Regulatory change management
Regulatory change management identifies new or changed regulation, assesses its impact on the bank and tracks implementation in policies, processes and controls.
The process runs from horizon scanning through applicability and impact analysis to implementation and evidence. Each relevant change gets an owner, is linked to the affected policies, processes, controls and systems, and is closed only when implementation has been demonstrated. MaRisk requires the compliance function to identify, at regular intervals and on a risk basis, the material legal rules and requirements whose breach could endanger the institution’s assets.
For the board, the question is not whether a new rule has been noticed but whether the bank will comply on the effective date. In Switzerland, the compliance function assesses the institution’s compliance risk every year and reports on it to the board of directors under FINMA Circular 2017/1; upcoming regulatory changes are a central input to that assessment.
Pitfalls include long lists of alerts without an applicability decision, impact analyses that stop at the policy level and never reach processes and controls, missing links between a requirement and its implementation, and no overview of which deadlines are at risk.
In practice
- 01Records each regulatory change with source, effective date, applicability decision and accountable owner.
- 02Maps affected requirements to policies, processes, controls and systems, and tracks each implementation task.
- 03Uses each relevant change as a trigger for an ad hoc review of the affected policies.
- 04Reports upcoming effective dates and implementation status to the executive board and escalates delays.
- 05Keeps evidence of implementation so that auditors can trace each requirement to its control.
How MRM-Solution supports it
- 01Follow supervisory news from 26 regulators and standard setters; gaps become pending rows in the requirements register.
- 02Derive the requirements into each policy’s register, every row with its origin, and count a row only after a person has approved it.
- 03See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com