Regulatory change management: horizon scanning and an obligations register for a lean firm

The FCA has published a policy statement that changes a rule you rely on, and you found out from a client, not your own process. For a compliance officer at a UK regulated firm of 25 to 250 people, that is the real risk in regulatory change management: not the rule itself, but learning about it late.

Regulatory change management is how a firm spots new or changed rules, decides whether they apply, assigns owners and deadlines, and updates its obligations, policies and controls in time. For a small firm, scan named sources weekly, triage monthly, record outcomes in the obligations register and report a summary to the board each quarter.

This guide gives you that process in a form one person can run: the sources to scan, the triage questions, the register that holds it together, and what the board should see.

What is regulatory change management?

Regulatory change management is the repeatable process a firm uses to find regulatory changes, judge which ones apply, plan the work, and prove the work was done. It sits inside the wider compliance function, alongside monitoring and reporting, and its output is an obligations register that stays current rather than a pile of saved alerts.

For how regulatory change fits with the rest of a compliance function, see our compliance hub. The short version is that regulatory change management has three parts.

• Horizon scanning finds what is coming.
• Triage and impact assessment decide what it means for you.
• Implementation and evidence make the change real and show it happened.

The process below covers all three, so a scan ends in evidence, not a saved alert.

Which sources should a small firm scan for regulatory change?

A small UK regulated firm should scan a fixed, named list of primary sources: the FCA's own publications, the Regulatory Initiatives Grid, the PRA if it is dual-regulated, the ICO and NCSC, Parliament for new legislation, and the EU Official Journal for any EU-regulated part of the group. A named list makes the scan repeatable and auditable.

The FCA publishes changes in a predictable pattern. Its guide to what it publishes says Consultation Papers "contain draft Handbook rules", that a Policy Statement "contains the final legal instrument", and that Handbook Notices are "published monthly (the day after our Board meets)". Every three months, a Quarterly Consultation Paper covers minor Handbook changes.

The Regulatory Initiatives Grid is the best single view of what is coming. It "sets out the planned regulatory initiatives for the next 24 months" from a forum whose members include the FCA, the PRA, the Bank of England, the ICO and The Pensions Regulator. The 10th edition, published in May 2026, lists 135 live initiatives.

New legislation follows its own path. The government's collection page tracks the Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025 to reform the NIS Regulations 2018 and still going through Parliament in October 2026. A Bill page belongs on the list as soon as the Bill could affect you, and its dates come from the Act once passed.

The cadences are our recommendation for a firm of this size, not a regulatory requirement. Adjust them to how often each source actually publishes something that touches your permissions.

A newsletter subscription is not a horizon-scanning process.

Newsletters and law firm briefings are useful for context, but they summarise the source on someone else's timetable. Scan the primary source, and use the briefing to understand it.

How does the regulatory change management process work?

The regulatory change management process runs in seven steps: scan, triage, impact assessment, plan, implement, evidence and close. We recommend a weekly scan, monthly triage and planning, and a quarterly report to the board. Each change becomes one record that moves through the steps, so nothing depends on memory or a single inbox.

1. Scan

Each week, the owner works through the source list and logs anything new in a change log: the source, the date, a one-line summary and a link to the primary document. Logging takes minutes. Judging comes later, so the scan stays quick and nothing is dropped because it looked minor.

2. Triage

Once a month, the owner takes every logged item through three triage questions (set out in the next section) and gives it one of three outcomes: not applicable, monitor, or act. Record the reason for each outcome. A "not applicable" decision with a reason is evidence of good governance; one without a reason is a gap.

3. Impact assessment

For each "act" item, assess what changes in your firm. Which obligations are new or different? Which policies, processes, controls, systems, contracts and training does the change touch? Which teams are affected? Keep this short and factual. How serious a missed obligation would be is a separate question, covered in our guide to compliance risk assessment.

4. Plan

Turn the impact assessment into actions, each with a named owner and a deadline that sits ahead of the rule's effective date. Take the effective date from the primary source, such as the Policy Statement or the legislation itself, never from a summary.

5. Implement

Owners make the changes: update the policy, change the process, configure the control, brief the staff. The compliance owner tracks progress at the monthly meeting and escalates anything that will miss its deadline.

6. Evidence

For each action, keep the record that shows it was done: the approved policy version, the change ticket, the training completion report. Link each record to the change and to the obligation in the register.

7. Close

Close the change only when every action has evidence and the obligations register reflects the new position. Note the closure date, so the next review can confirm the change is still working.

A change without evidence is a promise, not a change.

How do you triage a regulatory change?

Triage a regulatory change by asking three questions: does it apply to us, when does it take effect, and how much will it change what we do? The answers give each change an outcome (not applicable, monitor or act) and a priority, so the firm spends effort on the changes that matter and records why it set the others aside.

The one-year line is our recommendation, not a regulatory rule: act sooner on any change that needs a system build or new contract terms. Proposals deserve a light touch. A Consultation Paper tells you what may change, so log it, note the close date and decide whether to respond. Act on the final Policy Statement or legislation.

Some changes reach you indirectly. DORA, Regulation (EU) 2022/2554, applies from 17 January 2025 to EU financial entities, and a UK firm that serves them may find its requirements arrive through a contract instead of a regulator. Treat a contract clause that carries a regulation as a regulatory change in its own right.

What goes in an obligations register for regulatory change?

An obligations register is the record of what your firm must do, where each obligation comes from, who owns it, and how it is met. For regulatory change management, the register is the system of record: every closed change should leave the register more accurate than it was, with obligations linked to the policies, controls and evidence that meet them.

A register that only lists laws tells you what exists. A register that links each obligation to a control tells you whether you comply.

Write each obligation in your own words and link to the source. Rule text belongs in the FCA Handbook, not in your register, and a plain-English line is what an owner can act on.

Three fields make this a regulatory change register rather than a static list: Effective date, Last change and Next review. Together they show which entries a change touched and when each owner must look again. If you are building the register from scratch, including obligations that arrive through customer contracts, our guide to the compliance management system covers it.

The register links outwards. Each obligation points to its policies and controls, and each control points to its evidence. If you hold ISO 27001, the same structure supports Annex A 5.31, which covers identifying legal, statutory, regulatory and contractual requirements. If you are building the wider programme around the register, our guide to building a compliance programme covers how it fits.

ISO 37301:2021, the international standard for compliance management systems, also treats identifying compliance obligations and keeping them current as a core activity. You do not need certification to borrow that discipline.

How should you report regulatory change to the board?

Report regulatory change to the board once a quarter in a single page: the changes found, the triage outcomes, the actions open and overdue, and the changes coming in the next two quarters. The aim is a decision-ready summary, so the board can see that change is under control and step in where a deadline is at risk.

A useful quarterly summary covers five things.

1. New changes this quarter, with their triage outcome.
2. Open actions, with owner, deadline and status.
3. Overdue actions, with the reason and the recovery plan.
4. The look-ahead: material changes due in the next six months, drawn from the Regulatory Initiatives Grid and your monitor list.
5. Decisions needed, such as budget, resourcing or a risk the board must accept.

Keep the minutes. A board that has seen and challenged the summary each quarter is part of your evidence that regulatory change is governed, not just tracked.

When is regulatory change management software worth it?

Regulatory change management software is worth considering when the volume of relevant change outgrows what one person can scan and triage each month, when several entities or jurisdictions are in scope, or when the board needs an audit trail a spreadsheet cannot give. For a single-entity UK firm of 25 to 250 people, start with a disciplined spreadsheet register.

Ask four questions before buying anything.

• Volume. Is the weekly scan regularly taking more than a few hours?
• Scope. Do you hold permissions in several jurisdictions, or run several regulated entities?
• Traceability. Can you show the path from a rule to an obligation, a control and its evidence today?
• Ownership. Is there someone who will maintain the tool's content every week?

Software can speed up the scan and keep the audit trail. It cannot decide what applies to your firm or who owns the response. If the process does not work on a spreadsheet, it rarely works better in a tool.

What are the common mistakes in regulatory change management?

The common mistakes in regulatory change management are relying on briefings instead of primary sources, triaging without recording reasons, treating a policy update as the finish line, and keeping the change log apart from the obligations register. Each one leaves the firm unable to show its regulator that a change was found, judged and implemented in time.

• Scanning by inbox. Alerts from newsletters arrive whenever they arrive. A named source list with a weekly slot does not depend on anyone's inbox.
• No reasons on "not applicable". A dismissed change with no recorded reason looks the same as one that was missed.
• Stopping at the policy. Rewriting a policy does not change what staff do. The process, the control and the training have to change too, and each needs evidence.
• Two lists that never meet. A change log that does not update the obligations register leaves the register out of date the day the change closes.
• Dates from summaries. Effective dates in briefings can be wrong or out of date. Take them from the Policy Statement or the legislation.

An obligation with no owner is a risk nobody has accepted.

Frequently asked questions