Regulatory Change Management and Ethics: Implementation Discipline and Professional Judgment
This domain tests how a bank tracks regulatory changes, assesses impact, implements changes, and validates compliance. It also tests ethical judgment, conflicts of interest, confidentiality, and escalation.
Core rules
- Regulatory change management requires a reliable inventory of sources, identification of changes, impact assessment, assignment of ownership, policy and procedure updates, training, system changes, and validation.
- Effective dates matter. The bank must distinguish issuance date, adoption date, effective date, and mandatory compliance date, and track delayed or phased provisions.
- Impact assessment should cover products, forms, disclosures, systems, vendors, training, monitoring, and customer remediation.
- Validation should confirm the change was implemented as intended and is operating in practice.
- Ethics requires avoiding conflicts of interest, protecting confidential information, using bank resources appropriately, escalating concerns, and cooperating with examiners and auditors. “Legal” is not the same as “ethical.”
Worked example
A state enacts a new consumer data breach notification law effective in six months. Compliance logs the change, assigns legal and information security owners, assesses affected systems and vendor contracts, updates the incident response plan, trains staff, and schedules a tabletop test before the effective date. Reasoning: tracking the law is not implementation. The bank must show changed procedures, training, testing, and evidence that the new notice obligation can be met. If the bank waits until the effective date to update its vendor contracts, the change management process failed.
Traps that cost marks
- Treating regulatory change as only a legal department task.
- Missing the difference between adoption and effective date.
- Updating the policy but not the forms, systems, training, or monitoring.
- Ignoring ethics because no law was broken; conflicts and confidentiality breaches still matter.
- Failing to document decisions, escalations, and board reporting.
Exam focus
For each change, ask: who owns it, what must change, when is it effective, and how will the bank prove it was implemented?