Regulatory Environment and Legal Obligations
This domain tests your ability to identify which obligations actually bind an organization, where they come from, and how to keep that picture current - and to separate a legal requirement from a good-practice framework.
Where obligations come from
- Statute and case law; regulations and rules issued by regulators; supervisory guidance, which is often an expectation rather than a rule; licences and permits.
- Contract: customer terms, loan covenants, PCI DSS flow-downs, supplier codes. Contractual obligations bind even where no law requires them.
- Standards and frameworks (ISO 27001, COSO, NIST) are not law. They become binding through contract, incorporation by reference in regulation, or as a supervisory expectation.
Reading the text
"Shall" and "must" are mandatory; "should" is expected unless justified otherwise; "may" is permissive. Principles-based regimes (UK Bribery Act adequate procedures, GDPR accountability) require you to demonstrate a reasonable system, not merely a rule followed. Prescriptive regimes specify the control itself.
Extraterritorial reach
- FCPA: US nexus through an issuer, a domestic concern, or conduct in US territory.
- UK Bribery Act s.7: strict-liability offence for commercial organizations with a UK nexus that fail to prevent bribery by associated persons, with an adequate-procedures defence.
- GDPR Art 3: establishment in the EU, or targeting or monitoring EU data subjects.
- Sanctions: OFAC for US persons and USD flows, UK OFSI, EU regimes.
The obligation register
For each obligation record: source and citation, the requirement, the applicability rationale, the owner, mapped controls, evidence, review cadence, and change triggers such as new guidance or enforcement action.
Worked example
A UK-incorporated logistics company is a subsidiary of a US-listed parent, sells to EU customers, and has a Dubai sales office. Reasoning: FCPA - the parent is an issuer, so books, records, and internal-control provisions flow down to the group; UK Bribery Act s.7 - the UK entity is a commercial organization, so the Dubai office counts as an associated person; GDPR Art 3(2) - services offered to EU data subjects; sanctions - OFAC for USD transactions and OFSI for UK conduct.
Traps that cost marks
- Treating framework certification as legal compliance.
- Assuming local law is the only law that applies to a local entity.
- Leaving the register static when a regulator publishes new guidance.
- Reading "should" as optional.