Regulatory change management: implementing new rules reliably

Short answer: A regulatory change management process ensures that new rules are identified in time, assessed for relevance, analysed in a gap analysis and implemented as a project, with clear ownership of every step. It has six steps: horizon scanning, triage, gap analysis, implementation planning, implementation, and sign-off with evidence. For German credit institutions, the BaFin minimum requirements for risk management (MaRisk, AT 4.4.2) require the compliance function to identify the material legal rules at regular intervals.

This guide is for heads of compliance, general counsel and regulatory affairs leads at banks, insurers and other companies in Switzerland and Germany. It covers the process from scanning to evidence, the roles involved and the capacity needed at peak times.

The regulatory change management process at a glance

In banks and companies alike, regulatory change management follows a recurring cycle of six steps. Each step has a documented output and an owner.

A central register of all changes ties the steps together. For each rule it shows status, owners, application date and open gaps.

Horizon scanning and triage: spotting and sorting new rules

Horizon scanning picks up new rules early enough to leave time for implementation, and triage separates what matters from what does not. At German credit institutions this is expressly a compliance task: under MaRisk AT 4.4.2, the compliance function identifies the material legal rules on a risk basis at regular intervals, and its staff must be informed of material changes in good time. In Swiss banks, an annual assessment of compliance risk with a risk-based activity plan approved by senior management is one of the compliance function's minimum tasks (FINMA Circular 2017/1, margin no. 78).

Sources for horizon scanning

• the Official Journal of the EU and national law gazettes; in Switzerland, the Classified Compilation of federal law and consultation procedures (Vernehmlassungen);
• circulars, communications and consultations from FINMA, BaFin and the European supervisory authorities;
• industry associations and specialist information services;
• audit findings that point to changed supervisory expectations.

Triage criteria

• Does the rule apply to our legal form, licence, products and countries?
• When does it apply, and are there transitional periods?
• Which business functions and systems are affected?
• How big is the change compared with today: clarification, adjustment or new topic?

Companies operating in both Switzerland and the EU are often subject to both: Swiss law for the Swiss entity and EU law for subsidiaries or clients in the EU. Triage should record this per entity. Our regulatory calendar for legal and compliance lists upcoming deadlines.

Gap analysis: checking requirements against the current state

A gap analysis breaks a rule down into individual requirements and checks for each whether the company already meets it. It is the basis for budget and timeline. A proven approach:

1. Break the rule down into individual, testable requirements (requirements catalogue).
2. Assign each requirement to an accountable business function.
3. Capture the current state with evidence: policies, processes, systems, contracts.
4. Rate the gaps: met, partly met, not met.
5. Roughly estimate effort and dependencies for each gap.
6. Present the result and recommendation to management for a decision.

Record questions of interpretation and have them decided by the legal department or external advisers. A gap analysis without documented interpretation is hard to defend later.

Implementation project: from gap to evidence

The implementation project closes the gaps before the application date and proves it with evidence. Plan backwards from the deadline and reserve time for testing and sign-off. Two examples of deadlines that trigger implementation projects:

• DORA: financial entities in the EU have had to apply the Digital Operational Resilience Act since 17 January 2025 (Art. 64 DORA). Any remaining gaps are now handled as remediation. See our guide on DORA legal and compliance workstreams.
• AMLR: the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies directly from 10 July 2027 (Art. 90 AMLR). For affected companies in the EU, now is the time for gap analysis and implementation planning. Our guide on AMLR and AMLA gives an overview.

Typical work packages are updating policies and instructions, changing processes and controls, configuring systems, renegotiating contracts with service providers and training staff. The project ends with sign-off by compliance and handover to business as usual.

Roles and capacity

Regulatory change management needs clear overall ownership and flexible capacity, because large changes arrive in waves. Typical roles:

• Overall responsibility: management; operationally usually the head of compliance or regulatory affairs.
• Regulatory change leads: run horizon scanning and the register, facilitate triage, report to management.
• Legal counsel: interpret rules and update contracts and documents.
• Business owners: implement in their area and confirm implementation.
• Project lead: steers large changes with deadlines, budget and dependencies.
• Internal audit: independently checks that the process works and the evidence holds up.

Ongoing scanning and triage can usually be covered by internal staff. Gap analyses and implementation projects ahead of a deadline, by contrast, tie up considerably more capacity for several months. Alpinum Solutions provides compliance and legal professionals for this through staff leasing or freelancing, part-time or full-time, as individuals or project teams, from junior to senior level. Under staff leasing, the company gives the professional instructions; under freelancing, the professional works independently within the agreed mandate. Our guide on building a compliance management system shows how regulatory change fits into a CMS.

Limits and risks

• Responsibility for complying with new rules stays with management. External professionals analyse and implement but do not decide on interpretation or risk acceptance.
• Scanning without triage produces lists without consequences. Every rule captured needs a relevance decision and an owner.
• Deadlines and scope change, for example through postponements or exemptions. Check dates against the primary source before making project decisions.
• Alpinum is not a law firm and does not provide legal advice.

Frequently asked questions about regulatory change management

Who is responsible for regulatory change?

Overall responsibility lies with management. Operationally, the compliance function or a regulatory affairs team usually runs the process; at German credit institutions this includes the duty under MaRisk AT 4.4.2 to identify material legal rules regularly. Affected business functions are responsible for implementation. The legal department interprets the rules and internal audit reviews independently.

How early should implementation start?

The gap analysis should start as soon as the text of a rule is largely final, not shortly before the application date. Plan backwards from the deadline: testing, training and sign-off take time, and IT changes often take longest. For large changes such as the AMLR, which applies from 10 July 2027, planning should therefore begin well ahead of the deadline.

What is a regulatory gap analysis?

A regulatory gap analysis compares the requirements of a rule with the current state of the company. The rule is broken down into individual requirements, each is assigned to a business function and rated as met, partly met or not met. The result is a list of gaps with effort estimates, which forms the basis for budget, timeline and the implementation project.

Does regulatory change management need software?

Not necessarily. Smaller companies often work with a structured register and clear responsibilities. Software pays off when many rules, entities and countries need tracking, or when evidence must be centrally available for auditors. In every case, triage, owners and documented decisions matter more than the tool.

Can an interim professional carry out a gap analysis?

Yes. Experienced compliance officers or legal counsel who know the relevant rulebook often carry out gap analyses as a time-limited project. What matters is a clear mandate, access to the business functions and someone in the company who decides questions of interpretation. The result and implementation decisions remain with the company.

Next step

Describe the rule, the deadline and the profiles you need. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

• Regulatory compliance and regulatory change
• Regulatory calendar for legal and compliance
• Interim compliance
• Discuss your needs

Last updated: 30 October 2026.