Purpose
Regulatory change assessments fail by paraphrasing. Someone reads a summary,
writes "we need to enhance monitoring", and eighteen months later the regulator
asks which paragraph that maps to. This skill breaks the instrument into atomic,
individually testable obligations tied to provision references, and treats "we
already do this" as a claim requiring evidence.
Data classification
Confidential, potentially privileged. A gap assessment is a written record of
where the organisation does not comply. Assume a regulator or a claimant may see
it, and consider with counsel whether it should be produced under privilege.
STOP CONDITIONS:
| Trigger |
Action |
| The work is part of, or responsive to, an investigation, enforcement action, skilled-person review, or litigation |
Stop. Privilege and disclosure decisions come first. Route to counsel. |
| Counsel's advice or a without-prejudice regulator communication is pasted |
Stop. Do not summarise or excerpt privileged material. |
| Customer, client or employee personal data is pasted as an example of the issue |
Stop. Assessment works on obligations and controls, not on records. Ask for it to be removed. |
| Client positions, balances, transactions or account identifiers appear |
Stop. Name the category, not the value; ask for a de-identified extract. |
| The user asks for a legal conclusion on whether the firm is in breach |
Stop short of the conclusion. Produce the obligation, the evidence gap, and the question. Breach determination and any notification decision belong to counsel and the regulator-facing function. |
NON-FABRICATION RULE. Never state a requirement, threshold, deadline,
reporting frequency, or scope from memory, from a news summary, from a law-firm
briefing, or from a similar rule in another jurisdiction. Every obligation row must
quote or cite the supplied provision. Never assert that an existing control
satisfies an obligation without the control's documented description and evidence
of operation — an unevidenced "already covered" is the most expensive line in the
whole document. If the instrument text was not supplied, the output is
SOURCE TEXT NOT SUPPLIED — no obligations can be extracted.
Prerequisites
- Inputs (mandatory): the text of the instrument, rule, or guidance — the
actual provisions, not a summary.
- Inputs (mandatory): which regulator(s) and which jurisdiction(s) apply to the
organisation. Ask. Do not assume; the same activity is regulated differently
by different authorities, and multi-jurisdiction firms face overlapping and
sometimes conflicting versions of the same duty.
- Inputs (mandatory): the entity's regulated permissions, activities, size and
client categories — applicability turns on these.
- Inputs (needed for gap assessment): the current control set — policies,
procedures, systems, reports — with owners.
- Inputs (needed for planning): the dates: publication, in-force, transitional
end, first reporting date.
- Access: none required.
If the provision text is absent, stop. Everything else is guesswork wearing a table.
Procedure
1. Applicability test — run before extraction
Answer, with the provision that decides each: does it apply to this entity type ·
these permissions or activities · these client or counterparty categories · this
jurisdiction and any extraterritorial reach · above or below any size threshold ·
within the transitional period or after. Record APPLIES / DOES NOT APPLY /
UNCLEAR — question for counsel, each with the citation. A single "UNCLEAR" on a
scoping provision blocks the rest — resolve it first rather than assessing both
branches in parallel.
2. Extract atomic obligations
One obligation per row. An obligation is atomic when it has a single actor, a
single verb, and a single testable outcome. "Firms must establish, maintain and
evidence a policy and report annually" is four obligations, not one.
| Field |
Rule |
| Reference |
The provision number. Mandatory. No row without one. |
| Obligation text |
Quoted, not paraphrased |
| Actor |
Who must do it — the entity, a specific function, a named officer role |
| Verb class |
Prohibit / require an act / require a record / require a report / require a disclosure / require governance |
| Trigger |
Continuous, event-driven, or periodic — with the period |
| Deadline |
The date, or the event plus the elapsed time |
| Evidence expected |
What a supervisor would ask to see |
Guidance and supervisory expectations are recorded as a separate class from
binding rules. Do not merge them; the response to each differs, and blending them
inflates the programme.
3. Map to existing controls — evidence, not assertion
| Status |
Requires |
| Satisfied |
Named control, its owner, its documentation, and evidence it operated in the period |
| Partial |
Named control plus the specific element it does not cover |
| Not satisfied |
Nothing exists |
| Unknown |
Nobody could confirm — treat as Not satisfied for planning, and record the ownership gap separately, because it is its own finding |
"Business as usual" and "covered by the existing framework" are not statuses.
Reject them and ask which named control, owned by whom.
4. Assess impact per function
For each gap, state the affected functions and what specifically changes: policy
text, procedure, system change, data capture, new report, training, contract terms
with clients or vendors, disclosure, governance forum, records retention. Contract
and vendor impacts are the most commonly missed, because they need a counterparty's
agreement and therefore the longest lead time.
5. Plan backwards from the compliance date
Work back from the deadline, not forward from today. Every gap gets an owner
(role), a delivery date, and its dependency. Then apply the reality tests:
- Does any item require a system release? Check it against the release calendar.
- Does any item require a counterparty to sign something? Add negotiation time.
- Does any item require training? That is a capability item — route it onward.
- Is the first evidence date before the first reporting date? If not, the firm
will report on a period it cannot evidence.
- What is the interim position if an item lands late? Name the compensating
control, or state that there is none.
6. Output
Deliver: applicability determination with citations · obligation register ·
control mapping with evidence · gap list by function · plan with owners and dates
back-solved from the deadline · items requiring counsel · explicit list of
provisions not assessed and why. Date the assessment and record the version of the
instrument used — rules change during implementation, and an undated assessment
cannot be re-based.
Boundaries
- Not for determining whether a breach occurred, or whether to notify a
regulator. That is counsel's and the regulator-facing function's decision.
- Not for interpreting ambiguous provisions as though the answer were settled —
ambiguity is an output, routed to counsel.
- Not for commercial contract review — that is
legal-compliance-contract-review.
- Not for writing the resulting policy — that is
legal-compliance-policy-drafting.
Hand-offs
- Receives from: regulatory horizon scanning, or a regulator publication.
- Routes to:
legal-compliance-policy-drafting for every gap needing a policy or
standard change, carrying the provision reference with it.
- Routes to:
legal-compliance-policy-drafting so each new obligation lands as a
testable control statement with a defined evidence artefact.
- Routes to:
hr-training-needs-analysis when an obligation creates a competence
requirement with a date.
- Routes to:
legal-compliance-contract-review when client or vendor terms must
change to comply.
1---2name: legal-compliance-regulatory-change-impact3description: Converts a regulatory change into an atomic obligation register, tests applicability before assuming the rule bites, maps each obligation to the existing control that satisfies it, and produces a dated remediation plan — refusing to state what a rule requires from a summary, a press article, or memory rather than the supplied provision text. Use when a regulator publishes a new or amended rule, a consultation closes, a supervisory statement or guidance lands, a compliance deadline is approaching, or someone asks what a change means for the business. Trigger on 'new regulation', 'regulatory change', 'what does this rule mean for us', 'impact assessment', 'compliance deadline', 'gap analysis against the rules', 'guidance published'. Not for reviewing a commercial contract's clauses (use legal-compliance-contract-review) or for writing the internal policy that implements the change (use legal-compliance-policy-drafting).4---56## Purpose78Regulatory change assessments fail by paraphrasing. Someone reads a summary,9writes "we need to enhance monitoring", and eighteen months later the regulator10asks which paragraph that maps to. This skill breaks the instrument into atomic,11individually testable obligations tied to provision references, and treats "we12already do this" as a claim requiring evidence.1314## Data classification1516**Confidential, potentially privileged.** A gap assessment is a written record of17where the organisation does not comply. Assume a regulator or a claimant may see18it, and consider with counsel whether it should be produced under privilege.1920**STOP CONDITIONS:**2122| Trigger | Action |23| --- | --- |24| The work is part of, or responsive to, an investigation, enforcement action, skilled-person review, or litigation | Stop. Privilege and disclosure decisions come first. Route to counsel. |25| Counsel's advice or a without-prejudice regulator communication is pasted | Stop. Do not summarise or excerpt privileged material. |26| Customer, client or employee personal data is pasted as an example of the issue | Stop. Assessment works on obligations and controls, not on records. Ask for it to be removed. |27| Client positions, balances, transactions or account identifiers appear | Stop. Name the category, not the value; ask for a de-identified extract. |28| The user asks for a legal conclusion on whether the firm is in breach | Stop short of the conclusion. Produce the obligation, the evidence gap, and the question. Breach determination and any notification decision belong to counsel and the regulator-facing function. |2930**NON-FABRICATION RULE.** Never state a requirement, threshold, deadline,31reporting frequency, or scope from memory, from a news summary, from a law-firm32briefing, or from a similar rule in another jurisdiction. Every obligation row must33quote or cite the supplied provision. Never assert that an existing control34satisfies an obligation without the control's documented description and evidence35of operation — an unevidenced "already covered" is the most expensive line in the36whole document. If the instrument text was not supplied, the output is37`SOURCE TEXT NOT SUPPLIED — no obligations can be extracted`.3839## Prerequisites4041- **Inputs (mandatory):** the text of the instrument, rule, or guidance — the42 actual provisions, not a summary.43- **Inputs (mandatory):** which regulator(s) and which jurisdiction(s) apply to the44 organisation. **Ask.** Do not assume; the same activity is regulated differently45 by different authorities, and multi-jurisdiction firms face overlapping and46 sometimes conflicting versions of the same duty.47- **Inputs (mandatory):** the entity's regulated permissions, activities, size and48 client categories — applicability turns on these.49- **Inputs (needed for gap assessment):** the current control set — policies,50 procedures, systems, reports — with owners.51- **Inputs (needed for planning):** the dates: publication, in-force, transitional52 end, first reporting date.53- **Access:** none required.5455If the provision text is absent, stop. Everything else is guesswork wearing a table.5657## Procedure5859### 1. Applicability test — run before extraction6061Answer, with the provision that decides each: does it apply to this entity type ·62these permissions or activities · these client or counterparty categories · this63jurisdiction and any extraterritorial reach · above or below any size threshold ·64within the transitional period or after. Record `APPLIES` / `DOES NOT APPLY` /65`UNCLEAR — question for counsel`, each with the citation. A single "UNCLEAR" on a66scoping provision blocks the rest — resolve it first rather than assessing both67branches in parallel.6869### 2. Extract atomic obligations7071One obligation per row. An obligation is atomic when it has a single actor, a72single verb, and a single testable outcome. "Firms must establish, maintain and73evidence a policy and report annually" is four obligations, not one.7475| Field | Rule |76| --- | --- |77| Reference | The provision number. Mandatory. No row without one. |78| Obligation text | Quoted, not paraphrased |79| Actor | Who must do it — the entity, a specific function, a named officer role |80| Verb class | Prohibit / require an act / require a record / require a report / require a disclosure / require governance |81| Trigger | Continuous, event-driven, or periodic — with the period |82| Deadline | The date, or the event plus the elapsed time |83| Evidence expected | What a supervisor would ask to see |8485Guidance and supervisory expectations are recorded as a separate class from86binding rules. Do not merge them; the response to each differs, and blending them87inflates the programme.8889### 3. Map to existing controls — evidence, not assertion9091| Status | Requires |92| --- | --- |93| Satisfied | Named control, its owner, its documentation, and evidence it operated in the period |94| Partial | Named control plus the specific element it does not cover |95| Not satisfied | Nothing exists |96| Unknown | Nobody could confirm — treat as Not satisfied for planning, and record the ownership gap separately, because it is its own finding |9798"Business as usual" and "covered by the existing framework" are not statuses.99Reject them and ask which named control, owned by whom.100101### 4. Assess impact per function102103For each gap, state the affected functions and what specifically changes: policy104text, procedure, system change, data capture, new report, training, contract terms105with clients or vendors, disclosure, governance forum, records retention. Contract106and vendor impacts are the most commonly missed, because they need a counterparty's107agreement and therefore the longest lead time.108109### 5. Plan backwards from the compliance date110111Work back from the deadline, not forward from today. Every gap gets an owner112(role), a delivery date, and its dependency. Then apply the reality tests:113114- Does any item require a system release? Check it against the release calendar.115- Does any item require a counterparty to sign something? Add negotiation time.116- Does any item require training? That is a capability item — route it onward.117- Is the first evidence date before the first reporting date? If not, the firm118 will report on a period it cannot evidence.119- What is the interim position if an item lands late? Name the compensating120 control, or state that there is none.121122### 6. Output123124Deliver: applicability determination with citations · obligation register ·125control mapping with evidence · gap list by function · plan with owners and dates126back-solved from the deadline · items requiring counsel · explicit list of127provisions not assessed and why. Date the assessment and record the version of the128instrument used — rules change during implementation, and an undated assessment129cannot be re-based.130131## Boundaries132133- **Not for** determining whether a breach occurred, or whether to notify a134 regulator. That is counsel's and the regulator-facing function's decision.135- **Not for** interpreting ambiguous provisions as though the answer were settled —136 ambiguity is an output, routed to counsel.137- **Not for** commercial contract review — that is138 `legal-compliance-contract-review`.139- **Not for** writing the resulting policy — that is140 `legal-compliance-policy-drafting`.141142## Hand-offs143144- Receives from: regulatory horizon scanning, or a regulator publication.145- Routes to: `legal-compliance-policy-drafting` for every gap needing a policy or146 standard change, carrying the provision reference with it.147- Routes to: `legal-compliance-policy-drafting` so each new obligation lands as a148 testable control statement with a defined evidence artefact.149- Routes to: `hr-training-needs-analysis` when an obligation creates a competence150 requirement with a date.151- Routes to: `legal-compliance-contract-review` when client or vendor terms must152 change to comply.
alihusains