Build a Regulatory Change Register Before January 2027

The 2027 calendar for US banks and credit unions is filled with uncertainties. Relying on spreadsheets and email threads to track regulations can lead to chaos. This guide helps your GRC team build a change register that turns each regulatory obligation into a manageable, accountable task.

The Problem

Three dates are set in stone: the GENIUS Act and the OCC's stablecoin rule take effect on January 18, 2027, and FDIC signage compliance is due by April 1, 2027. Section 1071 data collection starts on January 1, 2028, with a grace period for good-faith errors through December 31, 2028. Meanwhile, rules without dates, like FinCEN's AML/CFT program rule and the CFPB's Section 1033 rewrite, loom large.

Fixed dates need milestones, and undated rules need triggers. Many teams handle fixed dates poorly and ignore undated rules, leading to last-minute scrambles. A well-structured register lets your team plan ahead, giving you a strategic edge by committing resources early and reducing rework.

What You Need Before Starting

• A system of record. Use an Integrated Risk Management (IRM) or GRC Platform with workflow, ownership fields, and reporting. A controlled spreadsheet can work initially, but plan to upgrade.
• An inventory of policies, procedures, controls, disclosures, and systems. You can't map changes to assets you haven't identified.
• Your institution's lead-time policy. Set readiness milestones based on internal policy, not guesswork.
• Existing board or committee reporting formats. Integrate with these, don't replace them.
• Named decision-makers for applicability calls, typically from compliance, legal, and relevant business lines.

Step-by-Step Implementation

Step 1: Create the Register Schema

For each rule, include fields like rule name, issuing body, status (final, proposed, enjoined), effective or compliance date, applicability decision, decision owner, decision date, accountable owner, readiness milestone, mapped assets, trigger event (for pending rules), and current status.

Step 2: Record Applicability for Every Rule

Document whether each rule applies, which business lines it affects, and who made the decision. Be specific about scope boundaries:

• The FDIC signage rule applies to FDIC-insured institutions. Credit unions follow NCUA requirements.
• The OCC's GENIUS Act rule applies to national banks and other OCC-supervised entities issuing payment stablecoins. If not applicable, record "not applicable" with a rationale.
• Section 1071 applies to lenders with 1,000 or more covered originations in each of two look-back years. Pull origination counts by year now.

Step 3: Assign One Owner and One Milestone

Assign a single accountable individual per rule. Set the readiness milestone ahead of the effective date using your lead-time policy. For January 18, 2027, work backward from the date and enter the results in the register.

Step 4: Perform Control Objective Mapping

Link each rule to the policies, procedures, controls, disclosures, and systems it affects. Examples include:

• FDIC signage: digital deposit channel disclosures, ATM screens, and signage inventories.
• Section 1071: loan origination system fields, data capture procedures, data governance controls.
• GENIUS Act and OCC rule (if applicable): reserve asset, redemption, risk management, and custody controls.

Each mapped item becomes a testable change. If you can't name the control that changes, the mapping isn't complete.

Step 5: Build the Watch List for Undated Rules

For each pending rule, record the trigger that starts work, usually the publication of a final rule. Examples include:

• FinCEN AML/CFT program rule: Trigger is the final rule publication.
• CFPB Section 1033: Trigger is a revised final rule with new dates.
• Basel III endgame: Trigger is the final rule.
• Third-party risk management guidance: Trigger is agency finalization after comments close.

Pre-build a response template for each watch item so a trigger event initiates work quickly.

Step 6: Wire Up Reporting

Incorporate register status into existing board or committee reports. Show each rule's milestone, owner, and status (on track, at risk, blocked). Avoid creating separate reports; integrate with existing processes.

Validation

Test the register as an examiner would:

1. Completeness check. Randomly select five rules. Can you trace each from applicability decision to owner to mapped controls to testing evidence?
2. Date backward test. Confirm readiness milestones exist for each fixed date and have an owner.
3. Orphan check. Ensure no rules lack an owner, milestone, or mapped assets.
4. Trigger drill. Simulate a final rule publication for a watch-list item. Measure how quickly an impact assessment and owner assignment occur.
5. Evidence check. Ensure testing can produce evidence before the effective date.

Maintenance

• Weekly: Review the watch list for agency releases, court rulings, and comment-period closings.
• Monthly: Reconcile register status against milestones and escalate any issues.
• Per trigger event: Execute the response template, set dates, assign owners, and update board reporting.
• After each effective date: Close the item only after post-implementation testing confirms the change.
• Annually: Revisit applicability decisions. Section 1071 coverage depends on origination counts that change.

The register succeeds when business line owners treat milestones as commitments and compliance treats applicability calls as documented decisions. Review the register in the same meetings where product and technology roadmaps are set, so regulatory dates are planning inputs from the start.