Regulatory Change Management and Horizon Scanning: A Practical Guide for UK Firms

How UK financial regulation changes

The FCA rulebook is the FCA Handbook, and it changes through a defined publication cycle rather than by surprise. The FCA sets out on its website exactly what it publishes and why, and understanding those document types is the foundation of any credible change management process.

Most substantive rule changes begin with a consultation paper. In a consultation paper the FCA proposes changes to the Handbook and invites responses from its audiences, including the financial services industry and consumer organisations. Because the Financial Services and Markets Act requires the FCA to publish a cost benefit analysis of its proposals, consultations usually carry an assessment of the expected economic costs and benefits so respondents can engage with the trade-offs.

Once the consultation period is over and the FCA has considered the responses, it issues a policy statement. In a policy statement the FCA publishes its response to the answers it received to the original consultation questions and sets out its rules, and the statement contains the final legal instrument that amends the Handbook. Separately, the FCA publishes Handbook Notices, which provide an overview of the instruments the FCA Board has made and summarise the changes, so a Handbook Notice is often the clearest single confirmation that a change has been formally made.

Not everything is a rule. The FCA also uses discussion papers to open a debate on a topic before it has settled on a proposal, and guidance consultations to consult on non-Handbook guidance. A robust process treats each document type differently, because a discussion paper signals a possible future direction while a policy statement signals a firm deadline.

The compliance function's responsibility under SYSC

Regulatory change management is not an optional extra. It flows directly from the FCA's systems and controls requirements in the SYSC sourcebook, which place responsibility for staying compliant squarely on the firm.

SYSC 6.1.1 R requires a firm to establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm, including its managers, employees and appointed representatives, with its obligations under the regulatory system, and for countering the risk that the firm might be used to further financial crime. Keeping those policies and procedures adequate is impossible if the firm does not know when its obligations under the regulatory system have changed.

SYSC 6.1.3 R requires a firm to maintain a permanent and effective compliance function that operates independently and has, among its responsibilities, the duty to monitor and assess the adequacy and effectiveness of the measures and procedures in place and to advise and assist relevant persons in complying with the firm's regulatory obligations. Monitoring adequacy is inherently forward looking: a control that was adequate under last quarter's rules may fall short once a new requirement takes effect.

Read together, these rules mean the compliance function needs a live view of the regulatory pipeline, a way to test existing controls against incoming change, and a mechanism to advise the business. That is precisely what a regulatory change management framework provides.

Horizon scanning and the Regulatory Initiatives Grid

Horizon scanning is the systematic surveillance of the regulatory environment for developments that could affect the firm. Done well, it gives the firm lead time to plan rather than react. Done badly or not at all, it leaves the firm discovering requirements only once they are live.

One of the most useful primary sources for horizon scanning is the Regulatory Initiatives Grid, published by the Financial Services Regulatory Initiatives Forum. The Grid sets out the planned regulatory pipeline for financial services and is published twice a year, giving firms a forward look so they can understand and prepare for the timing of initiatives that may have a significant operational impact on them.

The Forum brings together the main UK financial regulators, so the Grid is a single coordinated view rather than a patchwork. Its members are the Bank of England, including the Prudential Regulation Authority, the Financial Conduct Authority, the Payment Systems Regulator, the Competition and Markets Authority, the Financial Reporting Council, The Pensions Regulator and the Information Commissioner's Office, with HM Treasury attending as an observer.

The scale of the pipeline explains why a structured approach matters. The tenth edition of the Grid, published on 19 May 2026, featured 135 live initiatives, with joint initiatives making up around a third of them. No firm should treat every initiative as equally relevant, which is why horizon scanning must be paired with a filter for applicability to your permissions, business model and customers. A structured control framework such as Nasara Connect's Control product helps firms triage that pipeline against the obligations that actually apply to them.

A regulatory change management process that works

A dependable process turns the flow of publications into a controlled sequence of steps, each with an owner and an output. The point is not bureaucracy for its own sake, but a clear audit trail showing the firm identified a change, understood it, planned for it, delivered it and checked it landed.

The steps below describe a full cycle. Not every change needs the same depth: a minor Handbook Notice clarification may pass through in hours, while a major policy statement with a phased implementation timetable may need a dedicated project. The value is in applying the same discipline consistently so nothing falls through the gap.

Assessing impact and setting priorities

Impact assessment is where horizon scanning earns its keep. The first question is always whether an initiative applies to the firm at all. A change to rules for a sector you do not operate in can be logged and closed; a change touching your regulated activities needs full analysis.

For changes that do apply, a proportionate assessment considers several dimensions: which permissions and regulated activities are affected, which policies and procedures need to change, whether systems or reporting must be updated, what the cost and resource implications are, and what the customer impact will be. The FCA's own consultations model this thinking, because the cost benefit analysis it publishes sets out the expected economic costs and benefits of a proposal, and firms can use that analysis as a starting point for their own estimates.

Prioritisation should follow risk and deadline, not the order in which changes happen to arrive. A high-impact change with a near-term implementation date outranks a low-impact change with a distant one. Recording the rationale for each priority decision is itself part of the evidence trail, because it demonstrates that the compliance function is monitoring and assessing adequacy in line with its SYSC duties rather than working through a queue at random.

Implementing and embedding change

Implementation is the visible work: updating policies, amending procedures, reconfiguring systems, revising customer communications and training staff. It should be planned backwards from the regulator's implementation date, with enough buffer to test the change before it goes live rather than on the day it becomes mandatory.

Embedding is the step firms most often shortcut, and it is where good intentions quietly unravel. A policy that is updated but never trained on, or a control that is designed but never monitored, does not deliver compliance in practice. Embedding means the change becomes part of how the business runs day to day, supported by refreshed controls, staff who understand the new expectation, and management information that shows it is working.

Finally, assurance closes the loop. Testing that the change has taken effect, and retaining evidence of that testing, allows the compliance function to advise senior management with confidence and to demonstrate to the FCA that the firm keeps its policies and procedures adequate as its obligations evolve. Firms that are still building this capability, or moving into new regulated activities, can find that the change management discipline and the authorisation process reinforce each other, which is why many firms address both together when they seek or vary FCA authorisation.

Conclusion

Regulatory change management is not a single project but a permanent capability. UK rules change through a defined cycle of consultation papers, policy statements and Handbook Notices, supplemented by supervisory letters, and the Regulatory Initiatives Grid gives firms a twice-yearly forward look at what is coming. The firms that cope best are the ones that treat these sources as inputs to a repeatable process rather than as interruptions.

The regulatory expectation is clear. Under SYSC the compliance function must keep the firm's policies and procedures adequate and monitor their effectiveness, which is only possible with reliable horizon scanning, disciplined impact assessment and evidenced implementation and embedding. Build the process once, run it consistently, and regulatory change becomes something you manage rather than something that manages you.

Frequently asked questions