Obligations register
Also called obligations library, compliance obligations register, regulatory inventory
An obligations register is a structured list of every regulatory requirement that applies to a firm, broken into individual duties. Each obligation is linked to an accountable owner, the policies and controls that meet it and evidence that those controls work. It is the backbone of regulatory change management and compliance monitoring.
How it works
Compliance teams break laws, rules and guidance into single obligations, often one sentence each. They tag each by business line, product and jurisdiction, then link it to an owner, a policy and one or more controls. When a rule changes, the team updates the affected obligations and the links show which policies, controls and procedures need work.
Without a register, firms struggle to show regulators how they meet a specific rule or who is responsible for it. Supervisors expect the compliance function to identify the laws, rules and standards that apply, as set out in the Basel Committee's 2005 compliance paper. A maintained register also gives the board and internal audit a clear view of coverage and gaps.
The rules
Sets principles for the compliance function, including identifying and assessing compliance risk under applicable laws, rules and standards.
Internationally active banks and their supervisorsRequires an organisation to identify its compliance obligations, assess their impact and keep them documented and up to date.
Any organisation seeking a certifiable compliance management systemCommon questions
What is the difference between an obligations register and a risk register?
An obligations register lists what the rules require. A risk register lists what could go wrong and how likely and severe it is. Many firms link the two, so a gap in meeting an obligation shows up as a compliance risk.
How detailed should an obligations register be?
Most firms record each obligation at the level of a single testable duty, such as a reporting deadline or a disclosure requirement. Very broad entries make it hard to link controls. Very granular entries create volume that is hard to maintain.
Who owns the obligations register?
The compliance function usually maintains the register. Each obligation has a business owner responsible for meeting it. In UK firms under the Senior Managers and Certification Regime, owners are often linked to senior managers' statements of responsibilities.
