Global businesses are operating in an ever-changing and increasingly complex regulatory landscape. It is of vital importance that these businesses can manage implementation and regulatory change programs effectively, on a global basis.

Even where firms do not have a significant global footprint they will, inevitably, be part of a global supply chain. Therefore, they must be proficient in managing interdependencies on a global basis (including third-parties based in other jurisdictions, with whom the firm interacts) and need to consider how any changes will impact those.

There are a number of risks inherent to global programs, which derive primarily from the complexity and jurisdictional reach of these projects. Understanding the unique requirements on a country-by-country basis is key to success. Once requirements have been mapped, there are the practical difficulties associated with finding a way to reconcile overlaps and divergences between different regimes, balancing the need to be compliant with the pressure on firms to run efficient businesses.

Practical steps for change projects

We are often asked to advise clients on the implementation and embedding of regulatory changes as part of significant global projects, and also to assist with any subsequent issues arising from them, including in the context of regulatory enquiries and investigations. We set out below some practical steps for firms looking to manage global implementation and change projects in rule-mapping, regulatory change and governance, including dealing with potential emerging issues and managing regulatory enquiries. 

At the outset, it is important that firms understand which activities, products and services are undertaken or delivered in each and every market in which they operate. It is also necessary to establish which key third-party dependencies underpin the operations on those products and services. The most effective way to manage this fact-finding exercise is likely to be by way of a central project team, which will need to have extensive discussions with local business leads in each relevant jurisdiction.

We often see firms holding a series of workshops with various business heads, to understand the business which is undertaken. We regularly support clients to conduct this due diligence and these fact-finding exercises. As part of this stage, terms of business and other relevant client and market-facing agreements will need be collated, to build a common understanding of the business that is undertaken – ultimately, depending on the outcome of the project, these documents may need to be updated to manage regulatory change. 

Defining laws, rules and regulations

Firms should create, maintain and update (when required) a rule register or inventory setting out all legal and regulatory obligations to which the business is subject in the markets in which it operates. This involves assigning someone with responsibility for reviewing the rule register or inventory, and creating a process for reviewing and updating the document.

A record should be made each time the document is updated, which details who was responsible for the update. In some cases, it may be necessary to consider laws, rules and regulations in a number of different jurisdictions, and a governance framework should be put in place through which upcoming changes are identified and escalated to the relevant teams.

Clients typically look to external advisors to put together these rule registers or inventories in the first instance and putting them together may require firms to take decisions on questions of interpretation which may not be clear cut. It is important that firms keep a record of previous versions so that, if required, they can identify the chronology of the changes that have been made.

Conducting a gap analysis

Once the firm has identified all the rules and requirements to which it is subject, it will then need to design a process to implement and embed those rules and requirements into the way it does business. This is likely to require a “gap analysis”, to enable the firm to evaluate where there are overlaps and discrepancies between different regimes.

Generally, we see clients assessing different legal regimes by reference to the commercial significance of jurisdictions. Clients usually start by analysing the requirements in the largest market in which they operate, and then use this as a base against which to cross-check other requirements. There is a difficult balance to be struck here between conducting a meaningful comparison, and getting so immersed in the detail that ‘red flag’ issues get lost. From a practical perspective, focusing on issues thematically may be beneficial, as it will help to focus minds on the key material issues.

Gap analysis needs to be done in a timely fashion, because it is the building block upon which an implementation program is built. It is important that, as part of this exercise, the firm identifies upcoming changes and it may be that those can be embedded early to avoid the firm having to repeat work multiple times. Once the gap analysis has been undertaken, the firm can then move towards designing its implementation framework. 

Embedding effective governance

Governance is at the heart of the effective management of any change initiative. Once firms are clear on what they need to do, they must make sure they invest adequately in their governance arrangements, and systems and controls, to ensure they can design, implement and operate effectively policies and procedures.

This should include:

• clear assignment and documentation of the roles and responsibilities of senior individuals in relation to regulatory rule interpretation and implementation;
• a clearly defined reporting and escalation process through which interpretations of regulatory requirements are reviewed and approved;
• allocation of appropriate and adequate resourcing in respect of regulatory compliance functions with sufficient expertise and experience in regulatory change programmes.   

Implementation planning

Whilst there is a set of “best practices”, there is no “one size fits all” approach by which firms should effect global implementation; approaches vary depending on a number of factors, such as the number of jurisdictions in which the firm operates, the particular activities that are undertaken in each of those jurisdictions, the size and structure of the business and so on. 

• Firms may decide to “gold-plate” across all jurisdictions, adopting a global framework that meets the various regulatory requirements of each jurisdiction in which the firm operates. Generally, firms that adopt this approach will identify the jurisdiction with the strictest standards and apply those across their business. The benefit of this approach is simplicity and harmonisation – this can make it easier to put in place policies, procedures and systems and controls to meet the relevant requirements.
  
  Conversely, implementing a global framework will mean that there will be some jurisdictions in which the firm is doing more than is required. This approach may be resisted by the business and it may mean that there are certain jurisdictions where the firm’s approach is “off market” compared to firms that have chosen to only comply with the requirements that apply in each relevant jurisdiction.
  
  In cases where a firm is looking to “gold plate” requirements or to otherwise deviate from the strict legal and regulatory requirements, that firm should consider whether it would be appropriate to liaise with its relevant local regulators to ensure the authorities are comfortable with any proposed model.
  
• On the other hand, firms may choose to adopt a jurisdiction-by-jurisdiction approach to compliance, and seek to only comply with the specific regulatory requirements that are relevant in each jurisdiction. Whilst this may mean that a firm is better aligned to the market in each jurisdiction in which it operates, this approach will result in less global harmonisation. It is likely to be associated with greater (and potentially duplicative) compliance costs, because the firm may need to build separate compliance frameworks for each jurisdiction. 
  
• In other cases, firms may decide to implement a hybrid approach, for example, gold-plating the approach to certain activities, but simultaneously complying with other activities on a jurisdiction by jurisdiction basis. This can create complexities from a policy, procedure and systems perspective. 

A careful evaluation of the most appropriate approach will need to be made on a case by case basis.

Some legal implementation projects will require changes to be made to the business. At one extreme (for example, in the context of Brexit), this may necessitate business to be transferred within the group to other entities, either in the same jurisdiction or based elsewhere. Often, these projects also need to be supported by a comprehensive exercise to review (and update) relevant documentation and agreements, with clients, counterparties and other market participants.

Engaging and communicating

In some instances, particularly where the regulatory environment is uncertain, firms may look to engage with regulators and other industry groups in order to obtain greater clarity on issues which are preventing a clear pathway to implementation. 

Another key component in terms of regulatory change projects and ensuring effective engagement with all key stakeholders, is considering at what stage is it appropriate to communicate with clients and counterparties. Some changes to, for example, client agreements may require client consent. Determining the method (and timing) for obtaining such consent and understanding what the firm will do if it has not obtained all relevant consents is a key component of an implementation project.

Seeking legal advice

Firms will periodically require legal advice, in order to understand the legal and regulatory obligations to which they are subject. This is particularly the case when there are ‘grey’ areas to interpret. Engaging with external legal counsel may have the benefit of providing a privilege wrapper in relation to difficult issues of interpretation as well as offering the firm some protection if issues with historic interpretation are identified or queries on the approach arise in future.

Engaging external advisors may also introduce a helpful independent review, particularly where different areas of the business want to take different approaches. A global multi-disciplinary law firm is well placed to help firms navigate interpretive and implementation challenges across all markets.

Emerging risks and issues

As the global implementation plan progresses, issues may arise which can be addressed quickly and without the need for a more formal internal review and remediation plan. Throughout the project lifecycle, firms should consider whether it might be appropriate to take proactive steps in the event that issues are identified (which might be ‘easy wins’ to rectify), as well as giving due consideration to issues in respect of which a more formal internal investigation might be appropriate.

For example, the issues may be more systemic and/or serious in nature and require suitable investigation to assess whether improvements or enhancements need to be made to the firm’s systems and controls.

Managing regulatory enquiries

As always, firms must ensure they are equipped to respond swiftly and accurately to enquiries received from regulators in respect of any regulatory change projects that are being implemented. Firms should ensure that their governance framework incorporates a process for responding to regulatory enquiries, including escalation to the board and senior management where appropriate, and an approval/sign-off process for correspondence with regulators.

For example, it might be helpful to nominate a member of senior management and/or the in-house legal team with the accountability for responding to the enquiry, to help control the narrative and ensure clarity around who is responsible for communications with the relevant regulators.  

Global implementation projects also need an effective and appropriate management framework. Timelines and milestones need to be set, and processes need to be put in place to ensure that project deliverables and costs are managed effectively.