Read with the right scope
Suggested operating method for UK organisations. Applicable duties depend on your activities, sector, legal form and jurisdiction.
Status: Practical implementation guide
Start with applicability
A useful obligations register answers a business question: what must this organisation do, who does it, and what will show that it happened? Start with the legal entities, services, customers, locations, regulators and material contracts in scope. A requirement affecting one regulated service may not apply across the whole group.
Separate legislation, binding regulatory rules, official guidance, contractual promises and voluntary standards. Record the reason for including each item. Keep a reasoned exclusion where scope is uncertain or an exception is relied on, with an owner and a trigger to revisit it. Seek appropriate advice where the interpretation could materially affect the business.
Give each obligation a working record
Use one row for a requirement that has a clear operational outcome. Avoid copying an entire Act into a spreadsheet or treating a link to a policy as proof of performance.
- Reference and source: official URL, relevant provision, version checked and legal status.
- Applicability: affected entity, activity, customer group and explanation of scope.
- Delivery: accountable owner, control, procedure and supporting system.
- Evidence: record location, retention decision and who can inspect it.
- Assurance: test method, review date, exceptions and outstanding action.
Turn change into an owned task
Run a regular source review proportionate to your exposure. The FCA Regulatory Initiatives Grid is a planning resource for financial services; its published timings can change and the edition is a snapshot. Follow the originating authority for the operative rule and confirmed date. Other organisations need their own sector and activity source list.
For each material change, record the announcement date separately from the effective date. Identify affected policies, systems, notices, contracts, training and customer communications. Set a delivery owner, dependencies, an approval route and a test before closing the action. Mark consultations and proposals as such.
Close only when the outcome is evidenced
A completed drafting task does not establish that a control works. Select a recent transaction or process run and follow it through the amended procedure. Record missing evidence and any interim safeguard. Report overdue material changes and unresolved interpretation questions to the appropriate decision-maker.
This register is a suggested management method, not a statutory format or a certificate of compliance. A small organisation can begin with its most consequential obligations, provided the scope limitations remain visible and the register is maintained.
Put the guide to work
Start with the evidence.
- A primary-source reference and the status and version checked.
- A reasoned applicability or exclusion decision for the relevant entity and activity.
- A recent process record showing how the requirement is delivered.
- A change review linking affected procedures, implementation work and post-change verification.
Your first three steps
- Choose one consequential requirement and identify the entity and activity it affects.
- Translate it into an operational outcome and name the person responsible for delivery.
- Follow a recent example through the process and record any missing proof or unresolved interpretation.
Common gaps to look for
- An entire Act is copied into one row without a usable outcome.
- Guidance, proposed changes and contractual promises are treated as the same legal category.
- A policy link substitutes for evidence that the requirement was fulfilled.
Review when: Review when the official source, affected activity, contract or jurisdiction changes, or implementation evidence contradicts the recorded position.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the compliance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- FCA — Regulatory Initiatives Grid, May 2026 edition and scope ↗Source checked 1 November 2026 · Primary source
- ICO — Leadership and oversight ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.