Regulatory Mapping

Produce a comprehensive regulatory requirement matrix that maps each business process step to the specific regulatory requirements it must satisfy, identifies gaps where no control exists, and provides the foundation for a compliance program.

Step 1: Entity and Product Classification

Identify exactly what the client is and does, because regulatory obligations are entity- and product-specific.

Entity type (select all that apply):

Insurance:

Insurance agent (licensed individual or agency)
Insurance broker
Managing General Agent (MGA) — has binding authority
Managing General Underwriter (MGU) — no binding authority
Admitted carrier (licensed in state, subject to rate/form filing)
Non-admitted / surplus lines carrier
Third-Party Administrator (TPA)
Reinsurer

Mortgage:

Mortgage broker (originates, does not fund)
Mortgage banker / non-bank lender (originates and funds, sells to secondary market)
Portfolio lender (originates and holds)
Mortgage servicer (collects payments, loss mitigation)
Correspondent lender

Financial Services:

Registered Investment Advisor (RIA)
Broker-dealer (FINRA member)
Dual registrant (RIA + BD)
Bank or credit union (state or federally chartered)
Money services business (MSB)

Product lines and states (document each combination):

Product Line	States of Operation	License Type Held	License Numbers
[e.g., Personal lines P&C]	[e.g., TX, CA, FL]	[e.g., Insurance Agency]	[License #s]

Step 2: Regulatory Universe Identification

Based on entity type and product lines, enumerate all applicable regulations.

Federal regulations (apply regardless of state):

Regulation	Full Name	Administering Agency	Summary of Applicability
RESPA	Real Estate Settlement Procedures Act	CFPB	Mortgage: settlement costs, kickbacks, escrow
TRID	TILA-RESPA Integrated Disclosure	CFPB	Mortgage: LE and CD disclosures
HMDA	Home Mortgage Disclosure Act (Reg C)	CFPB	Mortgage: LAR data collection and reporting
ECOA/Reg B	Equal Credit Opportunity Act	CFPB	Credit: adverse action, fair lending
FCRA	Fair Credit Reporting Act	CFPB + FTC	Credit: permissible purpose, adverse action
Dodd-Frank QM/ATR	Ability to Repay / Qualified Mortgage	CFPB	Mortgage: underwriting standards
BSA/AML	Bank Secrecy Act / Anti-Money Laundering	FinCEN	All financial: CIP, SAR, CTR
GLBA	Gramm-Leach-Bliley Act / Safeguards Rule	FTC / banking regulators	All financial: privacy, data security
CAN-SPAM	CAN-SPAM Act	FTC	Email marketing
TCPA	Telephone Consumer Protection Act	FCC	Phone/text marketing
FINRA 4511	FINRA Recordkeeping Rule	FINRA	BD: books and records
SOX	Sarbanes-Oxley Act	SEC	Public companies: financial reporting controls

State regulations (document per state):

For each state of operation, identify:

Insurance code and regulations (administered by state DOI)
Mortgage banking / lending statutes (state banking dept or DOI)
State consumer protection statutes
State privacy laws (CCPA/CPRA for CA; others as applicable)
State recording consent laws (one-party vs. two-party)
State unclaimed property laws

Step 3: Requirement Extraction

For each regulation in the universe, extract the specific operational requirements — what must the business do, not just what the law says.

Requirement format:

REQ-[Regulation]-[N]:
Regulation: [Reg name and specific section/rule]
Requirement: [Plain English description of what must happen operationally]
Applies to: [Which entity types, product lines, or states]
Frequency: [Per transaction / Monthly / Annually / Ongoing]
Evidence required: [What documentation proves compliance]
Failure consequence: [Regulatory action, fine, license revocation, civil liability]

Example extractions:

REQ-TRID-001:
Regulation: TRID / Reg Z § 1026.37
Requirement: Deliver Loan Estimate within 3 business days of receiving application (6 triggers)
Applies to: All mortgage lenders and brokers
Frequency: Per loan application
Evidence required: LE issuance date, delivery confirmation, application date
Failure consequence: CFPB enforcement, inability to collect fees before LE delivery

REQ-NAIC-001:
Regulation: NAIC Unfair Trade Practices Act (adopted by most states)
Requirement: Acknowledge receipt of a claim within 10 working days; accept or deny within 45 days
Applies to: Admitted carriers, some TPAs
Frequency: Per claim
Evidence required: Claim acknowledgment log, acceptance/denial letters with dates
Failure consequence: State DOI market conduct citation, fines

Step 4: Process Mapping

Map each regulatory requirement to the business process step(s) where it must be implemented.

Process mapping table:

REQ ID	Regulation	Requirement Summary	Process Area	Process Step	Step Owner	System	Gap?
REQ-TRID-001	TRID / Reg Z § 1026.37	LE within 3 business days	Loan origination	Application intake → LE generation	Loan processor	LOS	[Yes/No]

Process areas to map (adjust for client):

Insurance:

Marketing and lead generation
Application intake and data collection
Underwriting and risk assessment
Quote and bind
Policy issuance
Endorsements and policy changes
Renewals
Cancellations and non-renewals
Claims intake
Claims investigation and adjudication
Claims payment
Compliance monitoring and reporting
Producer licensing management

Mortgage:

Lead generation and marketing
Pre-qualification
Loan application intake
Disclosure delivery (LE, CD, ECOA, FCRA)
Processing and document collection
Underwriting
Appraisal and title
Closing preparation and CD delivery
Closing and funding
Post-close and trailing documents
Secondary market delivery
Servicing (if applicable)
Loss mitigation and default (if applicable)

Step 5: Control Identification

For each requirement mapped to a process step, identify the control that satisfies it.

REQ ID	Process Step	Control Description	Control Type	Automated?	Evidence Produced
[REQ ID]	[Step]	[What the control does]	Preventive / Detective	Yes / No	[Log, report, document]

Where no control exists, mark as GAP and proceed to Step 6.

Step 6: Gap Identification and Evidence Matrix

Gap summary:

REQ ID	Requirement	Gap Description	Risk Level	Remediation
[ID]	[Requirement]	[What is missing or inadequate]	Critical / High / Medium / Low	[Specific action]

Evidence matrix — what a regulator would request:

REQ ID	Requirement	Evidence Type	Produced By	Stored Where	Retention Period

Output Format

Deliver one integrated artifact — the Regulatory Requirement Matrix — as a structured table with these columns:

Accompany with:

Regulatory Universe Summary — Bullet list of all applicable regulations with one-line description
Gap Priority List — Top gaps ordered by risk level (Critical first), with owner and target remediation date
Open Items — Regulatory requirements where client must provide clarification before mapping can be completed