Illustration: a regulator publishes a change, it splits into obligations, and each obligation connects to the policies, risks and controls that cover it. An obligation nothing covers is raised as an issue.
CalPrivacy · CCPA regulations mapped to policies, risks and controls
Built for
Banking
Insurance
Superannuation and pensions
Payments
Energy
Healthcare
Telecommunications
Law and advisory firms
How it works
Most organisations spread this work across separate tools and spreadsheets. nimmy connects it.
Work arrives as work. A regulatory change, an incident, a failed control test, a drifting model, an audit finding, a supplier due for reassessment or a slipping milestone each lands in a queue with an owner and a due date.
A regulation becomes obligations. Obligations map to policies, risks and controls, and anything left uncovered becomes an issue. Change one thing and nimmy shows everything it touches.
Owners, stewards, approvers and delegates on everything. Approvals that matter take a second person, and nothing closes on one signature.
Every decision, approval and change is recorded on a tamper-evident audit trail. A board pack or a regulator’s evidence request is a saved report, exported in seconds.
Also included: operations and critical services, third parties, accountability regimes, committees and board reporting, model governance, product approvals, scenario testing, training and reporting.
A risk register with appetite, indicators and scoring history. Controls that show whether they are working from tests, monitoring and incidents. Assurance across all three lines, plus issues and incidents.
Exposure read against appetite and every signal since the last score
Bow-ties, indicators, treatment and signed acceptance
Controls read as operating, degraded or failed
Tests signed off by someone other than the tester
Reviews by each line, with a coverage view
Incidents from detection to regulatory notification
One register for every requirement, whether it comes from law, a contract, a licence or your own policies. A policy library with versions and approvals. Licences and their conditions, declarations, and complaints.
Applicability, owner and coverage per entity
Gaps raised as issues, or accepted with a second signature
Policies with versions, approval routes and review cycles
Licence conditions on the obligation register
Conflicts, gifts and personal trading, decided by someone else
Complaints tracked to acknowledgement, answer and payment
AI drafts, summarises, extracts obligations, assesses impact and answers questions. Every answer cites the paragraph it came from, and nothing is sent, published or written to a register until a person approves it.
Answers grounded in the regulation’s own text, never the open web
Accept, edit or dismiss, with the approval on the audit trail
Each function switched on or off by your administrator
Ask about this change · What does Regulation S-P amendments require of us?
Suggestion · grounded in Regulation S-P amendments
Adopt an incident response program§ 248.30(a)(3), notify affected customers within 30 days§ 248.30(a)(4)(iii), and oversee service providers through due diligence§ 248.30(a)(5)(i).
§ 248.30(a)(3)Regulation S-P amendments · version in force · ecfr.gov
§ 248.30(a)(4)(iii)Regulation S-P amendments · version in force · ecfr.gov
AcceptEditDismissWrites nothing until accepted
Start with what you need
Switch on the modules you need today and add more when you are ready. Setup brings in your existing registers, policies, suppliers and people.
Who it is for
In-house teams
Risk, compliance, legal, operations, internal audit, project offices and the board, at regulated businesses in finance, energy, healthcare, telecommunications and beyond.
Law firms and consultancies that monitor regulation for their clients, advise them, and publish guidance under their own brand. Each client gets its own walled workspace.
Law firmsConsultanciesClient workspacesPublished guidance