PLM in Finance & Insurance Part 2: Digital Thread for Governed Change in Financial Services

Regulatory change as a perpetual fire drill

In many financial institutions, regulatory change feels like an endless cycle of fire drills. A new rule appears, perhaps a detailed conduct standard, a new capital requirement, or updated guidance on the use of models and data. Teams form quickly to interpret the text. Slide decks proliferate. Spreadsheets map expected impacts. Project plans are drafted with streams assigned to product, risk, operations, and technology. Months pass in a flurry of meetings and partial implementations. Eventually, the change is declared complete, the project is closed, and governance forums move on to the next item. 

Yet, when someone asks for an end-to-end explanation of how that obligation is actually fulfilled, the answers become much less clear. It is not that work was not done; it is that the links between obligations, decisions, product changes, controls, and evidence were never captured as part of a coherent lifecycle. Instead, they are scattered across documents and systems. This is the point where the evidence gap becomes visible. 

Defining the evidence gap in practical terms

The evidence gap is the space between the obligations you face and the story you can actually show about how you meet them. At one end of that space are regulatory texts, supervisory expectations, and internal policies that articulate what you intend to do. At the other end are the products you sell, the processes you run, the controls and tests you operate, and the real-world outcomes you see in customer behavior, incidents, and losses. 

In theory, there is a logical chain connecting those endpoints. In practice, that chain is often fragmented. You may have policy documents that interpret the regulation but are not linked to the specific product and process changes that resulted. You may have product specifications that mention compliance considerations but are not explicitly tied back to the originating obligations. You may have control registers and test logs that describe activities, but do not clearly identify which obligations they address. When things go well, this fragmentation remains largely invisible. When something goes wrong, or when a regulator or internal auditor asks to see the chain, the institution has to assemble it manually from many sources. 

Why project-based change no longer scales

The root of the problem lies in how change has traditionally been organized. Regulatory programs tend to be structured as temporary projects. They involve intense activity while the program is in motion, followed by return to business-as-usual behaviors once the deadline has passed. Information created during the program is often archived in project documentation rather than integrated into a living model of how the institution works. Each new wave of regulation starts the cycle again, with limited reuse of the structure created before. 

This project-centric model might be tolerable when change is occasional and narrow. However, it becomes much harder to sustain when regulatory expectations expand and overlap, when business models evolve, and when technology modernization agendas run alongside compliance demands. The result is a type of institutional fatigue. Teams experience a constant demand for impact assessments and actions, but lack a shared, persistent way to represent the relationships between obligations, products, processes, and controls. 

The consequences show up in familiar ways. Organizations become dependent on a few individuals who remember how previous changes were implemented. When those people leave or change roles, institutional memory evaporates. The quality of impact assessments varies because there is no consistent structural view of what connects to what. Evidence is produced in response to questions rather than as a natural byproduct of how the institution operates. 

What a digital thread looks like in financial services

A digital thread offers a way to break this cycle by turning regulatory and risk change into a managed lifecycle rather than a stream of isolated projects. In a financial services context, the digital thread is a network of relationships represented in a PLM platform that ties together obligations, internal policies, requirements, product and process designs, controls, tests, approvals, and outcomes. 

At the start of this thread, obligations are interpreted from regulatory texts and supervisory expectations. Instead of living solely in documents, these obligations are defined as structured objects. Each one represents a specific requirement that the institution must meet. Internal policies and standards are then linked to these obligations, showing how the organization has chosen to embody them. 

From there, requirements are defined that translate obligations and policies into concrete changes in products, processes, systems, data, and controls. These requirements are connected directly to the product structures and process flows that will implement them. When products are designed or changed, their definitions are linked back to those requirements, and through them to the underlying obligations. The same applies to processes and systems. Changes to workflows and technical components are tied to the requirements they satisfy. 

From disconnected artifacts to a connected lifecycle

Controls, tests, approvals, and outcomes must be part of this same connected picture to truly close the evidence gap. In many organizations, controls are cataloged separately, usually in a risk system or spreadsheet. Testing records and compliance monitoring sit in their own silos. Approvals and interpretations are in meeting minutes and email chains. A digital thread approach, however, pulls these elements into the lifecycle of the obligations and products they relate to, breaking down data silos. 

Controls are defined with clear references to the obligations and risks they mitigate and the products and processes where they operate. Test plans and execution records are attached to those controls, making it straightforward to see which evidence supports which requirement. Approvals and key decisions are captured as lifecycle transitions inside the PLM and digital thread platform, rather than as informal communications. When someone signs off on an interpretation of an ambiguous rule, or accepts a residual risk, that decision becomes part of the thread. 

Real-world outcomes such as incidents, complaints, and loss events are then linked back into the same structure. An incident in a particular process is connected to the product variant and control environment in which it occurred. From there, one can trace back to the requirements and obligations. This feedback loop is essential. It turns operational experience into design input and allows institutions to understand not just whether they have controls, but whether those controls are effective. 

The strategic payoff of closing the evidence gap

The immediate benefit of a digital thread is practical. Impact assessments become faster and more reliable because the relationships between obligations, products, processes, and controls are already modeled. When a new rule appears, teams can see which parts of the portfolio are connected to similar obligations and what already exists in terms of controls and evidence. Senior leaders can ask for line-of-sight views on critical topics and receive more than aggregated traffic-light reports. 

Over time, the strategic payoff is broader. The institution becomes more discovery-ready, meaning that it can respond to deep questions about its decision-making and controls without launching a new round of forensic work each time. The experience and learning generated by one change cycle are carried forward as part of the evolving digital thread, rather than dissipating when a project ends. Risk appetite and policy adjustments can be evaluated not only in conceptual terms but in terms of their impact on actual products, customers, and controls. 

A PLM and digital thread platform is central to making this sustainable. It provides the schema and lifecycle management needed to hold these objects and relationships together. It lets different functions work in their own language while still contributing to a unified model. It integrates, rather than replaces, existing systems by federating the information needed for traceability. 

Starting small with a digital thread approach

Making this shift does not require mapping every obligation and product at once. Many organizations begin with a focused domain where the evidence gap is felt acutely, such as consumer protection, vulnerable customer treatment, or operational resilience. Within that domain, they identify a manageable set of obligations, define the corresponding internal policies and requirements, and connect a subset of products, processes, and controls into the digital thread. BNP Paribas Securities Services stands out as a pioneer in the financial sector in adopting PLM technology — from its offer and solution catalog to, more recently, its client pricing process. 

As teams use the PLM and digital thread platform to manage changes in this area, they experience the difference between reconstructing evidence after the fact and having it emerge naturally from how work is done. Metrics such as the time needed to respond to a regulator’s request, the clarity of impact assessments, or the reduction in repeated effort provide tangible feedback. Based on that learning, the scope of the digital thread can be extended to other domains and product lines. 

In a world where regulatory expectations continue to evolve and where trust is a critical asset, closing the evidence gap is more than a compliance goal. It is a way of giving your organization a clear, defensible understanding of how obligations translate into actions and outcomes. A PLM and digital thread platform provides the structure needed to make that understanding durable. 

Ready to turn regulatory change from a recurring fire drill into a manageable, connected lifecycle? Explore how the Aras platform provides the backbone needed to model obligations, decisions, and evidence with clarity. Strengthen governance and traceability through our advanced product lifecycle management platform and structured requirements management that link policies directly to products and processes.