A regulation is a binding legal rule made by a government agency under authority that a legislature delegated to it. It carries the force of law, and breaking it can bring penalties, enforcement actions, or loss of a license. The key qualification: not everything a regulator publishes is a regulation. Agencies also issue guidance, interpretive letters, and staff statements that shape behavior without the same legal weight.
That distinction matters because fintech teams build to the wrong thing when they confuse the three layers. A statute sets the frame. A rule fills in the details and binds. Guidance tells you how the agency expects the rule to be read. Each layer fails differently, and each one ages differently.
This primer walks the chain from end to end: where the authority comes from, how a proposal becomes a final rule, what guidance can and cannot do, and what the whole process means for compliance and legal-ops teams. It is information, not legal advice; readers with specific facts should consult qualified counsel.
What is the difference between a statute, a regulation, and guidance?
A statute is a law passed by a legislature. It is the broadest instrument: it names the agency, describes the problem, and grants power to act. A regulation — often called a rule — is the agency's detailed implementation of that grant. Guidance is everything else: staff manuals, FAQs, supervisory letters, no-action statements, and interpretive notes.
The practical test is bindingness. A statute and a regulation bind everyone within their scope, and a court can enforce them. Guidance binds the agency's own staff in how it supervises, and it signals enforcement priorities, but it generally cannot create new obligations on its own. A regulator's FAQ can tell a firm how the agency will read a rule; it cannot, by itself, make conduct illegal that the rule does not reach.
Why does the distinction get blurred in practice? Because firms treat guidance as binding anyway. Supervisory expectations feed exam findings, and exam findings feed enforcement. A document with no legal force can still decide whether a product launch survives its next examination. The safe reading is to treat guidance as a strong signal of what the agency will accept, not as a rule in disguise.
One more wrinkle: terminology varies by jurisdiction. In the United States, "regulation" and "rule" are largely interchangeable, and the Code of Federal Regulations collects the final texts. In the European Union, a "regulation" is one specific legislative instrument — directly applicable across member states — distinct from a "directive," which sets outcomes that national law must implement. The same word, different machinery.
Where does regulatory authority actually come from?
Every valid regulation traces back to a delegation. The legislature passes a statute that empowers an agency to make rules within a stated perimeter. The agency then writes rules that implement, and cannot exceed, that grant. If a rule runs past what the statute authorized, a court can set it aside.
That structure explains a familiar pattern in fintech coverage. When an agency acts in a novel area — say, digital assets or AI-driven underwriting — the first question practitioners ask is not whether the policy is wise but whether the statute actually reached that conduct. A regulator stretching an old grant over new technology invites litigation over the perimeter itself.
Agencies also differ in structure. Some are single-director bodies inside an executive department; others are independent commissions with commissioners from both parties and their own adjudicative processes. The structure affects how rules are made, how enforcement is contested, and how quickly leadership can change direction. For a compliance team, the practical consequence is simple: the identity and composition of the regulator shapes how stable any given rule is.
For a worked example of one agency's grant in action, see the coverage of Regulation MC Explained: What the Fed's Government Securities Rule Covers and Who It Reaches, which shows a single delegated authority producing a rule with a defined reach. Readers following this should also see Regulation MC Explained: What the Fed's Government Securities Rule Covers and Who It Reaches.
How does a proposal become a binding rule?
The mechanism most jurisdictions share is some form of notice and comment. The agency publishes a proposed rule with a stated rationale. The public — firms, trade groups, consumer advocates, other agencies — submits comments. The agency reviews them, may revise the text, and then issues a final rule that responds to significant points raised.
That response duty is the part outsiders most often miss. An agency that ignores a substantial comment record builds a weakness into its own rule, because a court reviewing a challenge can ask whether the agency considered the evidence before it. The comment period is not theater; it is where the litigation record gets made.
After a final rule comes implementation. Rules carry effective dates and, frequently, staggered compliance deadlines that hit different firm sizes at different times. That staging is where most operational work lands: policy updates, model changes, vendor renegotiations, and training all get sequenced against the calendar. The gap between a final rule's publication and its first compliance date is often the most valuable window a compliance team gets.
Proposed-versus-final status is the discipline this publication applies to every rulemaking story, and readers should apply it too. A proposal can be withdrawn, rewritten, or delayed. Building to a proposal as if it were law is a classic and expensive error.
What can guidance do, and what can it not do?
Guidance can interpret, prioritize, and warn. It can tell firms how the agency reads an ambiguous term, what examiners will look for, and which practices have drawn enforcement attention. Good guidance is often more operationally useful than the rule text itself, because it is written for the people who have to comply.
What guidance cannot do, in principle, is create obligations the underlying rule does not contain. That limit is contested at the edges, and the contest is itself a live legal question in several jurisdictions. The working posture for practitioners: read guidance closely, map it against the actual rule, and flag any point where the two diverge. Divergence is where arguments live.
Enforcement actions sit between rules and guidance. A consent order — a settlement with a regulator, agreed without an admission typically — binds the named party and functions as guidance for everyone else. Its terms describe what one regulator accepted as remediation in one fact pattern, which is a signal, not a rule. Coverage of how that plays out in payment disputes appears in Regulation E Explained: Error Timelines, Liability Limits, and Dispute Steps for Electronic Payments. We covered a connected angle in Regulation E Explained: Error Timelines, Liability Limits, and Dispute Steps for Electronic Payments.
What this means in practice for compliance teams
Three implications follow from the chain described above, each bounded by how the process actually works.
- Tag every obligation by instrument. Maintain a register that records, for each requirement, whether it comes from a statute, a final rule, or guidance, with the jurisdiction and the instrument's date. When leadership asks why a control exists, the answer should be a citation, not a habit.
- Sequence work against compliance dates, not publication dates. The operative deadline is the one in the final rule's implementation provisions. Calendar backward from it, and treat proposals as planning inputs only.
- Treat guidance divergence as a finding to escalate. Where a supervisory expectation goes beyond the rule text, document the gap and the firm's reading. That file is what counsel will want if the expectation is ever tested.
The broader reading: regulation is not one thing but a supply chain, from legislative grant to proposal to final rule to supervisory interpretation. Teams that track each link separately spend less time rebuilding controls when one link moves. Teams that treat "the regulator said so" as a single undifferentiated source spend more.
Where the framework runs out
The evidence base for this primer is structural: the delegation model, the notice-and-comment cycle, and the bindingness hierarchy are durable features of administrative law across major jurisdictions, described here at that level of generality. What the framework cannot settle is any specific case — whether a given rule exceeds its grant, whether a given guidance document binds, whether a given conduct falls inside a perimeter. Those are legal questions for counsel and, ultimately, for courts.
What remains genuinely uncertain is the boundary itself. Agencies keep testing the edge of their delegated authority as technology moves, and courts keep redrawing it. For practitioners, the durable skill is not memorizing any single rule but reading each new instrument and asking the same three questions: What authorized this? Is it final? What does it actually bind me to do?
Sources: merriam-webster.com · eslteacher.org · dictionary.com · dictionary.cambridge.org
