Glossary

Abuse of dominance is conduct by a firm with substantial market power that harms rivals or customers, such as predatory pricing, refusing to supply or tying products. Holding a dominant position is not itself unlawful.

Account takeover is a fraud in which a criminal gains control of a genuine customer's existing account, typically with stolen credentials, and uses it to move money, buy goods or take over the customer's identity.

Accountability is the obligation to answer for decisions, actions and results, and to accept consequences, to a person or body with the right to ask. It cannot be fully handed to someone else.

Active bribery is the offence of offering, promising or giving an undue advantage to someone, such as an official or employee, to make them act improperly or to reward them for doing so.

An adequacy decision is a formal ruling by a government or data protection authority that another country's privacy protections are strong enough for personal data to be sent there without extra safeguards.

Under UK law, the adequate procedures defence lets a company avoid liability for failing to prevent bribery by its staff or agents, if it can show it had suitable anti-bribery procedures in place when the bribe was paid.

An administrative penalty is a financial sanction imposed directly by a regulator or government agency on a firm or individual for breaking rules, without going through a criminal trial or ordinary court case.

Advance fee fraud is a scam in which victims are persuaded to pay money upfront for a loan, prize, investment or other benefit that never materialises, with further fees often demanded afterwards.

An advance pricing agreement is a binding arrangement between a taxpayer and one or more tax authorities that fixes, in advance, how related-party transactions will be priced for tax over a set period.

Adverse media screening is searching news and other public sources for negative reports about a customer or related party, such as fraud, corruption or sanctions breaches, to judge whether they add financial crime risk.

The agency problem arises when one party, the agent, acts for another, the principal, but has different interests and more information. In companies, managers may pursue their own goals rather than shareholders' interests.

AI assurance is the set of checks, testing and independent review that gives boards, regulators and customers justified confidence that an AI system works as intended, follows the rules and does not cause unacceptable harm.

AI governance is the framework of policies, roles, approvals and oversight that decides how an organisation builds, buys and uses AI, and who answers for the results.

An AI impact assessment is a structured review, done before and during deployment, of how an AI system could affect people, groups and society, and what steps will reduce the harm.

AI risk tiers are categories, from minimal up to unacceptable, that sort AI uses by the harm they could cause, so that stricter controls apply where the stakes are higher.

Algorithmic bias is a systematic error in an automated system that produces unfair results for certain people or groups, often because of skewed data, flawed design choices or the way outputs are used.

An allow list is a record of names or parties already reviewed and cleared as not being a sanctions match, used so the screening system stops raising the same false alert again.

Alternative Dispute Resolution covers ways of settling disputes without a full court trial, mainly negotiation, mediation, conciliation and arbitration, usually faster, cheaper and more private than litigation.

An AML investigation is the review of an alert or referral about possible money laundering, in which analysts gather facts, judge whether activity is suspicious and either close the case or escalate it for reporting.

An AML/CFT compliance programme is the organisation-wide set of policies, controls, people and training that a regulated firm uses to detect and prevent money laundering and terrorist financing and to meet its legal duties.

An annual general meeting is the yearly meeting where shareholders receive the accounts, vote on matters such as electing directors, appointing the auditor and pay policy, and question the board.

An anti-bribery policy is a written organisational document that bans bribery, explains what is prohibited, and sets the rules and responsibilities staff and third parties must follow.

An anti-fraud policy is a formal document, approved by senior leadership, that states the organisation's position on fraud and sets out roles, expected behaviour, reporting routes and how suspected cases are handled.

Anti-money laundering covers the laws and controls that make it hard for criminals to disguise where illegal money came from and spend it as if it were clean. Paired with counter-terrorist financing, it is usually written AML/CFT.

Application fraud is the use of false information, forged documents or a stolen identity to obtain an account, card, loan or other financial product that would otherwise be refused.

The arm's length principle says that transactions between related companies should be priced for tax as if the parties were independent and dealing on open-market terms.

ALARP is the principle that a risk should be lowered until any further reduction would cost far more, in money, time or effort, than the safety it would gain. It applies mainly to safety.

Asset forfeiture is the legal process by which the state takes ownership of property that is the proceeds or instrument of crime. It can follow a conviction, or proceed against the property itself without one.

An asset freeze is a legal ban on moving, selling, transferring or otherwise dealing with funds and property belonging to a sanctioned person, while ownership stays with that person.

Asset misappropriation is the theft or misuse of an organisation's resources by an employee or other insider, such as cash, inventory, equipment or information, for personal gain.

Asset recovery is the full process of tracing, freezing, confiscating and returning assets stolen or gained through crime, especially corruption, often across borders and to the country or victims harmed.

Asset-liability management is the practice of managing the gap between what a financial institution owns and what it owes, in timing, amount and rate, to keep liquidity, earnings and capital within set limits.

An associated person is anyone who provides services for an organisation or acts for it, such as an employee, agent, subsidiary or contractor, and whose bribery can make the organisation itself liable.

Assurance is an independent, evidence-based opinion that gives stakeholders confidence that something, such as financial statements, a control, a process or a report, is reliable and working as claimed.

An assurance engagement is work in which an independent practitioner gathers evidence and gives a written conclusion that raises users’ confidence in information, such as a financial statement or sustainability report, prepared by someone else.

An audit committee is a board sub-group, usually made up mostly of independent directors, that oversees financial reporting, internal controls, internal and external audit, and how the company handles compliance concerns.

An audit finding is a point in an audit report where the auditor records that practice fell short of what was expected, backed by evidence, a cause, the resulting risk and a rating.

Audit firm rotation is a rule or practice of changing a company's external audit firm after a set number of years, to keep the auditor independent and sceptical.

An audit opinion is the auditor's formal verdict after an examination: for financial statements, whether they give a fair picture; in internal audit, an overall rating of how well an area is controlled.

An audit plan is a document setting out which areas the internal audit function will review over a period, usually a year, when, with what resources and why, based on an assessment of risk.

An audit quality review is an inspection by an independent oversight body of how well audit firms carry out audits, usually by examining samples of audit files and the firm’s own quality control systems.

The audit risk model says the risk of an auditor giving a clean opinion on misstated accounts depends on inherent risk, control risk and detection risk. Auditors adjust their testing to keep that overall risk low.

An audit trail is a time-ordered record showing who did what, when and why in a system or process, so that a transaction or decision can be traced from start to finish.

Auditor independence is freedom from conflicts, pressure and self-interest that lets an auditor reach and report conclusions objectively, both in fact and in how others see it.

Regulatory authorisation is the formal permission a regulator gives a firm or person to carry on a regulated activity, such as banking, insurance or investment advice, usually after meeting set conditions.

Authorised push payment fraud occurs when a victim is deceived into sending a payment themselves to an account controlled by a criminal, for example by pretending to be a bank, supplier or trusted contact.

Automated controls are checks built into software that run without anyone pressing a button, such as approval limits, input validation and system-enforced access rules. The process cannot move on unless the rule is met.

Automated decision-making is a decision taken by a system with no meaningful human involvement. Profiling is the automated use of personal data to evaluate or predict traits such as behaviour, finances or reliability.

AEOI is a system in which tax authorities of different countries routinely send each other information about financial accounts held by each other's residents, without waiting for a request.