Glossary

Call for Action jurisdictions are the countries on FATF's more severe public list, where AML/CFT weaknesses are serious enough that FATF urges all firms and governments to apply extra scrutiny and, in extreme cases, countermeasures.

Capital adequacy is whether a bank or insurer holds enough capital to absorb losses from its risks without failing. Regulators express it as minimum ratios of capital to risk-weighted exposures.

The capital conservation buffer is an extra layer of capital banks must hold above the regulatory minimum. If they dip into it, limits apply to dividends, bonuses and share buybacks until it is rebuilt.

A carbon footprint is the total greenhouse gas emissions caused by a person, organisation, event or product, usually stated in tonnes of carbon dioxide equivalent over a set period.

Carbon intensity measures greenhouse gas emissions relative to an activity, such as revenue, units produced or money invested, so that firms or portfolios of different size can be compared.

Carbon neutrality means a company, product or event has balanced its greenhouse gas emissions with an equal amount of removals or purchased offsets, so its stated net contribution over a period is zero.

A carbon offset is a tradable credit, normally worth one tonne of carbon dioxide equivalent, issued for emissions avoided or removed by a project and bought by another party to compensate for its own emissions.

Carbon pricing puts a cost on greenhouse gas emissions, through a tax or a tradable permit scheme, so that polluters bear the damage they cause and have a reason to cut it.

Card-not-present fraud is the use of stolen card details to buy goods or services where the card is not physically shown, such as online, by phone or by mail order.

Carousel fraud is a VAT or GST scheme in which the same goods are traded repeatedly through a chain of firms across borders, while one firm collects tax and disappears without paying it.

A cartel is a secret agreement among competitors to fix prices, limit output, share out markets or rig bids, instead of competing. It is among the most serious competition offences.

A cash-intensive business is one that takes a large share of its revenue in physical cash, such as restaurants, car washes or small retailers, which makes it easier to mix criminal money with genuine takings.

Catastrophic risk is the chance of an event so severe that it causes losses far beyond normal experience and threatens the survival of an organisation, a market or a community.

CDP is a non-profit that runs a global system through which companies, cities and regions report environmental data on climate, forests and water, and which investors and buyers use to compare them.

A cease and desist order is a regulator's formal instruction to stop conduct that breaks the law or rules, or to stop a practice that is likely to cause harm, and not to repeat it.

A central beneficial ownership register is a national database, kept by a government body, that records the individuals who ultimately own or control companies and other legal entities in that country.

CEO and CFO certification is a formal statement in which a company’s two most senior executives personally confirm that its financial reports are fairly presented and supported by working controls over reporting.

Chain hopping is swapping cryptocurrency from one blockchain to another, for example through bridges or exchanges, to break the trail of a transaction trace and make illicit funds harder to follow.

Chain of custody is the documented trail showing who collected, held, moved and examined a piece of evidence, so that it can be shown to be unaltered and authentic.

The chair of the board leads the board, sets its agenda, runs its meetings and makes sure directors get the information and time they need to decide well. The role is separate from running the business.

Chargeback fraud occurs when a customer falsely tells their card issuer that a genuine purchase was unauthorised or not received, so the money is returned while the customer keeps the goods or service.

Cheque fraud is the use of forged, altered, stolen or counterfeit cheques to obtain money or goods dishonestly, including paying in a cheque that the payer will not honour.

The chief audit executive is the head of the internal audit function, responsible for planning and delivering audits and for reporting independently to the board and senior management.

The Chief Compliance Officer is the senior executive responsible for running the compliance function, advising leadership on regulatory obligations and reporting on compliance risk to the board.

Chief executive and chair duality is when one person holds both roles, running the business and leading the board that oversees it. Separation gives the two roles to different people.

The CISO is the senior executive accountable for an organisation's information security strategy, policies and programme, who reports on cyber risk to executives and the board.

The chief risk officer is the senior executive in charge of the risk function, responsible for identifying, measuring and reporting the firm's risks to senior management and the board, independently of the business lines.

Child labour is work by children that harms their health, safety or development, or takes them out of school, and that international standards and most national laws prohibit.

Children's data protection is the set of stricter rules and extra care applied when organisations collect or use personal data about minors, including age checks and parental consent for online services.

Churning is a broker or adviser making excessive trades in a client's account mainly to earn commissions or fees, while paying little attention to what the client needs.

A civil penalty is a financial punishment ordered for a breach of law or regulation in a civil, non-criminal process, usually requiring proof on the balance of probabilities and carrying no prison term.

A clawback policy lets a company recover pay already given to executives, such as bonuses, after events like misconduct, a financial restatement or a major risk failure. Malus reduces pay not yet paid.

Client asset protection covers the rules that require firms holding customers' money or securities to keep them separate from the firm's own, record them accurately and return them if the firm fails.

Climate adaptation means adjusting people, assets and systems to cope with climate impacts that are already happening or expected, so that harm is reduced and opportunities are taken.

Climate mitigation means cutting greenhouse gas emissions or removing them from the atmosphere, so that global warming is slowed and limited.

Climate risk is the possibility of loss or disruption from climate change, arising either from physical hazards such as floods and heat, or from the economic and policy shift towards a low-carbon economy.

Climate scenario analysis tests how a business, portfolio or economy might fare under several possible climate futures, such as different warming paths and policy responses, in order to judge resilience.

Cloud governance is the set of policies, roles and checks that decide who may buy and use cloud services, how data and costs are controlled, and how security and legal duties are met.

A code of conduct is a written set of rules telling staff and others who work for an organisation what behaviour is expected and prohibited, and what follows if the rules are broken.

A code of ethics is a document stating the values and principles an organisation or profession commits to, such as honesty, fairness and respect, to guide decisions where no specific rule applies.

Combating the financing of terrorism covers the laws and controls that prevent funds being raised, moved or used to support terrorists, terrorist acts or terrorist organisations, whether the money is legal or criminal in origin.

Combined assurance is the coordination of the different assurance providers inside and outside an organisation, so that the board gets one joined-up view of how well the main risks are controlled.

Commercial bribery is paying or accepting a bribe between people in private businesses, such as a buyer and a supplier, to win business or favourable terms without the employer knowing.

The CRS is a global standard, developed by the OECD, under which financial institutions identify account holders who live abroad for tax purposes and report their account details to tax authorities for exchange between countries.

Communications surveillance is the monitoring of employees’ emails, chats, calls and messages, usually with automated screening, to detect market abuse, misconduct and breaches of rules such as leaked inside information.

Company formation agents are professional firms that register companies for clients and often also supply a registered address, nominee directors or shareholders, and administration. In many countries they are gatekeepers for AML purposes.

A company secretary is the officer responsible for a company's legal and governance administration: running board and shareholder meetings, keeping statutory records and advising directors on their duties and on compliance.

A compensating control is an alternative control that reduces the same risk when the normal control cannot be applied, or is not working well enough, so that overall exposure stays at an acceptable level.

A competition compliance programme is the set of policies, training, checks and reporting routes a company uses to stop its staff breaking competition law and to catch problems early.

Complaints handling is the process by which an organisation receives, records, investigates and resolves expressions of dissatisfaction from customers, and uses the findings to correct underlying problems.

Compliance means meeting the laws, regulations, standards and internal policies that apply to an organisation. It also names the function that advises on these duties and checks they are being met.

A compliance attestation is a signed statement, usually made each year by staff or managers, confirming that they have read and followed company policies and have reported any breaches or conflicts they know of.

A compliance breach is any failure to follow a law, regulation, licence condition or internal policy, whether deliberate or accidental and whether or not anyone has yet been harmed.

Compliance by design is the practice of building legal and regulatory requirements into products, systems and processes from the start, so the compliant route is the normal one, not a later fix.

A compliance charter is the founding document of the compliance function, signed off by the board or one of its committees. It fixes the function's purpose, authority, independence, duties, resources and reporting lines.

Compliance culture is the set of shared attitudes and habits that decide whether people in an organisation follow rules and raise concerns when nobody is checking, rather than looking for ways around them.

Compliance function independence is the principle that the compliance team has the standing, authority, resources and direct board access to challenge the business without pressure from those whose activities it oversees.

A compliance management system is the organised set of governance, policies, controls, monitoring and improvement routines through which an organisation identifies its obligations and manages the risk of breaching them.

Compliance monitoring and testing are the routine checks and sample-based tests, run by the compliance function, that show whether rules and controls are being followed and working as intended.

A compliance officer is a professional who helps an organisation follow laws, regulations and internal policies by advising staff, monitoring activity, running training and handling breaches and regulator contact.

A compliance programme is the organised set of policies, training, controls, reporting channels and monitoring that an organisation uses to prevent, detect and respond to breaches of law and its own rules.

Compliance risk is the chance that an organisation suffers legal or regulatory sanctions, financial loss or reputational damage because it fails to follow applicable laws, regulations, codes of conduct or its own standards.

A compliance risk assessment is a structured exercise that identifies the obligations an organisation faces, estimates the likelihood and impact of breaching each, and judges how well existing controls reduce that exposure.

Compliance training and awareness cover the courses, briefings and reminders that teach staff which rules apply to their work, how to apply them and how to report concerns.

Complicit financial advisors are wealth managers, brokers or similar professionals who knowingly help clients hide, move or invest criminal money, using their expertise and trusted standing to make suspicious activity look like ordinary investment business.

Comply or explain is a governance approach where companies must follow a code's provisions or publicly say which ones they did not follow and give reasons, leaving shareholders to judge.

Country-wide sanctions are broad restrictions on nearly all dealings with an entire country, territory or regime, rather than with named people or companies.

A CSIRT is a team of specialists that receives reports of security incidents, investigates them, coordinates the response and shares lessons, either for one organisation or for a whole sector or country.

Concentration risk is the chance of heavy loss because exposure is bunched in one borrower, sector, region, product, funding source or supplier, so one adverse event hits a large share of the business.

Conduct risk is the risk that the way a firm or its staff behave towards customers, markets or colleagues causes harm to them, to the integrity of the market or to the firm itself.

Confidentiality is the duty to keep certain information secret and to share it only with people authorised to see it, arising from law, contract, professional rules or the nature of a relationship.

The CIA triad names the three core goals of information security: confidentiality, meaning only authorised people see data; integrity, meaning it stays accurate and unaltered; and availability, meaning it is usable when needed.

Confiscation is the permanent loss of property to the state, ordered by a court, usually because the property is the proceeds or instrument of crime or equals the benefit a person gained from it.

Conflict minerals are natural resources, usually tin, tantalum, tungsten and gold, whose mining and trade help finance armed groups or enable human rights abuses in conflict-affected or high-risk areas.

A conflict of interest arises when someone's personal interests, relationships or duties to another party could affect, or appear to affect, how they carry out their duties for their organisation or client.

In data protection, consent is a person's genuine choice, made knowingly and for a named purpose, to allow an organisation to use their personal data.

A consent order is a negotiated enforcement outcome in which a firm agrees to the regulator's terms, such as a penalty or corrective steps, usually without admitting or denying the alleged wrongdoing.

Consumer protection laws are the statutes and regulations that shield buyers from unfair, misleading or unsafe dealings by sellers and give them rights to information, fair terms, redress and safe goods.

Contagion risk is the risk that distress at one firm, market or country spreads to others through links such as shared exposures, funding ties, confidence or common assets.

A contingency funding plan sets out how a financial institution would raise cash and manage outflows during a liquidity stress, naming the triggers, the funding sources, the actions and who decides.

A contingency reserve is money, time or other resource set aside in a budget or plan to cover identified risks that may occur, and released or used as those risks play out.

Continuous disclosure is the duty of a listed company to tell the market promptly about information that could affect its share price, and to publish regular reports, so that all investors are equally informed.

Continuous monitoring is the regular, often automated, checking of risks and controls through the year, so problems show up soon after they arise instead of at a yearly review or audit.

Contractual compliance obligations are the duties an organisation has promised to meet in its contracts, such as loan covenants, service levels and reporting deadlines, together with the work of tracking that they are met.

Control activities are the actions set out in policies and procedures that help make sure management's instructions on risk are carried out, such as approvals, reconciliations, access limits and reviews.

A control deficiency exists when a control is missing, badly designed or not working as intended, so it cannot reliably stop or catch the risk it was meant to address.

Control effectiveness testing is the evaluation of whether a control is well designed and operates as intended over a period, using evidence such as samples, re-performance and system checks.

The control environment is the set of standards, structures, behaviour and attitudes that shape how seriously an organisation takes internal control, from board oversight to the tone set by senior management.

COBIT is a governance and management framework for enterprise IT, published by ISACA, which links business goals to defined IT processes, responsibilities and performance measures.

A control owner is the named person accountable for making sure a specific control is designed sensibly, operated as intended, and fixed when it fails. The role is usually held by a business manager.

A controlled foreign corporation is a company in a foreign country that is controlled by residents of another country. Anti-deferral rules may tax its undistributed income in the hands of those owners.

Controlling persons are the individuals who exercise control over an entity, such as a company or trust, and whose tax residence must be reported when that entity is a passive investment vehicle.

A cooling-off period is a short time after signing a contract during which the buyer may cancel without giving a reason and usually without penalty, as set by law or industry rules.

Cooperation credit is the reduction in penalty, or more lenient treatment, a regulator or prosecutor gives a firm or individual that helps an investigation, discloses facts early or fixes the problem.

Cornering the market means buying enough of a commodity, security or asset to control its supply, then forcing buyers or short sellers to pay inflated prices to get it.

Corporate fraud is dishonest conduct by or against a company, such as falsified accounts, theft by insiders or deceiving shareholders, carried out to gain money or advantage at the expense of others.

Corporate governance is the set of rules, structures and habits that decide who steers a company and how those in charge are questioned, covering the board, management, shareholders and other stakeholders.

A corporate governance code is a set of recommended board and company practices, issued by a regulator, exchange or professional body, usually applied on a comply or explain basis.

Corporate liability is the legal responsibility of a company itself, as distinct from its people, for wrongs such as crimes, civil harms or regulatory breaches committed by those acting on its behalf.

Corporate secretarial compliance is the work of meeting the duties that company law places on a company, such as holding meetings, keeping registers and filing returns on time.

Corporate social responsibility is the way a company takes account of its effects on society and the environment in how it operates, beyond meeting the law, and contributes to the wellbeing of stakeholders.

The CSDDD is an EU law requiring large companies to identify, prevent, end and remedy harm to human rights and the environment in their own operations, subsidiaries and business partners across the value chain.

The CSRD is a European Union law requiring large and listed companies to publish independently assured sustainability information in their annual management report, following common standards and using the double materiality test.

CAPA is a structured process for fixing a problem that has occurred, finding out why it happened and changing the process so the same or a similar problem does not happen again.

Correspondent banking is where a bank in one place keeps an account for a bank elsewhere, handling its payments, foreign currency and trade settlement so the second bank can serve customers beyond its own borders.

Correspondent banking due diligence is the enhanced review a bank performs on a respondent bank before and during a relationship, to understand its business, ownership, controls and the risks its customers bring.

Corruption is the dishonest use of an official or business position to win a personal or group benefit, through acts such as bribery, embezzlement, extortion, nepotism and favouritism, in the public or private sector.

The Corruption Perceptions Index is an annual ranking by Transparency International that scores countries on how corrupt their public sectors are perceived to be, based on surveys and expert assessments.

The COSO ERM framework is a widely used model from the Committee of Sponsoring Organizations that links risk management to strategy-setting and performance, organised around five components and twenty principles.

The COSO Internal Control Framework is a widely used model that defines internal control as a process, run by people, giving reasonable assurance on operations, reporting and compliance objectives, built from five components and seventeen principles.

The countercyclical capital buffer is extra capital that authorities can require banks to hold when credit is growing too fast, then release when conditions worsen, so that banks can keep lending.

Counterfeiting is making and passing off imitations of genuine currency, goods, documents or securities as real, to deceive buyers or authorities and earn illegal profit.

CAATSA is a United States law passed in 2017 that tightened sanctions on Iran, Russia and North Korea, and gave Congress a stronger role in overseeing sanctions relief.

Counterparty credit risk is the risk that the other side of a derivative, repo or similar contract defaults before the final cash flows are settled, leaving the firm to replace the contract at a loss.

Country risk is the chance of loss from political, economic or legal conditions in a country, such as default by its government, currency controls, nationalisation or unrest, which can stop borrowers from paying.

Country-by-country reporting requires large multinational groups to report to tax authorities, for each country where they operate, their revenue, profit, tax paid, staff, assets and main activities.

A credit rating is an opinion, usually expressed as a letter grade, on how likely a borrower or a bond is to pay interest and principal as promised.

Credit risk is the risk of loss because a borrower or counterparty does not pay what it owes, or pays late, or because its ability to pay worsens.

Credit risk mitigation covers the techniques a lender uses to reduce the loss it would suffer if a borrower defaults, such as collateral, guarantees, netting and credit derivatives.

A criminal penalty is a punishment imposed by a criminal court after conviction for an offence, such as imprisonment, a fine, confiscation of proceeds or a ban from holding certain roles.

Crisis management is the way senior leaders take decisions, direct the response and communicate during a sudden, serious event that threatens people, operations, finances or reputation and goes beyond normal routines.

A critical third party is an external supplier whose failure or disruption could seriously affect a firm's essential services, or the stability of the wider sector that relies on it.

A cross-border currency declaration is a duty to tell customs when carrying cash or bearer negotiable instruments above a set value into or out of a country.

A cross-border data transfer is the movement of personal data, or remote access to it, from one country to another, which many privacy laws allow only if the data stays properly protected.

A cross-trade is a transaction in which a manager or broker matches a buy order from one client with a sell order from another, or from the firm itself, without going through the open market.

Cryptocurrency fraud is any deception that takes money or digital assets from victims through crypto, including fake token sales, giveaway scams, bogus mining services and fake investment platforms that use AI-generated content.

A cryptocurrency mixer is a service that pools digital coins from many users and sends equivalent amounts back from different addresses, breaking the visible trail between sender and receiver.

Cuckoo smurfing is a laundering method in which criminals deposit dirty cash into the account of an unsuspecting person who is expecting a genuine overseas remittance, so the cash is explained away by the transfer.

A currency transaction report is a report that a bank or other covered business files with the authorities on cash transactions above a set amount, whether or not anything looks suspicious.

A customer activity profile is the record of what a bank expects a customer to do with their account, such as typical amounts, frequency, countries and counterparties, used as a baseline to spot unusual behaviour.

Customer detriment is the financial loss or other harm a customer suffers because a firm sold them the wrong product, charged unfairly, gave poor service or otherwise failed to treat them properly.

Customer due diligence is the checking a firm does to know who its customer is: identifying and verifying them, understanding why they want the relationship, and keeping that picture current so laundering and terrorist financing risk can be managed.

Customer redress is the remedy a firm gives to customers it has wronged, usually refunds with interest, compensation or correction of the product, often together with an apology or explanation.

A customer risk assessment is the process of rating each customer as low, medium or high risk for money laundering and terrorist financing, based on who they are, where they operate, what they use and how they are served.

Customs compliance is a business's practice of meeting the rules that apply when goods cross borders, including correct declarations, product classification, valuation, origin claims, duty payment and record keeping.

Cyber incident reporting is the duty, set by law or regulator, to notify authorities, and sometimes customers, of significant cyber incidents within fixed deadlines and in a prescribed form.

A cyber incident response plan is a documented set of roles, steps and contacts that tells an organisation how to detect, contain, remove and recover from a cyber incident.

Cyber insurance is cover that pays part of the costs of a cyber incident, such as response, restoration, legal bills, notification and lost income, subject to terms, limits and security conditions.

Cyber resilience is an organisation's ability to keep delivering essential services during a cyber attack, and to recover and adapt afterwards, instead of relying only on preventing attacks.

Cyber supply chain risk management is the practice of identifying and reducing the security risks that come from suppliers, software components, hardware and service providers an organisation depends on.

Cyber-enabled fraud is fraud carried out through computers, phones or online channels, where technology helps the offender deceive victims or reach accounts that would be harder to attack in person.

Cybersecurity risk is the potential for loss from attacks on, or failures of, information systems, including damage to data, operations, finances and reputation.