Glossary

A DAO is an organization governed by rules encoded as smart contracts on a blockchain. It operates without centralized leadership, allowing token holders to vote on decisions, proposals, and fund management. DAOs enable decentralized governance, transparency, and community-driven projects, making them a key innovation in Web3 for collaborative decision-making and collective ownership.

A dApp is a software application that runs on a decentralized blockchain network instead of a centralized server. It operates without a single controlling entity, ensuring transparency, censorship resistance, and user control. dApps use smart contracts to automate functions and are fundamental to the Web3 ecosystem, powering services like DeFi, gaming, and NFTs.

The dark web, also known as the DarkNet, consists of websites whose IP addresses are deliberately concealed. Content on the dark web is accessed through encrypted overlay networks that use the public internet but require specialized software to serve as a gateway to these hidden sites.

Data analytics risk refers to the potential for errors, biases, or misuse of data during analysis that can lead to incorrect conclusions and poor decision-making. In digital transformation, managing this risk involves ensuring data quality, proper methodology, and ethical use of analytics tools.

Anonymisation involves permanently removing personal identifiers so individuals cannot be re-identified, taking data outside GDPR scope. Unlike pseudonymisation, it is irreversible. It is used for analytics, research, or compliance, enabling safe use of datasets without personal privacy risks.

If a security breach causes unauthorized access, loss, or alteration of personal data, institutions must inform the supervisory authority within 72 hours and possibly affected individuals. Finance companies must deploy breach-alert processes and templates to meet this tight deadline.

A data controller determines why and how personal data is processed, retaining primary GDPR responsibility. A data processor acts on the controller’s instructions to process data. Misclassification can lead to compliance issues and fines. In banking, a merchant's bank may often function as both controller and processor.

Appendage of external data (ownership information, PEP status, geography) to enhance screening accuracy.

A Data Fiduciary is the person or entity (individual, company, or government body) that determines the purpose and means of processing digital personal data. They hold legal responsibility for obtaining consent, maintaining data accuracy, implementing security safeguards, and addressing breaches via the Data Protection Board.

RBI's 2025 Master Directions specify validated data formats (e.g., UCRF) and require CICs to maintain a Credit Information Quality Index?ensuring accuracy, completeness, and reliability

GDPR mandates collecting only personal data necessary for the specific purpose. Financial institutions must regularly assess data collection to avoid excessive customer profiling, which increases breach risk or regulatory scrutiny.

Organizations must only collect data truly needed for the stated purpose?nothing excessive. Finance firms must regularly audit data inventories, purge redundant customer data, and avoid over-collection during marketing or analytics efforts.

Individuals have the right to receive their personal data in a structured, machine-readable format and transmit it to another controller where technically feasible. This ensures financial customers can migrate between banks without vendor lock-in.

A “Data Principal” is any individual whose personal data is processed under the act. For children or those lacking capacity, the term includes their parent or legal guardian. This gives citizens control over how their digital data is handled and adds legal recourse for affected parties.

A Data Processor is an individual or organization that processes personal data solely on behalf of a Data Fiduciary, governed by contractual obligations. They must strictly follow fiduciary instructions and adhere to privacy and security standards but are not independently liable under the Act unless specified.

The Recommendation notes that while data protection laws are vital, they should not obstruct anti-corruption mechanisms. Countries should consider regulations permitting processing of personal data during internal-bribery investigations and compliance reviews.

Financial systems (e.g., online banking, credit scoring) must embed privacy into product lifecycle. Controllers must commission pseudonymization, encryption, limit access, and keep data usage minimal. It ensures GDPR compliance is proactive, not an afterthought.

For high-risk processing (e.g. credit scoring, behavioral profiling), financial organisations must perform a DPIA. The assessment identifies risks, documents mitigation strategies, and justifies necessity before activity begins?demonstrating transparency and regulatory diligence.

A DPO is mandatory in financial institutions that process data at scale or monitor customers regularly. Responsible for GDPR compliance?PIA advice, staff training, and regulator liaison?the DPO reports to senior management and ensures the company balances privacy with financial regulatory obligations.

“Significant Data Fiduciaries” must appoint a DPO in India who reports to top management. The DPO oversees compliance, addresses Data Principals? queries, ensures impact assessments, breach reporting, and acts as the primary liaison with the Data Protection Board.

Data protection risk involves the possibility of legal, financial, or reputational harm resulting from unauthorized access, use, or disclosure of personal or sensitive data. Organizations must comply with data privacy laws like GDPR to manage this risk, ensuring data security, proper handling, and breach response.

A data room is a secure, virtual or physical space where confidential documents and information are stored and shared during mergers and acquisitions. It allows buyers, sellers, and advisors to review important financial, legal, and operational data safely, facilitating due diligence and decision-making throughout the transaction process.

CICs and credit institutions must update credit data at least fortnightly?or more frequently as agreed?to ensure up-to-date and reliable reporting .

Egmont mandates robust IT controls: encrypted channels (ESW), strict role?based access, audit trails, and mandatory breach?notification. Any compromise of shared intelligence can trigger an ESCP review, protecting both source FIUs and ongoing investigations.

Closure of banking relationships with high-risk correspondent banks.

The declaration process begins after the Enforcement Directorate files an application. The Special Court issues a notice, and if the individual doesn’t appear within six weeks, it may declare them a Fugitive Economic Offender, triggering confiscation and legal disqualification.

A declaratory judgment is a court’s official statement that defines the legal rights or obligations of parties without ordering any specific action. It clarifies legal relationships and can prevent future disputes by providing certainty on contested issues.

A deductible is the amount of money the insured must pay out of pocket before the insurance company starts to pay for a covered loss. It helps share the cost between the insurer and the policyholder and can affect the premium amount, with higher deductibles often leading to lower premiums.

A deemed-compliant FFI meets FATCA conditions without a formal IRS agreement. There are two types: registered (self-certify to the IRS) and certified (avoid registration by qualifying under certain exemptions). These institutions avoid withholding while maintaining predictable compliance.

Deep learning is a subfield of AI and machine learning that focuses on using artificial neural networks to model complex patterns in data. It is particularly effective in processing raw, unstructured data, making it highly useful in applications such as image recognition, natural language processing, and speech recognition.

NPCI is piloting signature-based behavioral biometrics (typing cadence, navigation patterns) combined with ML models. Deviations from a user's behavioral baseline trigger risk alerts?even with correct credentials.

“Deep OTM” options?those far from the underlying price?are monitored due to their speculative nature. NSE flags excessive OTM open interest concentration to prevent price distortions and keep derivative integrity intact.

Deepfake is a technology based on artificial intelligence (AI) that creates highly realistic but fake images, audio, or videos. The term combines “deep learning,” a type of AI, with “fake,” highlighting its use in generating convincing digital forgeries that can mislead viewers

Statutory settlement allowing a company to avoid prosecution where it meets compliance standards.

These regulations outline the procedure and requirements for the delisting of equity shares from stock exchanges, ensuring transparency and protecting the interests of investors during the delisting process.

Unlike the Convention’s supply-side focus, demand-side bribery refers to solicitations, requests, or acceptance of bribes by foreign public officials. The 2021 Recommendation urges countries to define, criminalize, and regulate solicitation by officials, including facilitation or gifts demanded by public servants?strengthening enforcement against both giving and receiving of improper benefits.

A demat account is an electronic account where investors hold their securities. Managed by DPs, it records holdings, transactions, corporate actions, and pledges, functioning like a securities wallet.

This is the conversion of physical share certificates into electronic form through a depository system. Investors submit certificates via a DP, after which securities are credited to their demat account. It replaces manual transfers and helps eliminate theft and forgery.

A demurrer is a legal objection that challenges the sufficiency of the opposing party's pleading, asserting that even if the facts presented are true, they do not constitute a valid legal claim. It serves to dismiss claims that are legally insufficient without addressing factual disputes.

BIS list of individuals denied export privileges.

A deposition is a sworn, out-of-court testimony given by a witness in a legal case. It is part of the discovery process and is used to gather information, preserve testimony, and assess credibility before trial. Attorneys from both sides can question the witness, and the testimony can later be used in court if needed.

These regulations regulate operations of depositories (e.g. NSDL, CDSL) and participants. They mandate account opening, dematerialization of securities, settlement, record maintenance, audit, cybersecurity measures, and investor grievance redressal. The framework ensures safe, reliable electronic securities transactions and market infrastructure integrity.

A depository is a SEBI-registered company under the Companies Act, authorized to hold securities electronically. It enables the dematerialization, transfer, and settlement of securities like shares, bonds, and debentures through book-entry systems, replacing physical certificates and facilitating efficient, secure securities transactions.

Fees imposed for services like account-opening, transfers, pledges, dematerialization, and rematerialization. These charges are capped by SEBI and collected by DPs per transaction.

A DP is a SEBI-registered intermediary (e.g. bank, brokerage) appointed by a depository to offer depository-related services. DPs operate the front end of account operations like account-opening and transaction support, while the depository manages records centrally.

An integrated electronic platform managed by a depository for holding securities, processing transfers, enabling pledges, corporate actions, and settlement. It records holdings, transaction history, and supports investor servicing.

Internal list of parties in watch as potential future sanctions targets.

Detective controls are processes or activities designed to identify and uncover errors, fraud, or irregularities after they have occurred. They help organizations detect issues promptly so corrective actions can be taken to minimize impact and prevent recurrence.

Deviant subculture is a group within society that develops values and norms differing from the mainstream, often justifying behaviors considered criminal or deviant by others. Members may adopt these alternative norms as a response to social exclusion or inequality, reinforcing behaviors that challenge dominant societal standards.

UPI and RuPay platforms use both device binding and SIM matching?by mandating offline multi-factor authentication (PIN/biometrics) and mapping SIM to device IDs?to prevent identity theft and non-repudiation-based fraud.

Device binding requires mapping SIM, device, and app versions, with strict validations (e.g., no Airplane Mode, only latest app version). NPCI caps binding attempts (e.g., max three per day), and blocks faulty or repeated attempts for 24 hours?mitigating risk from SIM cloning or device spoofing.

Differential association theory explains that criminal behavior is learned through interaction with others. People acquire values, attitudes, techniques, and motives for criminal activity by associating with individuals who already engage in such behavior. The theory emphasizes the importance of social relationships in the development of deviance and suggests that the frequency and intensity of these interactions influence the likelihood of offending.

Differential opportunity theory suggests that people’s access to legitimate and illegitimate means of achieving success varies based on their social environment. When lawful opportunities are limited, individuals may turn to criminal activities as alternative ways to reach their goals, especially in disadvantaged communities.

Wolfsberg’s updated principles address digital assets such as cryptocurrencies. They require CDD, sanctions screening, transactional monitoring adapted to blockchain context, source-of-funds tracing, and encrypted wallet risk scoring.

Reflecting the rise in cryptocurrencies and fintech, the Wolfsberg Principles now address digital asset risks?removing anonymity, enhancing CDD, and updating monitoring to capture blockchain transactions. Firms must embed controls that adapt to evolving financial technologies and associated crime threats.

Digital compliance refers to the process of ensuring that digital systems, technologies, and data practices adhere to regulatory requirements and industry standards. This includes privacy laws, cybersecurity regulations, and governance policies. As businesses undergo digital transformation, managing digital compliance is critical to avoid legal penalties, reputational damage, and operational disruptions.

RBI’s circular mandates standardized Key Fact Sheets (KFS) with APR, prepayment terms, and cooling-off periods for digital and MSME loans. Lenders must use secure numbering series for calls/SMS, register on telecom platforms, and monitor revoked mobile numbers to prevent misuse in digital loan fraud.

The RBI is introducing ?.bank.in? domains exclusively for banks and ?.fin.in? for other financial entities. Managed in collaboration with IDRBT, this domain governance aims to reduce phishing threats by standardizing URLs, streamlining authentication, and helping the public more easily identify legitimate digital finance platforms.

A 2023 Digital?Transformation initiative explores big?data, graph analytics, and AI models for detecting complex, multi?jurisdictional laundering schemes. Pilot projects focus on privacy?preserving computation and blockchain?analytics to help FIUs trace crypto flows while respecting data?protection laws.

Dilution occurs when a merger or acquisition results in a decrease in the acquiring company’s earnings per share (EPS), usually because more shares are issued to fund the deal. This reduces each existing shareholder’s ownership percentage. Dilutive transactions may concern investors if the long-term benefits of the deal don’t outweigh the immediate impact on EPS.

PFRDA requires PFs and CRAs to include a Directors' Responsibility Statement and CFO Certification in financial reports, affirming the adequacy of internal, financial, and digital controls, legal compliance, NAV accuracy, and alignment with the Stewardship Code.

New governance norms mandate that annual reports include statements confirming fairness of scheme statements, adequacy of internal and digital controls, compliance with laws, stewardship codes, valuation manual, ethics, and NAV accuracy?signed by CFO, CEO, and Directors.

Pension Funds must include a Directors? Responsibility Statement and CFO certification in annual reports to confirm accuracy of financial statements, adequacy of internal controls and digital architectures, and compliance with applicable laws and policies.

UPI IDs linked to phone numbers with no activity for a year?and phones inactive for 90 days?are disabled for incoming transactions. This reduces fraud risks via misassigned or recycled numbers, prompting users to re?register if needed.

Disaster recovery risk is the possibility that an organization’s plans to restore IT systems and operations after a disruptive event may fail or be inadequate. This can lead to prolonged downtime, data loss, and financial damage. Effective disaster recovery planning is essential to minimize impact and ensure business continuity during digital transformation.

Discovery is the formal pre-trial process by which parties in a legal case exchange relevant information and evidence. It includes tools like interrogatories, depositions, requests for documents, and admissions. Discovery helps both sides understand the facts of the case, avoid surprises at trial, and encourage settlements by revealing the strengths and weaknesses of each side's arguments.

If borrowers dispute credit data, CICs must investigate, correct any errors within the specified timeline, and notify both institution and borrower about resolution

Insurers are required to manage fraud risks from agents and brokers by conducting fit-and-proper checks, monitoring policy turnover or frequent cancellations, reconciling intermediary records with internal data, scrutinizing customer complaints, and ensuring policyholder data changes follow secure, documented processes.

U.S. legislation to mitigate systemic risk, avert financial crises, and enhance consumer protections.

The Dodd-Frank Act established a whistleblower program empowering individuals to report securities law violations to the SEC. It offers protections against retaliation and rewards whistleblowers with 10-30% of monetary sanctions recovered. The program encourages transparency and accountability in financial markets.

A Denial-of-Service (DoS) attack is a cyberattack where a malicious actor seeks to disrupt the normal functioning of a computer or device, making it unavailable to its intended users. This is typically achieved by overwhelming the target with excessive requests, preventing it from processing legitimate traffic. A DoS attack is specifically characterized by being launched from a single computer.

A Double Taxation Agreement (DTA) is a treaty between two countries designed to prevent individuals or businesses from being taxed twice on the same income. It allocates taxing rights between countries and provides mechanisms for tax relief, promoting cross-border investment and economic cooperation by reducing tax barriers.

Drag-along rights are contractual provisions that allow majority shareholders to force minority shareholders to join in the sale of a company. This ensures that if the majority decides to sell, minority shareholders cannot block the deal and must sell their shares on the same terms, facilitating smoother transactions and maximizing value for all owners.

Drawal of Foreign Exchange refers to obtaining foreign currency from authorized entities like banks for permitted uses such as travel, education, or investment. FEMA regulates drawals by setting limits, requiring documentation, and monitoring transactions to prevent misuse. Individuals and businesses must comply with these rules to ensure legal and transparent foreign exchange usage.

DTAAs are bilateral tax treaties India signs with other countries to prevent double taxation. They also facilitate information exchange about taxpayers. Under the Black Money Act, DTAAs enable the Indian government to detect and pursue undisclosed foreign income and assets by accessing bank and investment data from treaty countries.

Filtering trading of market-listed companies to thwart evasion.

A due diligence checklist is a comprehensive list of items and documents that buyers review during the due diligence process in mergers and acquisitions. It helps ensure all critical financial, legal, operational, and regulatory aspects of the target company are thoroughly examined before finalizing the deal.

Organisations must implement due diligence and oversight of partners and agents. Under S7, failure to prevent bribery by an "associated person" triggers strict corporate liability. Firms should perform risk assessments, background checks, and regular monitoring to ensure compliance across their value chains and third-party arrangements.

Due diligence under FATCA refers to the processes FFIs and withholding agents must follow to identify U.S. accounts. It includes reviewing customer data, applying indicia tests, and collecting IRS forms. Accurate procedures ensure compliance and reduce withholding exposure.

Structured framework applied to evaluate a counterparty's compliance position.

Documents utilized to collect risk information for clients, counterparties, or suppliers.

Duress in contract law refers to a situation where one party is forced or threatened into entering an agreement against their will. It undermines genuine consent, and a contract formed under duress may be considered voidable. The pressure can be physical, emotional, or economic in nature.

A dusting attack is a crypto privacy breach where hackers send tiny amounts of cryptocurrency (called “dust”) to many wallets. They then track transactions to identify and deanonymize wallet owners by linking addresses. Though the dust has minimal value, the goal is surveillance, often for phishing or targeted attacks. It’s a threat to crypto user privacy.