Glossary

The recovery point objective is the maximum amount of data loss an organisation will accept after an outage, measured as time between the last good copy of the data and the moment of failure.

The recovery time objective is the target time within which a disrupted process, system or service must be restored after an outage, counted from the moment the disruption begins.

Red flags are warning signs in a customer's behaviour, a transaction or a document that hint at laundering, fraud or sanctions evasion and justify closer scrutiny.

Sanctions red flags are warning signs in a customer, payment or trade that suggest a possible sanctions breach or an attempt to evade sanctions, and that call for a closer look.

RegTech is technology, such as software, data analytics and automation, that helps regulated firms meet regulatory requirements more efficiently, for example through monitoring, reporting, identity checks and tracking rule changes.

Regulatory capital is the amount and type of capital that supervisors require a financial firm to hold against its risks, defined by their rules about what counts and how much is needed.

Regulatory change management is the process of tracking new and changing laws and rules, judging their impact on the business, and making the policy, process and system changes needed to comply by the deadline.

Regulatory compliance is an organisation's adherence to the laws, regulations and supervisory rules that apply to its business, together with the work it does to show that it follows them.

Regulatory reporting is the submission of required data, statements and notifications by an organisation to its regulators, on a fixed schedule or when specific events occur.

The relevant market is the set of products and the geographic area within which firms actually compete, defined by authorities so they can measure market power and judge a firm's conduct or a merger.

A remediation plan is a documented set of actions, owners and deadlines for fixing an identified weakness, breach or audit finding and stopping it from happening again.

A reporting entity is a business or professional that the law requires to apply anti-money laundering controls and to send reports on suspicious or threshold transactions to the financial intelligence unit.

Reputational risk is the chance that negative opinion among customers, investors, regulators, staff or the public damages an organisation's standing, and through that its revenue, funding, right to operate or ability to hire.

Residual risk is the level of risk that remains after existing controls and other responses have been taken into account.

RCSA is a process in which business teams themselves identify their risks, rate them, assess how well their controls work and agree actions for gaps.

A risk control matrix is a table that lists the risks in a process, the controls meant to address each one, who owns them, and how often they run. It is a working record of control coverage.

Risk governance is the set of structures, roles, decision rights and reporting lines through which an organisation oversees and directs how risk is taken and managed, from the board down.

Risk identification is the first stage of risk management: spotting what could go wrong, or unexpectedly go right, for an organisation's goals and recording each item clearly enough to act on.

A risk limit is a measurable boundary on how much exposure a person, desk or business unit may take, set to keep activity inside the board's risk appetite.

A risk management framework is the structure of policies, roles, processes and tools an organisation uses to manage risk consistently, from setting objectives to reporting results to the board.

A risk management maturity model rates how developed an organisation's risk practices are, usually on a scale of stages from ad hoc to optimised, and shows what to improve next.

A risk matrix is a grid that plots risks by likelihood on one axis and impact on the other, with colour bands showing which combinations are low, medium or high.

A risk register is a living record of identified risks, with their ratings, owners, controls and planned actions, kept so that risks can be tracked and reported.

A risk taxonomy is a structured classification of risks into categories and sub-categories with agreed names and definitions, so that risks are described and reported the same way across the organisation.

Risk transfer moves some or all of the financial cost of a risk to another party, usually through insurance, a contract or a hedge, while the original party stays responsible for the underlying activity.

Risk-based supervision is an approach where a regulator directs its time and resources toward the firms and activities that pose the greatest risk, instead of giving every firm the same level of attention.