Glossary

Ransomware is malicious software that locks or encrypts a victim's data or systems, and often steals a copy, then demands payment to restore access or prevent publication.

Reasonable grounds to suspect is the level of suspicion at which a person must report possible money laundering or terrorist financing. It needs facts behind it but falls well short of proof.

Records management is the controlled handling of an organisation's records from creation to final disposal, so that reliable evidence of its activities is kept, found when needed and destroyed on time.

Records of processing activities are a written register, kept by controllers and processors, listing what personal data they handle, why, who receives it, how long it is kept and how it is secured.

Records retention is the practice of keeping each type of record for a set period, as required by law or business need, and then disposing of it in a controlled and documented way.

Recovery and resolution planning means preparing, in advance, the steps a financial institution would take to restore itself after severe stress, and the steps authorities would take to wind it down in an orderly way if recovery fails.

The recovery point objective is the maximum amount of data loss an organisation will accept after an outage, measured as time between the last good copy of the data and the moment of failure.

The recovery time objective is the target time within which a disrupted process, system or service must be restored after an outage, counted from the moment the disruption begins.

Red flags are warning signs in a customer's behaviour, a transaction or a document that hint at laundering, fraud or sanctions evasion and justify closer scrutiny.

Sanctions red flags are warning signs in a customer, payment or trade that suggest a possible sanctions breach or an attempt to evade sanctions, and that call for a closer look.

RegTech is technology, such as software, data analytics and automation, that helps regulated firms meet regulatory requirements more efficiently, for example through monitoring, reporting, identity checks and tracking rule changes.

A regulated entity is a company or institution that a regulator authorises, supervises and holds to specific rules, such as a bank, insurer, broker, pension fund or payment provider.

Regulatory arbitrage is the practice of structuring a business, product or transaction to take advantage of differences in rules between countries, sectors or regulators, so as to face lighter requirements or lower costs.

Regulatory capital is the amount and type of capital that supervisors require a financial firm to hold against its risks, defined by their rules about what counts and how much is needed.

Regulatory capture occurs when a regulator, set up to serve the public interest, comes to act in the interest of the industry it oversees, through influence, dependence or shared outlook.

Regulatory change management is the process of tracking new and changing laws and rules, judging their impact on the business, and making the policy, process and system changes needed to comply by the deadline.

Regulatory compliance is an organisation's adherence to the laws, regulations and supervisory rules that apply to its business, together with the work it does to show that it follows them.

Regulatory equivalence is a formal finding that another country's rules and supervision achieve outcomes comparable to one's own, allowing firms from there to operate or be relied on with fewer extra requirements.

A regulatory examination is a supervisor's structured review of a firm's records, systems and practices, on site or remotely, to test compliance with rules and judge the quality of its risk management.

A regulatory framework is the body of laws, rules, guidance and supervisory arrangements that governs a sector or activity. It sets out what is allowed, who oversees it and what happens on a breach.

Regulatory impact analysis is a structured study of the likely costs, benefits and side effects of a proposed rule and its alternatives, carried out before the rule is adopted so decision makers can compare options.

Regulatory inquiry response is how an organisation handles a supervisor's or enforcement agency's request for information, interview, inspection or search, from first notice to final reply.

A regulatory obligations register is a central list of the legal and regulatory requirements that apply to an organisation, each linked to the policy, control and named owner responsible for meeting it.

Regulatory reporting is the submission of required data, statements and notifications by an organisation to its regulators, on a fixed schedule or when specific events occur.

A regulatory sandbox is a supervised space where firms test new products or services on a limited scale, with real customers, under tailored rules and close regulator oversight for a fixed period.

A related party transaction is a deal between a company and someone close to it, such as a director, major shareholder, relative or affiliated business, where the relationship might affect the terms.

Relationship exit is the decision and process of ending a customer relationship because the financial crime risk cannot be managed, or because the firm cannot complete the required due diligence.

Relatives and close associates are family members and known business or personal partners of a politically exposed person, who are screened and treated with similar caution because they can hold or move funds on the official's behalf.

The relevant market is the set of products and the geographic area within which firms actually compete, defined by authorities so they can measure market power and judge a firm's conduct or a merger.

Reliance on third parties allows a regulated firm to use customer due diligence already carried out by another regulated firm, such as an introducer, while remaining fully responsible for the outcome.

A remediation plan is a documented set of actions, owners and deadlines for fixing an identified weakness, breach or audit finding and stopping it from happening again.

A reportable transaction is a transaction that must be reported to the authorities because of its type, size or other defined feature, whether or not anyone suspects wrongdoing.

A reporting entity is a business or professional that the law requires to apply anti-money laundering controls and to send reports on suspicious or threshold transactions to the financial intelligence unit.

Reputational risk is the chance that negative opinion among customers, investors, regulators, staff or the public damages an organisation's standing, and through that its revenue, funding, right to operate or ability to hire.

Residence-based taxation taxes a person on income from anywhere because they live or are based in the country. Source-based taxation taxes income because it arises within the country, whoever earns it.

Residual risk is the level of risk that remains after existing controls and other responses have been taken into account.

Responsible AI is the practice of designing, building and using AI according to principles such as fairness, safety, transparency, privacy and accountability, and turning those principles into working controls.

Responsible business conduct means running a business so that it avoids and addresses harm to people, society and the environment in its own operations, supply chains and business relationships, while still pursuing profit.

Responsible lending is the practice, often a legal duty, of lending only after checking that the borrower can repay without undue hardship, and of explaining the terms and risks clearly.

A restatement is the reissue of previously published financial statements to correct a material error, replacing earlier figures with corrected ones and disclosing what changed and why.

A restricted list is a confidential internal list of securities in which a firm and its staff may not trade or advise, because the firm holds inside information or has a conflict.

Retaliation is any harmful action taken against a person because they reported wrongdoing, raised a concern or took part in an investigation, such as dismissal, demotion, exclusion or harassment.

Revenue recognition is the set of accounting rules deciding when and how much revenue a business records, generally when control of goods or services passes to the customer for the payment it expects to receive.

The right to erasure lets an individual ask an organisation to delete their personal data when it is no longer needed, consent is withdrawn, or the data was handled unlawfully, subject to listed exceptions.

Risk analysis is the step of working out how likely an identified risk is, how large its consequences could be and what drives both, so that risks can be compared and ranked.

RCSA is a process in which business teams themselves identify their risks, rate them, assess how well their controls work and agree actions for gaps.

Risk appetite is the board's stated position on which risks the organisation will seek or accept in pursuit of its goals, and how much of each. Management works inside it.

A risk appetite statement is the board-approved document that sets out, in words and measures, how much and what kinds of risk the organisation will accept while pursuing its strategy.

Risk assessment is the work of finding the risks an organisation faces, estimating how likely and how serious each is, and deciding which need action first.

Risk capacity is the maximum amount of risk an organisation could take on before breaching its capital, liquidity, legal or other hard constraints, whatever its preferences. It sets the ceiling for risk appetite.

A board risk committee is the board committee that oversees risk appetite, the firm's overall risk profile and the quality of its risk management, and advises the board on whether the two fit together.

A risk control matrix is a table that lists the risks in a process, the controls meant to address each one, who owns them, and how often they run. It is a working record of control coverage.

Risk culture is the shared set of values, attitudes and habits that shape how people in an organisation think about risk, raise concerns and make decisions when risk is involved.

RDARR is a set of principles from the Basel Committee for how banks gather, manage and report risk data, so that boards can rely on accurate, timely risk information, including in a crisis.

Risk governance is the set of structures, roles, decision rights and reporting lines through which an organisation oversees and directs how risk is taken and managed, from the board down.

Risk identification is the first stage of risk management: spotting what could go wrong, or unexpectedly go right, for an organisation's goals and recording each item clearly enough to act on.

A risk limit is a measurable boundary on how much exposure a person, desk or business unit may take, set to keep activity inside the board's risk appetite.

A risk management framework is the structure of policies, roles, processes and tools an organisation uses to manage risk consistently, from setting objectives to reporting results to the board.

A risk management maturity model rates how developed an organisation's risk practices are, usually on a scale of stages from ad hoc to optimised, and shows what to improve next.

A risk matrix is a grid that plots risks by likelihood on one axis and impact on the other, with colour bands showing which combinations are low, medium or high.

A risk owner is the person with the accountability and authority to manage a specific risk, including deciding on treatments and reporting its status. The role usually sits in the business, not in the risk function.

A risk profile is a description of the risks an organisation, unit or project faces at a point in time, showing their type, size and how they compare with its appetite.

A risk register is a living record of identified risks, with their ratings, owners, controls and planned actions, kept so that risks can be tracked and reported.

A risk taxonomy is a structured classification of risks into categories and sub-categories with agreed names and definitions, so that risks are described and reported the same way across the organisation.

Risk tolerance is how far results may drift from a target for one objective or measure before management must act. It is narrower and easier to measure than risk appetite.

Risk transfer moves some or all of the financial cost of a risk to another party, usually through insurance, a contract or a hedge, while the original party stays responsible for the underlying activity.

Risk treatment is the decision on how to respond to a rated risk, and the follow-through: stop the activity, cut likelihood or impact, pass on part of the cost, or accept what remains.

The risk-based approach means matching the strength of controls to the level of risk, so that more effort goes to higher-risk customers, products and places, and less to lower-risk ones.

Risk-based internal audit is an approach in which audit effort is directed at the areas of greatest risk, chosen by assessing the organisation's activities and its controls, rather than by rotation or routine.

Risk-based supervision is an approach where a regulator directs its time and resources toward the firms and activities that pose the greatest risk, instead of giving every firm the same level of attention.

Risk-weighted assets are a bank's assets and off-balance-sheet exposures, each multiplied by a weight that reflects its riskiness. The total is the base against which capital ratios are measured.

Round-tripping is sending money abroad, often through offshore companies, and bringing it back as if it were foreign investment or income, to hide its origin or gain tax or regulatory benefits.

In a rug pull, the creators of a crypto token or project attract investors, then withdraw the funds or liquidity and disappear, leaving buyers holding tokens that can no longer be sold.

The rule of law is the principle that everyone, including government and officials, is bound by laws that are publicly known, applied equally and enforced by independent courts, instead of by arbitrary personal power.