Glossary

Ransomware is a type of malware that restricts access to a computer system or encrypts its files, demanding payment in exchange for restoring access. It can cause significant harm to individuals and organizations, leading to data loss, financial losses, business disruptions, and reputational damage. As ransomware attacks have become more sophisticated in recent years, it is crucial to understand its development, various forms, and how organizations can protect themselves from these threats.

Ransomware risk is the threat of malicious software that encrypts an organization's data, demanding payment for its release. This risk can cause significant operational disruption, financial loss, and reputational damage. Managing ransomware risk involves regular backups, employee training, and strong cybersecurity measures.

Rational choice theory proposes that individuals make conscious decisions to commit crimes by weighing the potential benefits against the risks and consequences. It assumes that offenders act logically to maximize their gains while minimizing the chances of getting caught or punished.

The Act prohibits the re-transfer of benami property from the benamidar to the real owner. Any such transfer is considered null and void. This measure ensures the real owner cannot reclaim the asset through deceptive means and reinforces the confiscation process. It also prevents laundering or recovery of illegally acquired assets by masking ownership.

Real estate professionals who, knowingly or unknowingly, facilitate money laundering by assisting clients in purchasing properties to integrate illicit funds into the legitimate economy.

REIT regulations oversee the formation, operation, valuation, and public offering of real estate investment trusts. They include disclosure mandates, asset definition, minimum asset holding, income distribution, and sponsor obligations. These rules aim to create a transparent and efficient structure for real estate investments through capital markets.

The real owner is the person who actually finances or benefits from the property, even if it is held in another’s name. The Act focuses on uncovering and penalizing these individuals to stop the concealment of assets and black money through benami transactions.

NPCI's FRM system uses machine learning and AI to analyze UPI, IMPS, and other online product transactions in real or near real time, triggering alerts for suspicious activity. Member banks use its web portal to monitor flagged events, investigate fraud, and report outcomes. Fraud trends guide ecosystem-wide protective measures.

Automatic screening at the time of transaction processing to prohibit prohibited activity.

Exporters must realize and repatriate the full value of goods/services to India within a prescribed period. Under FEMA and RBI directives, this ensures foreign earnings return to the country and contribute to forex reserves. Delays or failures to comply can attract penalties and legal action. This provision upholds transparency in cross-border trade and payment flows.

A recalcitrant account holder is an individual or entity that fails to provide the information FFIs need to determine U.S. tax status or refuses to consent to reportable data disclosure. Under FATCA, FFIs must withhold 30% on U.S.-source payments to and from these accounts, incentivizing full transparency and cooperation.

Recidivist sanctions law breaches by the same entity.

The 2009 OECD Recommendation supplements the Convention by urging parties to proactively discourage facilitation payments, require corporate internal controls, prohibit tax deductibility for bribes, and promote non-trial resolutions like deferred prosecution?emphasizing prevention and enforcement harmonization.

Policy outlining how long compliance records should be retained for regulatory purposes.

REs using recovery agents must conduct background and police verification, provide authorization letters, and ensure agents maintain borrower dignity without intimidation. Agent details must be shared with borrowers.

REs must conduct due diligence on recovery agents?background & police verifications?and ensure agents are authorized, transparent and ethical. Borrowers must be informed, and agents must act with dignity and respect.

A red flag refers to any fact, event, or set of circumstances that may signal potential legal or compliance issues, particularly in relation to illegal or unethical business conduct. It often points to corrupt practices or non-compliance with anti-corruption laws, serving as an early warning sign for organizations to investigate and address possible risks.

An RFI is a warning sign?transaction, behavior, document, or claim?that suggests potential fraud and triggers further investigation. Examples include inconsistent documentation, repeated small claims, or digital anomalies. IRDAI mandates insurers to identify and act on RFIs via their Fraud Monitoring Committees and Units.

Indication of suspicious activity in transactions or compliance breach.

Indications of probable sanctions avoidance or non-compliance.

Prohibition on import/export of refined product (diesel, gasoline) from sanctioned state.

Egmont consists of eight regional clusters (e.g., Asia/Pacific, Europe) that foster localized collaboration, training, peer support, and mutual assistance tailored to specific regional AML/CFT contexts.

Organizations such as AU (African Union), ASEAN, or regional groupings applying sanctions.

These include Commercial Banks (excluding payments banks), Small Finance Banks, UCBs, and NBFCs (including NBFC-MFIs/HFCs). All REs issuing microfinance loans must comply with RBI/NABARD rules.

Regulation Fair Disclosure (Reg FD) is a rule introduced by the U.S. Securities and Exchange Commission (SEC) in 2000 to prevent selective disclosure of material non-public information. It requires public companies to disclose such information to all investors at the same time, ensuring a level playing field and promoting transparency in the securities markets.

Compliance with external rules, regulations, and laws that apply to the organization.

Particular filings necessary to report blocked property or suspicious activity.

A regulatory framework is a structured system of rules and guidelines established to ensure compliance and assess the wider impact of regulations. It sets clear standards across industries and sectors, promoting consistency, transparency, and accountability.

A Regulatory Impact Analysis (RIA) is a document prepared before implementing new government regulations. It evaluates the potential effects of proposed rules on stakeholders, including economic, social, and environmental impacts. While widely used across countries, the scope, format, and influence of RIAs differ depending on national regulatory frameworks and decision-making processes.

RBI may issue directions, constitute Technical Working Groups, and continuously update CIC regulations?as seen in the 2025 Master Direction?to refine system governance

PFRDA introduced a framework for regulation-making?including stakeholder consultation, economic impact analysis, and a Regulations Advisory Committee?to ensure transparent, cost-effective, and subscriber-focused policymaking.

Regulatory landscape upon which innovative solutions to compliance are subjected to testing under controlled conditions.

is a machine learning method where a model is trained to optimize its actions within a given environment to achieve a specific goal. This training process is guided by feedback mechanisms, such as rewards and penalties, based on the model's actions.

Reinsurance is insurance that an insurance company purchases from another insurer to protect itself from large financial losses. By transferring part of the risk, the original insurer reduces its exposure to significant claims, helping maintain financial stability and manage risk more effectively.

This covers any activity of a public nature or connected to business, employment, or carrying out services. A service counts if a reasonable person in the UK would regard it as requiring impartiality or trust. Both public and private sector actions abroad can be judged by UK standards.

To remand is to send a case back from an appellate court to the lower court for further action. This typically occurs when the higher court reverses a decision and requires additional proceedings consistent with its ruling.

The process where investors convert holdings from electronic form back to physical certificates. A DP or depository converts holdings upon request, after which physical certificates are issued and electronic balances decreased.

Plan of action to remediate deficiencies identified through audits or regulatory enforcement actions.

Apps must completely remove QR/contact-based nicknames from payment confirmation screens. Users should see only the verified bank name, eliminating fake or confusing aliases used in phishing attempts.

Similar to earlier directives, apps must disable nickname display from QR or chat features entirely. Beneficiary confirmation screen must show authenticated bank name through Validate API.

Post-confiscation, the government can initiate steps to recover and repatriate assets located abroad, utilizing treaties, mutual legal assistance, or international cooperation, crucial for addressing offenders holding illicit wealth in foreign jurisdictions.

the bringing into India the realized foreign exchange and the conversion of such foreign exchange into Indian rupees. FEMA mandates that foreign exchange due or accrued to a person resident in India should be repatriated to India within the specified period.

Microfinance loans should not cause total household repayments (across all loans) to exceed 50% of monthly income. If repayments exceed this threshold due to new lending, additional loans must be withheld until compliance is restored.

A transaction that financial institutions must report to the Financial Intelligence Unit (FIU) due to its suspicious nature or exceeding a certain monetary threshold, which may indicate money laundering activities.

A reporting entity is a financial institution or intermediary obligated under PMLA to report transactions and maintain records to aid in detecting money laundering activities.

Legal obligation to report sanctions blocks or rejections to authorities.

Obligation to make timely and accurate reports to regulators.

Trading members must forward only internally generated alerts?not those from the exchange?to the NSE through MSD. Each quarter, they must submit three report tables by the 15th day after quarter-end. Incomplete or late filings result in compliance penalties, reinforcing the importance of self-monitored surveillance.

Representations and warranties are statements made by the seller about the condition, assets, and operations of a company in a transaction. They assure the buyer that the information provided is accurate and complete. If these statements prove false, the buyer may seek remedies or compensation for any resulting losses.

Adequate procedures must follow six principles: proportionality, top-level commitment, risk assessment, third-party due diligence, communication/training, and monitoring/review. These form the defence under S7. Companies without measures aligned to these principles lack the protected status against corporate failure-to-prevent bribery charges.

Res judicata, Latin for "a matter judged," is a legal doctrine preventing the same dispute between the same parties from being relitigated once it has been finally adjudicated. It ensures finality and consistency in judicial decisions.

Rescission is the cancellation of a contract, returning all parties to their original positions before the agreement was made. It can occur by mutual consent or due to legal reasons such as misrepresentation, fraud, or mistake.

These regulations govern individuals and entities providing research services related to securities. They aim to ensure objectivity and transparency in research reports and recommendations, thereby protecting investors from biased information.

India follows residence-based taxation, meaning global income is taxable if the person is a resident in India. Any foreign income or asset owned or earned during such residency must be disclosed. Failure to do so invites action under the Black Money Act, including tax, penalty, and prosecution.

Residential status determines a person’s tax liability on global income. Residents must disclose all foreign income and assets, while non-residents report only Indian income. Misreporting status to avoid tax on offshore income falls under black money provisions and may attract penalty and prosecution.

Residual risk is the remaining exposure to risk after all preventive measures and controls have been applied. It reflects the level of uncertainty or threat that still exists despite risk mitigation efforts. Organizations must evaluate whether this residual risk is acceptable or if further actions are needed to reduce it to an acceptable level.

Resilience is the ability of an organization or supply chain to anticipate, withstand, adapt to, and quickly recover from disruptions or unexpected challenges. It involves building flexible systems, effective response strategies, and continuous improvement processes to maintain operations and minimize the impact of adverse events, ensuring long-term stability and performance under changing conditions.

Resilience Index is a metric used to evaluate an organization’s ability to prepare for, respond to, and recover from disruptions within its supply chain or operations. It considers factors such as risk management practices, response capabilities, and recovery speed. A higher resilience index indicates stronger adaptability and readiness to maintain continuity and performance during unexpected challenges or crises.

A Responsible Officer (RO) is an individual authorized by an FFI to oversee FATCA compliance. The RO ensures proper due diligence, certification, and reporting are completed per IRS regulations. Their role includes filing certifications of compliance or identifying events of non-compliance. Serious lapses by the RO may lead to enforcement actions.

Retaliation refers to negative actions taken against someone who reports misconduct or unethical behavior, such as firing, demotion, threats, or harassment. It is often used to discourage or punish whistleblowers. Many legal frameworks prohibit retaliation to protect individuals who report wrongdoing and to encourage transparency, accountability, and ethical practices within organizations and government bodies.

Retention is the portion of risk that an insurance company or policyholder chooses to keep instead of transferring it to another party. It means they accept responsibility for losses up to a certain amount, which can help control costs and encourage careful risk management.

A retention bonus is a financial incentive offered to key employees to encourage them to stay with a company during and after a merger or acquisition. It helps maintain continuity, preserve institutional knowledge, and reduce the risk of disruption by motivating essential staff to remain through the transition period.

This is the duration personal data is stored. GDPR demands that data is kept only as long as necessary and within legal mandates. Organizations must define, justify, and transparently publish retention periods?regularly reviewing whether data should be anonymized or deleted after conclusion of its purpose.

Originally, the Benami Act had limited retrospective effect. However, after the 2016 amendment, only procedural parts applied retrospectively, not penal provisions. This means transactions done before the amendment are examined, but penalties apply only to violations after 2016. This interpretation balances fairness while enabling action against past benami holdings without violating legal principles.

is a payment made by the buyer to the seller if the buyer fails to complete a merger or acquisition under certain conditions, such as financing issues or regulatory obstacles. It compensates the seller for lost time and resources and helps ensure the buyer is committed to closing the deal.

Data subjects can request confirmation if their personal data is processed, and can obtain a copy along with details?such as processing purpose, recipients, retention time, and rights. Banks must respond within one month, and must provide a meaningful, intelligible dataset.

Data Principals have the right to request correction or deletion of inaccurate, irrelevant, or outdated information. Fiduciaries must respond timely, resolve valid requests, and stop future processing of data once the purpose is fulfilled. Exceptions apply where law mandates retention.

Customers may request deletion of their personal data (including shared third-party copies), as long as there’s no overriding legal basis to retain it. Financial institutions need data inventories, deletion workflows, and retention policies to efficiently remove data while respecting AML/accounting retention requirements.

Data subjects have the right to receive their personal data in a structured, machine-readable format (e.g., financial transaction history), and transmit it to another controller (e.g., switching banks), simplifying account migration and promoting customer choice.

Individuals can request deletion of personal data unless retention is required by law, contractual obligation, or public interest. For finance, data like outdated loan application records may be erased at the customer’s request, unless AML or auditing laws require retention.

Principals can nominate someone to exercise data rights on their behalf after death or incapacitation. This ensures continuity of data rights and representation within the Act’s framework.

Customers can request correction of incorrect or incomplete personal data. Financial institutions must change or complete records promptly (e.g., updating a misspelt name or incorrect address), providing confirmation back to the data subject.

Data Principals can request a summary of their personal data being processed?covering nature, categories, sources, recipients, and processing reason. Fiduciaries must comply within 30 days.

Formal declaration of the organization's sanctions risk tolerance.

Risk Breakdown Structure (RBS) is a hierarchical tool used to categorize and organize risks by grouping them into different levels or categories. It helps provide a clear overview of potential risks in a project or organization, making it easier to identify, assess, and manage them systematically.

Risk culture is the shared values, beliefs, and attitudes about risk within an organization. It shapes how employees perceive, communicate, and respond to risk, influencing decision-making and behavior at all levels. A strong risk culture supports effective risk management by encouraging transparency, accountability, and proactive risk awareness.

Risk Governance refers to the framework through which an organization sets its risk strategy, policies, and oversight. It ensures accountability, decision-making transparency, and alignment with corporate objectives. Risk governance involves the board, executive leadership, and risk committees in defining risk appetite, roles, and responsibilities, ultimately embedding risk management into organizational culture and strategic planning.

Risk mitigation is the process of developing and implementing strategies to reduce the likelihood or impact of identified risks. It involves taking proactive actions to minimize potential disruptions, protect assets, and ensure the continuity of operations by managing vulnerabilities within the supply chain or business environment.

Risk pooling is the practice of combining multiple risks from different individuals or entities into a single group. This helps spread the financial impact of losses across the group, making it easier for insurers to predict and manage risks while keeping premiums more affordable for everyone involved.

Risk prioritisation is the process of evaluating and ranking security risks based on their potential impact on the business. Not all risks carry the same weight?some are more severe due to factors like system importance, data sensitivity, and ease of exploitation. Treating all risks equally can lead to misallocation of resources, where less critical issues are addressed while more serious threats are overlooked.

A risk register is a centralized document or tool used to identify, record, and track risks within a project or organization. It typically includes details such as the nature of each risk, its likelihood and impact, risk owner, mitigation measures, and status updates. The risk register helps prioritize and manage risks effectively throughout the risk management process.

Actuarial risk is the possibility that assumptions made by actuaries?such as life expectancy, accident rates, or claim frequency?may turn out to be incorrect. These miscalculations can lead to premiums being too low to cover actual losses, affecting an insurer’s profitability and financial stability. Accurate modeling is essential to minimize this type of risk.

Risk transfer is the process of shifting the potential financial consequences of a risk to another party, often through insurance, outsourcing, or contractual agreements. It allows organizations to reduce their exposure to certain risks by ensuring that another entity assumes responsibility for potential losses, helping to protect assets and maintain operational stability in case of disruptions.

Entities are urged to perform risk-based due diligence tailored to sectors and transaction types (e.g., M&A), including third parties?then monitor and adjust controls based on risk. This dynamic approach replaces one-size-fits-all compliance.

PFRDA is adopting risk-based supervision focusing on governance, compliance habits, financial soundness, and operational performance?promoting proportionality to reduce compliance costs and streamline supervision.

Establish clear, interdisciplinary ethical guidelines to govern AI development and use. Incorporate regular audits to ensure ongoing compliance, transparency, and alignment with societal values. These guidelines should address fairness, accountability, and potential risks, fostering responsible innovation and public trust in AI systems.

The Director of the ED or an authorized Deputy Director has the authority to initiate proceedings, attach property, and file applications. Their role is central to enforcing the provisions of the Act and taking action against high-value offenders.

Round-tripping is a deceptive financial practice where a company sells an asset and then repurchases it shortly after, often through a pre-arranged deal. This creates the illusion of legitimate revenue without real economic activity. It misleads investors and regulators about the company’s financial health and performance.

A rug pull is a crypto scam where developers promote a project, attract investor funds, then suddenly withdraw all liquidity, leaving investors with worthless tokens. Common in DeFi and NFT spaces, it exploits lack of regulation. Red flags include anonymous teams, unaudited smart contracts, and unrealistic promises. It’s a form of exit scam in the Web3 world.

Upon detecting unexplained volatility or rumor-driven moves, NSE may initiate clarifications, impose call auctions for impacted stocks, or temporarily suspend trading to restore equilibrium. These actions are non-discretionary and aim at ensuring transparent price discovery.

Broad restrictions on energy, finance, defense, and oligarchs.