Glossary

A safe harbour is a rule or provision that protects a person from liability or penalty if they meet stated conditions, giving certainty that a given course of action will not be challenged.

Sanctions are legal restrictions imposed by governments or international bodies on countries, sectors, organisations or individuals, to pursue foreign policy or security aims by limiting their access to funds, trade or travel.

Sanctions compliance is the set of policies, controls and governance an organisation uses to follow sanctions law, covering risk assessment, screening, escalation, training, testing and record keeping.

A sanctions compliance officer is the senior person who owns a firm’s sanctions controls: setting policy, advising the business, deciding on escalated cases and acting as the contact for regulators.

Sanctions deconfliction is the process of working out what a firm should do when the sanctions rules or lists of different countries pull in opposite directions, or where one country’s law forbids obeying another’s.

Sanctions evasion is any act that hides a prohibited party’s involvement in a deal, or moves goods and money around sanctions restrictions, so that banned activity appears to be permitted.

Sanctions risk is the chance that an organisation breaches sanctions, knowingly or not, and suffers fines, criminal liability, frozen funds, lost banking relationships or reputational damage as a result.

A sanctions risk assessment is a structured review of how and where an organisation could breach sanctions, rating exposure by customer, geography, product and channel, and judging how well controls reduce it.

Sanctions screening is the checking of customers, owners, counterparties and transactions against sanctions lists, to find prohibited parties before a relationship or payment goes ahead.

The Sarbanes-Oxley Act is a 2002 United States law that tightened financial reporting, internal controls and auditor oversight for public companies after major accounting scandals.

Scenario analysis studies what could happen to an organisation under a specific set of plausible events, to measure the damage and test whether its plans and resources are enough.

The Science Based Targets initiative is a body that sets criteria for corporate emissions targets and validates whether a company's targets match what climate science says is needed to meet the Paris goals.

Scope 1 emissions are greenhouse gases released directly from sources that an organisation owns or controls, such as boilers, furnaces, company vehicles and process leaks.

Scope 2 emissions are greenhouse gases released in generating the electricity, steam, heat or cooling that an organisation buys and uses, even though the release happens at the supplier's site.

Scope 3 emissions are all other indirect greenhouse gas emissions in a company's value chain, from suppliers, transport, product use and disposal, to investments, which are not in its own operations or purchased energy.

Secondary sanctions are penalties applied to people and firms outside the sanctioning country, usually non-nationals, for dealing with a sanctioned target, even where the dealing would be lawful in their own country.

A secrecy jurisdiction is a country or territory whose laws and practice make it hard for other countries to learn who owns assets, companies or accounts held there.

Sectoral sanctions limit specific kinds of dealings with selected sectors of a country’s economy, such as finance, energy or defence, rather than banning all business with the country or with named individuals.

A security operations centre is a team, often with dedicated tools and premises, that monitors an organisation's systems around the clock, detects security events and starts the response.

Segregation of duties is the control principle of splitting the steps of a process among different people, so that no single person can both carry out and conceal an error or fraud.

Self-certification is a signed statement by an account holder, given to a financial institution, declaring where they are tax resident and giving their tax identification number for CRS and FATCA reporting.

Self-laundering is the laundering of criminal proceeds by the same person who committed the crime that produced them, such as a fraudster who hides their own fraud money.

A self-regulatory organisation is an industry or professional body that writes and enforces rules for its members, with powers given or recognised by law or by a statutory regulator.

Self-reporting is when a firm tells its regulator or enforcement authority about a breach or possible breach it has found itself, before the authority discovers it, often in return for lighter treatment.

Sensitive personal data is information about a person, such as health, beliefs, ethnic origin or biometric identifiers, whose misuse could cause serious harm or discrimination, so privacy laws demand stricter conditions before it is handled.

Sensitivity analysis tests how much a result changes when one input or assumption is varied, showing which inputs matter most to the outcome.

Settlement risk is the danger that one side of a trade pays or delivers but the other side fails to do so. The first party loses the full amount sent, not just the market movement.

Shadow banking is lending and maturity transformation done by non-bank firms and funds that fall outside the safeguards, such as capital and liquidity rules, that apply to deposit-taking banks.

A shadow fleet is a group of ships, often old tankers with hidden ownership and weak insurance, used to carry sanctioned oil or other cargo while avoiding the checks that apply to mainstream shipping.

Shadow IT is the use of apps, cloud services, devices or software by employees or teams without the knowledge or approval of the organisation's IT and security functions.

The shared responsibility model divides security and compliance duties between a cloud provider and its customer, with the split depending on the service type, so that each knows what it must secure.

Shareholder activism is when an investor takes a sizeable minority stake in a listed company and uses that ownership to press for changes in strategy, management, capital use or governance.

A shell bank is a licensed bank with no real office or management in the place that licensed it, and no link to a regulated group whose supervisor oversees the whole group.

A shell company is a registered legal entity with no real operations, staff or assets of its own. It has some legitimate uses, but is often used to hide who owns or controls money.

Short selling regulation is the set of rules that require traders to disclose large short positions, and that limit or ban selling shares or bonds they have not borrowed, to curb abuse and market stress.

A show cause notice is a written notice from a regulator or authority telling a person or firm what breach is alleged and asking them to explain, within a set time, why action should not be taken.

SIM swap fraud is when a criminal persuades a mobile operator to move a victim’s phone number to a SIM card the criminal controls, so as to receive one-time codes and take over the victim’s accounts.

Simplified due diligence is a lighter version of customer checks that a firm may apply where money laundering and terrorist financing risk has been assessed as low, with fewer or less detailed requirements.

A single point of failure is any one component, person, supplier or process whose breakdown would stop an entire service or system because no backup or alternative route exists.

Social engineering is the manipulation of people, through deception, pressure or trust, into handing over information, access or money that they would not otherwise give to an attacker.

Social washing is when a company overstates or misrepresents its record on social matters, such as diversity, fair pay, workers’ rights or community benefit, to look more responsible than the evidence supports.

Source of funds is the origin of the specific money used in a transaction or placed into an account, such as a salary payment, a property sale or an inheritance, and the evidence that supports it.

Source of wealth is how a customer accumulated their overall assets over time, for example through employment, a business, investments, inheritance or property, and the evidence that the story is credible.

A speak-up culture is a working environment where people feel safe to raise concerns, mistakes and disagreement with colleagues and leaders, expecting to be heard and not punished.

The SDN List is the US Treasury’s main sanctions list, naming individuals, companies, vessels and aircraft whose assets are blocked and with whom US persons are generally barred from dealing.

A specific licence is written permission from a sanctions authority to a named applicant to carry out a particular activity that the sanctions would otherwise prohibit, on stated terms and for a limited time.

Spoofing is entering orders you never mean to fill, then cancelling them, so other traders misread demand or supply and move the price in the spoofer's favour.

Stakeholder engagement is the planned, two-way dialogue between an organisation and the people and groups affected by or interested in its activities, used to understand concerns and inform decisions.

Stakeholder theory holds that a company should weigh the interests of everyone its actions affect, including employees, customers, suppliers, communities and investors, and not only those of its shareholders.

Standard Contractual Clauses are pre-approved contract terms that two parties sign so that personal data can move to a country without equivalent privacy law while the recipient still promises to protect it to a set standard.

A State-Owned Enterprise is a commercial business that a government owns outright or controls through a majority stake, and that sells goods or services rather than simply administering policy.

Statutory registers are the records a company must keep by law, such as who its shareholders and directors are and what charges secure its debts, and must make available for inspection.

Storage limitation is the data protection principle that personal data may be kept in identifiable form only as long as needed for the purpose it was collected for, and must then be deleted or anonymised.

Stranded assets are assets that lose value early, or become unusable, because of changes such as climate policy, new technology or shifting demand, leaving owners and lenders with write-downs.

Strategic risk is the risk that an organisation fails to meet its goals because of poor strategic choices, weak execution of its plan, or a failure to adapt to changes in its market or environment.

Stress testing measures how an organisation, portfolio or system would cope under severe but plausible shocks, such as a deep recession or a market crash, to see whether it stays sound.

Strict liability makes a person or organisation legally responsible for harm or a breach even without proof of intent, negligence or fault. The fact that the event occurred is enough.

Structuring, also called smurfing, is splitting a large amount of cash into smaller deposits or transfers, often across accounts or people, to stay below reporting thresholds and avoid attention.

Succession planning is the process by which a board prepares for planned and sudden changes in its top leadership, by identifying and developing candidates and having an emergency plan for abrupt departures.

Suitability is the test that a financial product or recommendation fits the particular customer's objectives, financial situation, knowledge and capacity to bear loss, judged before the sale is made.

A data protection supervisory authority is the independent public body that monitors and enforces privacy law in a country or region, handling complaints, investigating breaches and imposing fines or orders.

A supplier code of conduct is a document that sets out the ethical, labour, environmental and legal standards a buyer expects its suppliers to meet as a condition of doing business.

A supply chain attack breaks into a target by first compromising a supplier, vendor or software provider the target already trusts, then using that supplier's own updates, code or access to reach the real victim.

Supply chain risk is the chance that disruption, failure or misconduct at any point in the network that makes and delivers goods and services interrupts supply, raises cost or harms the buyer's reputation.

Supply chain traceability is the ability to follow a product, material or ingredient from its origin through each stage of processing and transport to the final customer, using records that can be checked.

A Supreme Audit Institution is the highest independent public body in a country that examines how government raises, spends and accounts for public money, and reports its findings to the legislature.

SupTech is the use of technology by financial and other supervisors to collect, process and analyse data, so they can monitor firms and markets faster and more accurately than manual review allows.

A SAR or STR is a confidential report sent by a regulated business to the financial intelligence unit when it suspects that funds or activity are linked to crime, money laundering or terrorist financing.

The SASB Standards are a set of industry-specific disclosure standards that name the sustainability topics and metrics most likely to affect a company’s financial performance, written for use in reporting to investors.

Sustainability assurance is an independent practitioner’s examination of reported sustainability information, ending in a conclusion that tells readers how far the disclosures can be trusted.

Sustainability governance is the set of structures, roles and decision rights through which a board and management oversee sustainability risks, targets and reporting, and are held accountable for them.

Sustainability reporting is the practice of disclosing an organisation’s environmental, social and governance performance, risks and impacts to stakeholders, increasingly following common standards and subject to assurance.

A sustainability-linked bond is a debt instrument whose financial terms, usually the interest rate, change depending on whether the issuer meets pre-set sustainability targets, and the proceeds can be used for any purpose.

A sustainability-linked loan is a loan whose interest margin goes up or down depending on whether the borrower meets agreed sustainability performance targets, with the funds usable for general corporate purposes.

The SDGs are seventeen goals adopted by all UN member states in 2015, setting shared targets to 2030 on poverty, health, equality, climate and other global problems, which companies and governments use as a common reference.

Sustainable finance is the provision of financial services, such as lending, investing, insurance and capital raising, that takes environmental, social and governance factors into account and supports sustainable economic activity.

The Sustainable Finance Disclosure Regulation is an EU law requiring financial firms and funds to disclose how they treat sustainability risks and the effects of their investments on people and the environment.

SWIFT disconnection is the removal of named banks from the SWIFT messaging network, which cuts their usual route for sending and receiving international payment instructions, as a sanctions measure against a country or its financial sector.

The Swiss cheese model explains accidents by treating every safeguard as having weak spots. Harm follows only when the weak spots in several safeguards happen to coincide.

Synthetic identity fraud uses a made-up person, built by mixing real identifiers such as a genuine national ID number with invented names, dates or addresses, to open accounts and borrow money that is never repaid.

Systemic risk is the risk that the failure of one institution, market or infrastructure triggers a chain of failures that disrupts a whole financial system or economy, and not only the party first affected.

A SIFI is a financial institution so large, connected or hard to replace that its failure could damage the wider financial system, and which therefore faces stricter supervision and higher capital requirements.