151 compliance terms, in plain language.

When a criminal gains control of someone else's account, often with stolen passwords, and uses it to move money or data.

Credible negative news about a person or company, such as fraud, corruption or sanctions evasion, used as a risk signal in due diligence.

A notice that something needs a person's attention, such as a possible list match or an unusual transaction.

When too many low-value alerts make reviewers less careful, so real risks are missed.

Another name a person or company is known by. Good screening checks listed aliases as well as the main name.

Anti-money laundering: the laws, controls and checks that stop criminal money entering or moving through legitimate businesses.

A firm's written set of AML policies, controls, training, testing and a responsible officer, as required by its regulator.

Laws and controls that stop paying or receiving bribes, including through third parties. Often shortened to ABC.

A legal requirement to stop any dealing with the funds or economic resources of a sanctioned party.

A time-ordered record of who did what and when, kept so it can be reviewed by an auditor or examiner later.

Running a rule over past activity to see what it would have flagged before switching it on.

Checking a whole file of names in one run instead of one at a time.

Shares owned by whoever holds the paper certificate, which can hide ownership; now restricted in many countries.

The real person who ultimately owns or controls a company, however many companies sit in between. Often abbreviated to UBO.

A government register that records who ultimately owns or controls companies.

Assets that must be frozen because they belong to, or are controlled by, a sanctioned person or entity.

The verified facts that establish a company is real: registration, status, address, officers and owners.

A scheme in which an account or business builds a good record, then borrows or spends heavily and disappears.

Tools for tracking an alert from review to decision, with notes, evidence and approvals in one place.

A business that handles a lot of cash, such as restaurants or car washes, and so carries higher money-laundering risk.

Customer due diligence: identifying a customer, understanding the relationship and assessing its risk before and during it.

A record showing who held a piece of evidence and when, so it can be trusted later.

A person with a close business or personal relationship to a politically exposed person.

The person responsible for a firm's compliance programme. In AML often called the MLRO or BSA officer.

A single list that combines several sanctions programmes or authorities in one place.

One bank providing services to another bank, often across borders; a higher-risk relationship for money laundering.

The level of risk linked to a country, based on factors such as sanctions, corruption and the strength of its AML controls.

A section of a report that names which sources were searched and which could not be, so a gap is never read as a clear result.

Counter-terrorist financing: controls that stop money reaching terrorist groups. Usually paired with AML as AML/CTF.

Updating a customer's information and risk rating periodically or when something changes.

A score or band that sets how closely a customer is checked and monitored, based on who they are and what they do.

Collecting and keeping only the personal data you actually need.

A contract that sets how a supplier may handle personal data on a customer's behalf. Often called a DPA.

How long records are kept before deletion, set by law and policy.

Exclusion of a person or company from government contracts or programmes, usually for misconduct.

A person or company that may not receive certain goods, services or technology under export-control rules.

A person or entity formally placed under sanctions by an authority.

The decision recorded on an alert, such as not a match, confirmed match or escalated.

See dual-use goods: items with both civilian and military applications.

Items with both civilian and military uses, which may need an export licence.

The checks done before entering, or while maintaining, a business relationship.

A set of questions sent to a vendor or customer to gather information for a risk assessment. Often called a DDQ.

Enhanced due diligence: deeper checks for higher-risk customers, such as source of funds and senior approval.

A broad ban on trade with a country or in certain goods.

The final recipient and user of exported goods or technology.

Confirming how exported goods will be used, to rule out prohibited uses.

A penalty or order a regulator imposes for breaking the rules.

Working out that records with different spellings or details refer to the same person or company.

Whether a party is an individual, company, vessel or aircraft; matching them as the right type cuts false alerts.

Sending a case to a more senior reviewer or specialist because it may be a real risk.

A fingerprint of a saved record. If anything in the record changes, the fingerprint no longer matches.

A government list of people and companies barred from certain programmes or contracts.

Rules that restrict the export of certain goods, software and technology to certain countries, people or uses.

A real match that screening fails to flag. More dangerous than a false positive.

An alert that looks like a match but is not. Good tools reduce them without hiding real matches.

The Financial Action Task Force, the global body that sets AML/CTF standards and publishes lists of higher-risk jurisdictions.

Crimes involving money, such as fraud, money laundering, bribery, tax evasion and sanctions evasion.

The national agency that receives and analyses suspicious activity reports. Often called the FIU.

Work extracted under threat or coercion. Several countries restrict imports made with it.

See four-eyes review: a second person approves a decision.

A control in which a second person must approve a decision before it takes effect.

Stopping any use, transfer or dealing with funds or assets that belong to a sanctioned party.

A company used to hide the real party behind a transaction.

Matching names that are close but not identical, such as spelling variants, transliterations and typos.

Professionals such as lawyers, accountants and company formation agents who can enable or prevent financial crime.

An informal name for jurisdictions under increased monitoring by the global AML standard setter.

A country identified as having strategic weaknesses in its AML/CTF controls, triggering enhanced checks.

A result returned by a screening search that needs review.

A value sent with an API request so that repeating the request is processed once, not twice.

Confirming that a person is who they say they are, for example with documents or data checks.

A review of an AML programme by someone not involved in running it, often required periodically.

Owning a company through one or more other companies rather than directly.

The final stage of money laundering, when criminal money re-enters the economy looking legitimate.

Understanding the customers of your business customers, for example in payments and correspondent banking.

Know your business: confirming who a company is, that it exists and is in good standing, and who owns and runs it.

Know your customer: confirming a customer's identity and understanding their risk before and during a relationship.

The middle stage of money laundering: moving money through many transactions to hide its origin.

A rule that stops records from being deleted while they may be needed for a dispute or investigation.

Official permission to export certain goods or to deal with a sanctioned party in specific circumstances.

A test that a real person is present during identity verification, not a photo or video.

A number showing how closely a name and its details match a listed record.

The score above which a possible match is shown for review.

A change in a customer or vendor, such as new owners, that should trigger a fresh review.

Money laundering reporting officer: the person who decides whether to report suspicious activity.

A person who moves money for criminals, knowingly or not.

Checking customers, vendors or transactions continuously or on a schedule, rather than once.

Checking a name against sanctions, PEP and other risk lists.

A different spelling or form of the same name, such as Mohammed and Muhammad.

Another name for adverse media.

See adverse media screening.

A person who holds shares or a directorship on behalf of someone else.

A customer based outside the country where the account or service is provided, often a higher-risk factor.

Ending a customer or vendor relationship and handling records and funds correctly.

A company registered in a jurisdiction other than where it mainly operates, sometimes used to hide ownership.

The process of accepting a new customer, vendor or partner, including the checks done before going live.

Keeping customer information and risk ratings up to date during the relationship.

See monitoring: watching relationships continuously after onboarding.

The sequence of companies and people between a company and its ultimate owners.

Tricking someone into making or redirecting a payment, for example with a fake request to change bank details.

An authorised simulated attack to find security weaknesses.

Politically exposed person: someone with a prominent public role, or a close relative or associate, who carries higher corruption risk.

The first stage of money laundering: putting criminal cash into the financial system.

The specific version of the rules in force when a decision was made, kept with the decision.

The underlying crime that produced the money being laundered.

Funding the development of weapons of mass destruction. Increasingly covered by AML rules.

A document showing where a person lives, used in some identity checks.

How often existing relationships are checked again, set by risk.

Running existing customers or vendors through screening again, for example when lists change.

A sign that something may be wrong and needs a closer look.

Technology that helps firms meet regulatory requirements.

Risk that comes from who a customer is connected to, such as owners, directors or related companies.

Running a past check again to see what it would say now, with the difference from the original shown.

Any person or company on a list that limits trade or transactions with them.

How much risk an organisation is willing to accept to meet its goals.

A structured review of the risks a business faces and the controls in place.

Spending more effort on higher-risk customers and less on lower-risk ones, as regulators expect.

Restrictions a government or international body places on countries, people, companies, ships or sectors.

Attempts to get around sanctions, for example through front companies, false documents or third countries.

A published list of people, companies and other targets subject to sanctions.

A set of sanctions measures aimed at a country, regime or activity.

Suspicious activity report: a report to the financial intelligence unit about activity that may involve crime. Called an STR in some countries.

A standard way for an identity provider to add, update and remove users in an application automatically.

Checking a name, company or payment against lists and sources to find risk.

The share of screened names that produce a possible match.

Measures aimed at non-domestic parties that deal with a sanctioned target.

Risk linked to an industry, such as gambling, crypto or precious metals.

Restrictions that apply to particular industries or activities rather than to named targets only.

A company with no real operations, sometimes used legitimately and sometimes to hide money or ownership.

Signing in to many applications with one company account. Often called SSO.

See structuring: splitting transactions to avoid reporting thresholds.

An independent auditor's report on a service organisation's security and related controls.

The original document or record a finding is based on.

Where the money used in a particular transaction or relationship comes from.

How a person built their overall wealth.

Suspicious transaction report: the name for a suspicious activity report in many countries.

Splitting transactions to stay below reporting thresholds. Also called smurfing.

A third party a supplier uses to process customer personal data.

An identity made by combining real and invented details to open accounts.

Risk that comes from vendors, suppliers, partners and other outside parties.

The value at which a rule raises an alert.

Warning someone that they are the subject of a suspicious activity report or investigation; often illegal.

Hiding criminal money through trade, for example by mis-invoicing goods.

Reviewing payments and activity for patterns that may indicate crime.

Writing a name from one script in another, such as Arabic or Cyrillic into Latin letters, which creates spelling variants.

A rule that requires certain sender and receiver details to travel with a payment or virtual-asset transfer.

Ultimate beneficial owner. See Beneficial owner.

The person who in practice controls a company, even without owning shares.

Checks on a supplier before contracting and during the relationship.

The checks and setup done before a supplier can be used and paid.

Any list of people or entities that warrant attention, including sanctions, law-enforcement and regulatory lists.

A message one system sends to another when something happens, such as a new alert.