A
Adverse Media
Negative news or information about an individual or entity found in public sources such as news articles, court records, regulatory announcements, or online publications. Adverse media screening is a key component of KYC and ongoing due diligence, helping firms identify reputational, legal, or financial crime risks associated with customers or counterparties.
AML (Anti-Money Laundering)
A broad set of laws, regulations, policies, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. AML programmes typically include customer due diligence, transaction monitoring, suspicious activity reporting, and staff training.
AML Policy
A formal document adopted by an organisation setting out its approach to preventing money laundering and terrorist financing. It typically covers risk appetite, roles and responsibilities, customer due diligence procedures, reporting obligations, and training requirements.
AML Risk Assessment
A structured evaluation of the money laundering and terrorist financing risks faced by an organisation, customer, product, or geographic region. Risk assessments inform the level of due diligence required and help firms allocate compliance resources proportionately.
Anonymisation
The process of irreversibly altering personal data so that an individual cannot be identified, directly or indirectly. Truly anonymised data falls outside the scope of GDPR and other data protection laws. Anonymisation differs from pseudonymisation, where re-identification remains possible under certain conditions.
Audit Trail
A chronological record of all activities, decisions, and changes within a compliance or data management system. Audit trails are essential for demonstrating regulatory compliance, supporting investigations, and providing evidence during supervisory reviews or enforcement actions.
B
Beneficial Owner
The natural person who ultimately owns or controls a legal entity or arrangement, or on whose behalf a transaction is conducted. Identifying beneficial owners is a fundamental requirement of KYC and CDD under AML regulations globally, including the EU Anti-Money Laundering Directives and the UK Money Laundering Regulations.
BSA (Bank Secrecy Act)
The primary US federal AML law, enacted in 1970. The BSA requires financial institutions to assist US government agencies in detecting and preventing money laundering by maintaining records, filing Currency Transaction Reports (CTRs) and Suspicious Activity Reports (SARs), and implementing AML programmes.
C
CAMS (Certified Anti-Money Laundering Specialist)
A globally recognised professional certification awarded by ACAMS (Association of Certified Anti-Money Laundering Specialists). Widely regarded as the gold standard AML qualification, demonstrating expertise in financial crime prevention, detection, and compliance.
CDD (Customer Due Diligence)
The process of verifying the identity of customers and assessing the risks they pose before and during a business relationship. CDD forms the foundation of AML compliance and typically includes identifying and verifying the customer, understanding the nature of the business relationship, and monitoring transactions on an ongoing basis.
CFT (Combating the Financing of Terrorism)
Measures taken by governments, regulators, and financial institutions to detect, prevent, and disrupt the financing of terrorist activities. CFT obligations often run alongside AML requirements and share many of the same tools and techniques, including transaction monitoring and suspicious activity reporting.
Compliance Framework
The overall structure of policies, procedures, controls, and governance arrangements an organisation puts in place to meet its regulatory obligations. A robust framework typically includes a written compliance policy, designated compliance personnel, regular risk assessments, staff training, internal audit, and reporting mechanisms.
Consent (Data Privacy)
Under GDPR, consent is one of the six lawful bases for processing personal data. Valid consent must be freely given, specific, informed, and unambiguous. Individuals must be able to withdraw consent at any time, and organisations must be able to demonstrate that valid consent was obtained.
Controller (Data Protection)
An organisation or individual that determines the purposes and means of processing personal data. Under GDPR, controllers bear primary responsibility for ensuring personal data is processed lawfully, fairly, and transparently, and that data subjects can exercise their rights.
CTR (Currency Transaction Report)
A report filed by US financial institutions with FinCEN for cash transactions exceeding $10,000 in a single business day. CTRs are a key tool in the detection of structuring and other money laundering activities.
D
Data Breach
A security incident in which personal data is accidentally or unlawfully accessed, disclosed, altered, lost, or destroyed. Under GDPR, organisations must notify their supervisory authority within 72 hours of becoming aware of a qualifying breach, and in some cases must also notify affected individuals directly.
Data Minimisation
A core GDPR principle requiring organisations to collect and process only the personal data that is necessary for the specific purpose for which it was obtained. Data minimisation reduces privacy risks and limits the potential impact of a data breach.
Data Protection Impact Assessment (DPIA)
A process required under GDPR for assessing the privacy risks of new or significantly changed data processing activities, particularly those likely to result in high risk to individuals. DPIAs help organisations identify and address risks before they materialise and are a key accountability tool.
Data Protection Officer (DPO)
A designated individual responsible for overseeing an organisation's data protection strategy and ensuring compliance with GDPR. Certain organisations are required by law to appoint a DPO, including public authorities and those carrying out large-scale processing of sensitive personal data.
Data Subject
An identified or identifiable natural person whose personal data is being processed. Under GDPR, data subjects have rights including access to their data, rectification, erasure, restriction of processing, data portability, and the right to object.
De-Risking
The practice by financial institutions of exiting or refusing business relationships with entire categories of customers or jurisdictions considered high-risk, rather than managing those risks on a case-by-case basis. De-risking has been criticised by regulators and international bodies for excluding legitimate customers from the financial system.
Due Diligence
The process of investigating and verifying information about a customer, counterparty, or transaction to assess associated risks. In AML, due diligence ranges from standard CDD for ordinary customers to enhanced due diligence (EDD) for higher-risk relationships.
E
EDD (Enhanced Due Diligence)
Additional scrutiny applied to higher-risk customers, relationships, or transactions. EDD is required under AML regulations for customers such as politically exposed persons (PEPs), high-risk third countries, and complex or unusual transactions. It typically involves gathering more detailed information, obtaining senior management approval, and increasing monitoring frequency.
EDPB (European Data Protection Board)
An independent EU body composed of representatives from national data protection authorities of all EU member states. The EDPB ensures consistent application of GDPR across the EU and issues guidelines, recommendations, and binding decisions on key data protection issues.
Enforcement Action
A formal regulatory or legal measure taken against an organisation or individual for failing to comply with applicable laws or regulations. In the AML and data protection space, enforcement actions can include financial penalties, public censure, licence revocation, or criminal prosecution.
F
FATF (Financial Action Task Force)
An intergovernmental body established in 1989 to set international standards for combating money laundering, terrorist financing, and proliferation financing. FATF's 40 Recommendations provide the global AML/CFT framework, and its mutual evaluations assess countries' compliance with these standards. Its typologies reports and guidance papers are essential reading for compliance professionals globally.
FCA (Financial Conduct Authority)
The UK's primary conduct regulator for financial services firms, responsible for supervising AML compliance for the majority of regulated financial services firms. The FCA has significant enforcement powers including the ability to impose unlimited financial penalties and withdraw regulatory authorisations.
FinCEN (Financial Crimes Enforcement Network)
A bureau of the US Department of the Treasury responsible for collecting and analysing financial intelligence to combat money laundering and terrorist financing. FinCEN administers the Bank Secrecy Act and maintains the beneficial ownership registry established under the Corporate Transparency Act.
Financial Intelligence Unit (FIU)
A national agency responsible for receiving, analysing, and disseminating financial intelligence related to suspected money laundering and terrorist financing. Examples include the NCA in the UK, FinCEN in the US, and FINTRAC in Canada.
Four Eyes Principle
A control mechanism requiring that certain decisions or transactions be reviewed and approved by at least two authorised individuals. In compliance, it is commonly applied to high-risk customer onboarding decisions, SAR filings, and significant compliance determinations.
G
GDPR (General Data Protection Regulation)
The EU's comprehensive data protection law, in force since 25 May 2018. GDPR establishes rights for individuals over their personal data and obligations for organisations that collect and process such data. It applies to any organisation processing the personal data of EU residents, regardless of where that organisation is based. The UK retained GDPR principles through the UK GDPR post-Brexit.
Governance
The system of rules, practices, and processes by which an organisation is directed and controlled. In a compliance context, governance refers to the structures and accountabilities that ensure regulatory obligations are met, including board oversight, management committees, policies, and internal controls.
H
Hawala
An informal value transfer system based on trust networks, widely used for legitimate remittances but also exploited for money laundering and terrorist financing. Settlement occurs outside formal banking channels through a network of brokers (hawaladars), making these transactions difficult to detect and monitor.
High-Risk Third Country
A jurisdiction identified by the EU or other regulatory bodies as having strategic deficiencies in its AML/CFT regime. Transactions involving high-risk third countries trigger mandatory enhanced due diligence requirements under EU Anti-Money Laundering Directives.
I
ICO (Information Commissioner's Office)
The UK's independent data protection regulator, responsible for enforcing the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations. The ICO can issue fines of up to £17.5 million or 4% of global annual turnover for serious breaches.
Internal Audit
An independent function within an organisation that evaluates the effectiveness of internal controls, risk management processes, and governance arrangements. In the compliance context, internal audit plays a critical role in assessing whether AML and data protection controls are operating effectively and independently of management.
K
KYB (Know Your Business)
The process of verifying the identity and legitimacy of business customers, including understanding their ownership structure, business activities, and the nature of the relationship. KYB is the corporate equivalent of KYC and is essential for managing the risks associated with business clients.
KYC (Know Your Customer)
The process of verifying the identity of customers and understanding their financial activities to assess the risk they pose. KYC encompasses customer identification, verification, beneficial ownership determination, and ongoing monitoring, and is a fundamental component of AML compliance.
L
Layering
The second stage of the money laundering process, in which criminals move funds through a series of complex transactions to distance them from their illegal source. Common techniques include wire transfers across multiple jurisdictions, currency conversions, and the use of shell company structures.
Legitimate Interest
One of the six lawful bases for processing personal data under GDPR. An organisation may rely on legitimate interest where the processing is necessary for its own or a third party's purposes, provided those interests are not overridden by the rights and interests of the data subject.
M
MLRO (Money Laundering Reporting Officer)
The designated individual within a UK regulated firm responsible for receiving internal suspicious activity reports, assessing them, and deciding whether to make a disclosure to the National Crime Agency. The MLRO is a statutory requirement under the Proceeds of Crime Act 2002 and Money Laundering Regulations 2017.
Mutual Evaluation
A peer review process conducted by FATF to assess how effectively a country has implemented FATF's Recommendations. Results influence a country's international reputation, access to correspondent banking, and the due diligence obligations imposed on firms operating in that jurisdiction.
N
NCA (National Crime Agency)
The UK's lead law enforcement agency for serious and organised crime, including money laundering and financial crime. The NCA's UK Financial Intelligence Unit (UKFIU) receives and analyses SARs submitted by regulated firms and disseminates financial intelligence to law enforcement and international partners.
O
Ongoing Monitoring
The continuous review of customer relationships, transactions, and behaviour to ensure they remain consistent with the firm's knowledge of the customer and their expected activity. Ongoing monitoring is a core AML obligation and includes transaction monitoring alerts, periodic reviews, and screening against updated sanctions lists.
P
PEP (Politically Exposed Person)
An individual who holds or has held a prominent public function — including heads of state, senior politicians, government officials, judicial officials, senior military officers, and executives of state-owned enterprises — together with their immediate family members and known close associates. PEPs are subject to enhanced due diligence due to elevated risk of corruption and bribery. Being a PEP is a risk indicator, not an automatic bar to a business relationship.
Personal Data
Any information relating to an identified or identifiable natural person. Under GDPR, personal data includes obvious identifiers such as names and email addresses, as well as location data, IP addresses, and online identifiers. Special categories of personal data — such as health information and biometric data — receive additional protection.
Placement
The first stage of the money laundering process, in which the proceeds of crime are introduced into the financial system. Common methods include cash deposits, currency exchanges, and the purchase of high-value assets. Placement is often the stage most vulnerable to detection.
Processor (Data Protection)
An organisation or individual that processes personal data on behalf of a controller. Under GDPR, processors must only act on the documented instructions of the controller and must implement appropriate technical and organisational security measures to protect personal data.
Pseudonymisation
Processing personal data such that it can no longer be attributed to a specific individual without the use of additional information kept separately. Unlike anonymisation, pseudonymised data remains personal data under GDPR and continues to be subject to data protection obligations.
R
Record Retention
The obligation to maintain records of CDD, transactions, and compliance activities for a specified period. UK Money Laundering Regulations require a minimum retention period of five years. Data protection law simultaneously requires that personal data is not kept longer than necessary — a tension firms must actively manage and document.
Risk Appetite
The level and type of risk an organisation is willing to accept in pursuit of its objectives. In an AML context, a risk appetite statement defines the categories and levels of money laundering or terrorist financing risk a firm is prepared to accept and informs decisions on customer acceptance, product design, and geographic exposure.
Risk-Based Approach (RBA)
The internationally recognised AML/CFT compliance framework in which the level of due diligence and controls is proportionate to the level of risk identified. The RBA is central to FATF's Recommendations and underpins most national AML regulatory frameworks globally.
S
SAR (Suspicious Activity Report)
A report filed by a regulated firm with its Financial Intelligence Unit when it knows or suspects a customer or transaction is connected to money laundering, terrorist financing, or other financial crime. In the UK, SARs are submitted to the NCA's UKFIU. In the US, they are filed with FinCEN. SARs are a critical source of financial intelligence for law enforcement.
Sanctions
Restrictive measures imposed by governments or international bodies against individuals, entities, or countries to achieve foreign policy or national security objectives. Firms are required to screen customers and transactions against applicable sanctions lists and to freeze any assets belonging to designated parties.
SDD (Simplified Due Diligence)
A reduced level of CDD applicable to demonstrably lower-risk customers or products. SDD does not mean no due diligence — firms must still identify the customer and conduct ongoing monitoring, but may apply reduced verification requirements where the lower risk is clearly evidenced and documented.
Shell Company
A legal entity with no active business operations or significant assets, often used to obscure the beneficial ownership of funds or assets. Shell companies are a cornerstone of many money laundering structures and a sustained focus for regulators and financial intelligence agencies worldwide.
Special Categories of Data
Under GDPR, certain types of personal data receive additional protection due to their sensitive nature. These include data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning a person's sex life or sexual orientation.
Structuring
The practice of deliberately breaking up large cash transactions into smaller amounts to avoid triggering currency transaction reporting thresholds — also known as "smurfing." Structuring is itself a criminal offence in many jurisdictions, regardless of whether the underlying funds are from legitimate sources.
T
Terrorist Financing
The provision or collection of funds with the intention that they be used to carry out terrorist acts or support terrorist organisations. Unlike money laundering, terrorist financing may involve legitimate funds, making it particularly challenging to detect through standard transaction monitoring systems.
Tipping Off
The criminal offence of disclosing to the subject of a SAR, or to a third party, that a report has been filed or that an investigation is underway. Tipping off carries serious criminal penalties in most jurisdictions and is a criminal offence in the UK under the Proceeds of Crime Act 2002.
Transaction Monitoring
The automated or manual review of customer transactions to detect patterns or activities that may indicate money laundering, terrorist financing, or other financial crime. Transaction monitoring systems generate alerts when transactions meet predefined risk criteria, which are then reviewed by compliance analysts.
U
UK GDPR
The version of the EU GDPR retained in UK law following Brexit, with modifications for the UK context made by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. The UK GDPR operates alongside the Data Protection Act 2018 and mirrors the EU GDPR in most key respects, with the ICO as the supervisory authority.
Ultimate Beneficial Owner (UBO)
The natural person who ultimately owns or controls a corporate entity, either through direct or indirect ownership of shares or voting rights, or through other means of control. Identifying UBOs is a core CDD requirement under AML regulations in most jurisdictions and a persistent focus of regulatory examination findings.
W
Wire Transfer
An electronic transfer of funds between financial institutions. Wire transfers are subject to specific AML obligations under FATF Recommendation 16 (the Travel Rule), which requires financial institutions to include originator and beneficiary information to enable tracing of funds.
Whistleblowing
The reporting of suspected wrongdoing within an organisation to an internal or external authority. In the AML context, whistleblowing mechanisms allow employees to report suspected financial crime or regulatory breaches without fear of retaliation. Many jurisdictions provide specific legal protections for financial services whistleblowers.
This glossary is maintained by LetsTalkAML and updated regularly. Last reviewed: 2025. For queries or suggested additions, use the Contact page.