Glossary

> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

Account Monitoring

The ongoing surveillance of customer transactions after initial KYC onboarding to detect changes in account behaviour, new high-risk activities, or trigger events requiring re-verification. Software implementations use event-driven triggers combined with scheduled batch reviews to keep risk profiles current. (31 CFR § 1020.210)

AML (Anti-Money Laundering)

A set of laws, regulations, and procedures intended to prevent criminals from disguising illegally obtained funds as legitimate income. US AML obligations for banks derive primarily from the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and are enforced by FinCEN. Builders must implement transaction monitoring, SAR filing workflows, and customer due diligence pipelines to satisfy these obligations.

Automated Clearing House (ACH)

A US electronic network for financial transactions used for direct deposits, payroll, and consumer bill payments. ACH transactions are governed by NACHA rules and must be monitored for AML patterns including layering via multiple rapid ACH transfers. Builders integrate ACH into transaction monitoring systems with specific velocity rules for same-day ACH limits.

Bank Secrecy Act (BSA)

The primary US AML statute, 31 U.S.C. § 5311 et seq., requiring financial institutions to maintain records and file reports that help identify, detect, and deter money laundering and other financial crimes. The BSA is administered by FinCEN. Software builders must implement CTR filing at $10,000 cash thresholds, SAR filing for suspicious activity, and five-year record retention. (31 U.S.C. § 5311)

Beneficial Owner

A natural person who ultimately owns or controls a legal entity customer. Under FinCEN's Customer Due Diligence (CDD) Rule (31 CFR § 1010.230), financial institutions must identify and verify beneficial owners who own 25% or more of a legal entity and one individual who controls the entity. Builders model beneficial ownership as a directed graph: entity nodes link to natural person nodes with ownership percentage edges.

Biometric Identity Verification

The use of biometric data - fingerprints, facial recognition, liveness detection - as a KYC identity verification method. Biometric checks supplement document verification and are common in mobile onboarding flows. Builders must ensure biometric data is handled under applicable data protection law (GDPR Art. 9 for EU users) and never stored as raw biometric templates without explicit consent.

Blocking (OFAC)

The freezing of funds or assets of a sanctioned individual or entity under OFAC jurisdiction. When a sanctions match is confirmed, the financial institution must block the transaction, maintain records of the blocked property, and file an OFAC report within 10 business days. Builder implementations must support a blocked state on transactions with timestamps and the matching SDN entry reference.

CDD (Customer Due Diligence)

The process of verifying a customer's identity, understanding the nature of their business and expected activity, and assessing the risk they pose. FinCEN's CDD Rule (31 CFR § 1010.230) mandates CDD for all legal entity customers including collection of beneficial ownership. Software systems must record every CDD action, its timestamp, the analyst performing it, and the documentary evidence reviewed. (31 CFR § 1010.230)

CKYC (Centralised Know Your Customer)

A centralised KYC registry maintained by a regulator or industry utility, allowing financial institutions to share verified KYC data and reduce duplicate onboarding friction. India's CKYC Registry is a prominent example. Builders may integrate with CKYC utilities via API to fetch pre-verified identity data, but must still record the fetch, the data version, and the institution's reliance on it.

Consent Log

A structured record of a customer's consent to data processing, used in Open Banking implementations to track which third-party providers (TPPs) have been granted access to which accounts and for what purpose. PSD2 (Directive 2015/2366/EU, Art. 67) requires that consent is explicit, time-limited, and revocable. Builders must implement consent log tables with creation, expiry, and revocation timestamps plus scope fields. (PSD2 Art. 67, EUR-Lex 2015/2366/EU)

CTR (Currency Transaction Report)

A mandatory report filed with FinCEN when a financial institution facilitates a cash transaction exceeding $10,000 by a single customer in a business day. Multiple smaller cash transactions by the same customer on the same day must be aggregated ("currency aggregation rule"). Builders implement CTR filing via a nightly batch that aggregates same-day, same-customer cash transactions against the $10,000 threshold. (31 CFR § 1010.311)

Customer Identification Programme (CIP)

A written programme required of banks and other financial institutions under the USA PATRIOT Act (31 CFR § 1020.220) specifying how they verify the identity of customers who open new accounts. CIP must collect name, date of birth, address, and ID number; verify through documentary or non-documentary means; and compare against government lists. Builder CIP modules must produce a verification record for each customer.

Documentary Verification

The process of confirming identity by checking a physical or digital government-issued identity document (passport, national ID, driver's licence). Document verification in software pipelines typically uses an OCR extraction step, a liveness/biometric check, and a lookup against a document authenticity database. Results must be logged with the document type, issuing country, expiry date, and verification outcome.

Dynamic Thresholds

AML monitoring rules with thresholds that adjust automatically based on a customer's historical transaction behaviour or peer group baseline. A builder implementing dynamic thresholds sets a rule like "flag any transaction more than 3 standard deviations above the customer's 90-day rolling mean." Dynamic thresholds reduce false-positive rates compared to static universal limits.

EDD (Enhanced Due Diligence)

Additional identity verification and monitoring measures applied to high-risk customers - including PEPs, customers from high-risk jurisdictions, or customers with unusual transaction patterns. EDD typically requires senior management approval, more frequent re-verification, and more intensive transaction monitoring. Builders flag EDD customers in the data model and apply tighter alert rules.

eIDAS (Electronic Identification, Authentication and Trust Services)

An EU regulation (Regulation (EU) 910/2014) establishing a legal framework for cross-border electronic identity and trust services. Relevant to KYC in EU banking platforms because eIDAS notified eID schemes can satisfy strong customer authentication and remote identity verification requirements. Builders integrating notified eID schemes must record the assurance level (low, substantial, high) and the scheme identifier. (Regulation (EU) 910/2014, EUR-Lex 910/2014)

FATF (Financial Action Task Force)

The global intergovernmental body that sets international AML/CFT standards. FATF Recommendations define the risk-based approach to AML and are adopted by member jurisdictions in domestic law. When building for financial clients in multiple jurisdictions, builders reference FATF's country risk ratings and the FATF Recommendations (especially Recommendation 10 on CDD and Recommendation 20 on SAR reporting).

FIDO2 (Fast Identity Online 2)

An authentication standard comprising the W3C WebAuthn API and the FIDO Alliance's CTAP protocol, enabling phishing-resistant public-key authentication via hardware security keys, biometric authenticators, or platform authenticators. PSD2 RTS (Delegated Regulation (EU) 2018/389) lists FIDO2-based authenticators as compliant possession/inherence factors for Strong Customer Authentication. Builders implement FIDO2 using the WebAuthn browser API combined with server-side attestation verification. (PSD2 RTS Art. 9, EUR-Lex 2018/389)

FinCEN (Financial Crimes Enforcement Network)

The US Treasury bureau that administers the Bank Secrecy Act, receives and analyses financial intelligence (CTRs, SARs), and issues AML regulations for financial institutions. FinCEN's BSA E-Filing System is the submission endpoint for CTRs and SARs. Builders integrate with FinCEN by generating BSA XML payloads that comply with the published FinCEN XML schema. (31 CFR Parts 1010–1030)

GDPR and Banking

The General Data Protection Regulation (Regulation (EU) 2016/679) applies to EU-domiciled customers of banking platforms. KYC data (identity documents, biometrics, financial profiles) is typically sensitive personal data requiring a clear lawful basis. Builders must implement data minimisation, purpose limitation, and retention limits in the same KYC data model, cross-referencing the AML five-year retention obligation with GDPR's erasure rights. (GDPR Art. 6, 9; EUR-Lex 2016/679)

High-Risk Jurisdiction

A country or territory identified by FATF or domestic regulators as having strategic AML/CFT deficiencies. Customers from high-risk jurisdictions require EDD. Builders implement a jurisdiction risk table that is updated from FATF plenary outputs and OFAC CAATSA/SDN lists and use it to flag transactions originating from or destined to high-risk countries.

IBAN (International Bank Account Number)

A standardised international identifier for bank accounts under ISO 13616. IBANs are validated using a MOD-97 check algorithm. KYC data models store the customer's primary payment IBAN alongside the BIC/SWIFT code of their bank. AML systems monitor IBAN-level transaction flows for cross-border layering patterns.

KYC (Know Your Customer)

The process by which a financial institution verifies the identity of its customers before and during the provision of services. KYC comprises three tiers: simplified due diligence (SDD) for low-risk products, standard CDD for ordinary customers, and EDD for high-risk customers. Builders implement KYC as a state machine: pending_verification → in_review → verified → expired, with scheduled re-verification triggers.

KYC Data Model

The structured set of tables storing identity documents, verification attempts, PEP/sanctions results, risk scoring, and EDD flags for each customer. A complete KYC data model includes: customers, identity_documents, verification_attempts, pep_screenings, sanctions_screenings, risk_assessments, and kyc_events. Each table must be append-only for audit purposes with soft-delete only.

Layering

The second stage of money laundering (after placement), involving a series of complex financial transactions designed to distance illicit funds from their source. Layering is detected by transaction monitoring rules that track rapid movement of funds through multiple accounts, inter-entity transfers, and jurisdiction-hopping. Builders encode layering typologies as graph-traversal rules over the transaction network.

LEI (Legal Entity Identifier)

A 20-character ISO 17442 code uniquely identifying legal entities in financial transactions. Required for reporting under MiFID II and EMIR. For AML purposes, LEI helps link entity customers to their beneficial owners in external databases. Builders validate and store the LEI on corporate account records and use LEI lookups in EDD processes.

MLRO (Money Laundering Reporting Officer)

The designated individual responsible for receiving internal SAR reports, making external SAR filings to FinCEN, and overseeing the AML programme. Software platforms must provide the MLRO with a case management interface that surfaces all pending alerts and SAR decisions, tracks deadlines, and logs all MLRO-level actions with timestamps.

OFAC (Office of Foreign Assets Control)

The US Treasury office that administers economic sanctions against countries, regimes, individuals, and entities. Financial institutions must screen customers and transactions against OFAC's Specially Designated Nationals (SDN) list and Consolidated Sanctions List before providing services. Builders implement OFAC screening as a synchronous check during onboarding and an asynchronous re-screen on existing customers when the SDN list is updated.

Open Banking

A framework, enabled by PSD2 in the EU, that requires banks to provide third-party providers with API access to customer account data (AISP) and the ability to initiate payments (PISP) - with customer consent. Builders implementing Open Banking APIs must manage consent lifecycle (OAuth2 authorisation code flow), scope the API token to the granted permissions, and honour consent revocation. (PSD2 Art. 66–67, EUR-Lex 2015/2366/EU)

OTP (One-Time Password)

A dynamically generated, time-limited authentication code used as a second factor in multi-factor authentication. In PSD2 SCA contexts, OTP is a knowledge-independent possession factor (if delivered to a registered device). Builders implementing OTP must use a server-side TOTP (RFC 6238) or HOTP (RFC 4226) algorithm, deliver the OTP over a separate channel (SMS to registered phone, authenticator app), and invalidate it after single use or 30-second expiry.

PEP (Politically Exposed Person)

An individual who holds or has held a prominent public function, or a close family member or associate of such a person. PEPs pose higher corruption risk and require EDD under FATF Recommendation 12 and EU 5AMLD (Directive (EU) 2018/843). PEP screening results must be stored with the screening date, data source, match confidence, and analyst disposition (false positive / confirmed PEP). (Directive (EU) 2018/843, EUR-Lex 2018/843)

Placement

The first stage of money laundering: introducing illicit funds into the financial system. Placement detection focuses on large cash deposits, structured deposits just below reporting thresholds, and use of money service businesses. Builders implement CTR aggregation and structuring detection (see CTR, Structuring) as the primary placement-phase controls.

PSD2 (Payment Services Directive 2)

Directive (EU) 2015/2366/EU regulating payment services in the EU, introducing Open Banking via PSD2 API standards, requiring Strong Customer Authentication (SCA) for electronic payments, and establishing rules for payment initiation and account information service providers. Builders must implement SCA for payments and consent management for Open Banking. (Directive 2015/2366/EU, EUR-Lex 2015/2366/EU)

Risk-Based Approach

The AML framework principle, mandated by FATF and the EU AMLD series, that requires financial institutions to allocate enhanced due diligence resources proportional to the assessed money laundering risk. Software systems implement the risk-based approach through customer risk scoring models that aggregate jurisdiction risk, product risk, channel risk, and customer profile risk into a composite risk tier (low / standard / high).

Risk Score

A numerical representation of a customer's assessed AML risk. Risk scores are computed from multiple risk factors (jurisdiction, product, channel, PEP status, adverse media), each weighted by the institution's risk model. Builders store risk scores in a risk_assessments table with factor breakdown, computation timestamp, and the scoring model version, enabling audit and periodic recalibration.

Sanctions Screening

The automated process of comparing customer and transaction data against sanctions lists (OFAC SDN, EU Consolidated, HMT Financial Sanctions, UN Security Council). Screening must occur at onboarding, periodically during the customer relationship, and in real time on transactions. Builders implement fuzzy matching (phonetic algorithms, Levenshtein distance) to catch name variations while managing false-positive rates. (31 CFR § 1010.520)

SAR (Suspicious Activity Report)

A confidential report filed with FinCEN when a financial institution knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is structured to evade BSA requirements, lacks a lawful purpose, or involves potential money laundering. SARs must be filed within 30 days of initial detection (or 60 days with supervisory approval for complex investigations). (31 CFR § 1020.320)

SCA (Strong Customer Authentication)

A multi-factor authentication requirement under PSD2 RTS (Delegated Regulation (EU) 2018/389), requiring verification using at least two of: something the customer knows (password, PIN), something the customer has (registered device, OTP token), and something the customer is (biometric). Builders must enforce SCA at transaction initiation and for sensitive account operations, with exemptions for low-value transactions below €30. (PSD2 RTS Art. 4, EUR-Lex 2018/389)

SDD (Simplified Due Diligence)

A reduced level of customer due diligence permitted for products or customer types assessed as lower risk (e.g., regulated financial institutions, government entities, low-value savings accounts). SDD does not eliminate CDD - it reduces the depth and frequency of verification checks. Builders must document the SDD eligibility criteria in configuration and log each instance of SDD application with the justification.

Structuring

The practice of breaking a large cash transaction into multiple smaller transactions to evade the $10,000 CTR filing threshold, illegal under 31 U.S.C. § 5324. Detection requires daily aggregation of same-customer, same-branch cash transactions and pattern matching over a 30-day lookback window. Builders implement structuring detection as a specialised AML rule with multi-day aggregation logic. (31 U.S.C. § 5324)

Suspicious Activity Indicator

A defined behavioural pattern or transaction characteristic that individually or collectively suggests potential money laundering or financial crime. Common indicators include rapid fund movements, unexplained cash spikes, transactions inconsistent with stated business, and peer-group anomalies. Builders encode suspicious activity indicators as parameterised AML rules stored in a rules table, allowing compliance officers to tune thresholds without code releases.

Transaction Monitoring

The automated analysis of customer transactions against a set of AML rules to detect suspicious activity patterns. Transaction monitoring systems process transaction events through a rules engine, generating alerts for analyst review. Builders implement transaction monitoring as either: (a) real-time stream processing for threshold-based rules, or (b) nightly batch processing for aggregation-based rules (CTR, structuring, velocity). (31 CFR § 1020.210)

TTR (Threshold Transaction Report)

The Australian equivalent of the US CTR - a report required when a financial institution conducts a cash transaction with a physical value of AUD 10,000 or more. Architecturally similar to CTR implementations but submitted to AUSTRAC rather than FinCEN. Builders implementing multi-jurisdiction AML systems must abstract the reporting threshold and submission endpoint as configuration, not hardcoded values.

Two-Factor Authentication (2FA)

An authentication mechanism requiring two distinct verification factors before granting access. In banking, 2FA typically combines a password (knowledge) with an OTP or FIDO2 authenticator (possession). PSD2 RTS mandates 2FA (called SCA) for EU payment initiation and access to sensitive account data. Builders must enforce 2FA at login, at transaction initiation, and when modifying critical account settings.

Velocity Rule

An AML monitoring rule that triggers an alert when a customer's transaction volume (count or aggregate amount) exceeds a defined threshold within a rolling time window. Example: "flag any customer who initiates more than 20 transactions in a 24-hour period." Builders implement velocity rules by maintaining rolling counters in a fast-access store (Redis) and comparing against configurable thresholds stored in the rules table.

Watchlist

A consolidated list of individuals, entities, and identifiers (e.g., account numbers, IBANs, shipping routes) against which all customer and transaction data is continuously screened. A financial institution's watchlist typically combines OFAC SDN, EU Consolidated List, HMT UK Financial Sanctions, INTERPOL notices, and internal suspicious entity flags. Builders implement watchlist matching as a dedicated service with fuzzy-matching capability and daily list refresh.

Wire Transfer

An electronic transfer of funds between bank accounts, governed in the US by FinCEN's Travel Rule (31 CFR § 1010.410). Banks and money transmitters must collect, retain, and transmit originator and beneficiary information for wire transfers of $3,000 or more. Builders implement Travel Rule compliance by capturing and passing this data through the wire transfer lifecycle. (31 CFR § 1010.410)

Zero-Knowledge Proof (ZKP) in KYC

A cryptographic technique allowing one party to prove possession of certain information (e.g., age over 18, nationality) without revealing the underlying data. ZKPs are emerging in privacy-preserving KYC systems as an alternative to sharing raw identity document data with every verifying institution. Builders evaluating ZKP-based KYC must assess the maturity of the specific proof system (zk-SNARKs, zk-STARKs) and the jurisdiction's acceptance of ZKP-based verification.