> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

4AMLD / 5AMLD / 6AMLD

EU Anti-Money Laundering Directives: the 4th (2015/849/EU), 5th (2018/843/EU), and 6th (2018/1673/EU) iterations of the EU AML framework. 4AMLD introduced the risk-based approach and beneficial ownership registers; 5AMLD extended them to crypto assets and high-value goods dealers; 6AMLD harmonised predicate offences. Builders must check which AMLD applies to their EU jurisdiction. (EUR-Lex 2015/849, 2018/843, 2018/1673)

AISP (Account Information Service Provider)

A third-party provider authorised under PSD2 to access a customer's payment account data from their bank to aggregate account information. AISPs must be registered and use PSD2-compliant Open Banking APIs with customer consent. Builders creating AISP products implement OAuth2 authorisation code flow with scopes mapped to PSD2 account-access rights. (PSD2 Art. 67, EUR-Lex 2015/2366/EU)

AML/CFT

Anti-Money Laundering / Countering the Financing of Terrorism - the combined regulatory framework targeting both money laundering and terrorist financing. The BSA covers AML; 18 U.S.C. § 2339B and related statutes cover CFT. Software systems typically implement a unified transaction monitoring engine that covers both AML and CFT typologies.

An OAuth2 access token issued to a TPP following customer consent under PSD2 Open Banking. The token encodes the consented data scopes (accounts, balances, transactions) and the consent expiry. Builders must implement token revocation endpoints so customers can withdraw consent and must honour expiry without requiring customer action. (PSD2 Art. 67, EUR-Lex 2015/2366/EU)

BCBS (Basel Committee on Banking Supervision)

The primary international standard-setter for prudential banking regulation, operating under the Bank for International Settlements (BIS). BCBS guidelines on AML/CFT controls and sound practices for managing risks associated with money laundering and financing of terrorism are referenced by central bank supervisors. Builders working on global banking platforms review BCBS guidance for risk management framework requirements.

BSA E-Filing

The FinCEN web portal and API through which financial institutions submit CTRs, SARs, FBARs, and other BSA reports in XML format. Builders implementing automated BSA reporting generate XML payloads conforming to the FinCEN BSA XML schema published on fincen.gov and submit them via the E-Filing API.

CDD Rule

FinCEN's Customer Due Diligence Requirements for Financial Institutions, codified at 31 CFR § 1010.230, requiring financial institutions to collect beneficial ownership information for legal entity customers. The rule requires identifying the beneficial owner(s) who own 25% or more and one controlling party. Builders must implement beneficial ownership collection forms and storage in the onboarding workflow.

CTR (Currency Transaction Report)

A mandatory FinCEN filing for cash transactions exceeding $10,000 in a single business day, including multiple transactions by the same customer that aggregate above the threshold. Filed using FinCEN Form 112 via BSA E-Filing within 15 calendar days of the triggering transaction. (31 CFR § 1010.311)

DSAR (Data Subject Access Request)

A request from an individual exercising their GDPR right of access to their personal data held by a financial institution. DSARs interact with the AML obligation to retain data for five years - builders must implement a reconciliation layer that responds to DSARs while maintaining AML-mandated records. (GDPR Art. 15, EUR-Lex 2016/679)

Dynamic Linking

A PSD2 SCA requirement specifying that the authentication code for a payment must be dynamically linked to the transaction amount and the payee, so that any change to either invalidates the code. Builders implement dynamic linking by including the transaction amount and payee IBAN in the HMAC or FIDO2 challenge used to generate the SCA code. (PSD2 RTS Art. 5, EUR-Lex 2018/389)

EBA RTS

European Banking Authority Regulatory Technical Standards on Strong Customer Authentication and Common and Secure Open Standards of Communication - Delegated Regulation (EU) 2018/389. Sets detailed requirements for SCA factors, dynamic linking, exemptions (TRA, low-value, corporate whitelisting), and the Open Banking API standard. (EUR-Lex 2018/389)

FCA (Financial Conduct Authority)

The UK financial regulator that oversees payment institutions and AML compliance under UK POCA 2002 and the Money Laundering Regulations 2017. Builders deploying UK Open Banking APIs must comply with FCA-authorised TPP registration and the UK Open Banking Standard published by the OBIE.

FIDO2

The W3C and FIDO Alliance's open standard for hardware-backed, phishing-resistant authentication using public-key cryptography. WebAuthn (the browser API component of FIDO2) enables builders to implement authenticators as SCA possession factors compliant with PSD2 RTS Art. 9. Server-side implementation requires attestation verification, credential storage, and challenge/response logic. (PSD2 RTS Art. 9, EUR-Lex 2018/389)

FINCEN FORM 112

The standard form used to file a CTR with FinCEN. Builders generating CTR filings programmatically produce Form 112 data as FinCEN XML (BSA E-Filing format) rather than paper; the XML schema is published at fincen.gov/resources/filing-information. (31 CFR § 1010.311)

GDPR's right to erasure (Art. 17) requires deletion of personal data when no longer needed, but EU and US AML laws mandate five-year retention of KYC and transaction records. Builders must implement a retention-hold architecture: AML-retained records are placed in a compliance hold that overrides standard GDPR deletion cycles and is lifted only at retention expiry. (GDPR Art. 17, EUR-Lex 2016/679; 31 CFR § 1020.410)

IBAN Validation

The process of verifying that an IBAN is structurally valid using the ISO 13616 MOD-97 algorithm. Valid IBAN format: 2-letter country code + 2 check digits + BBAN. Builders implement IBAN validation as a utility function used at transaction entry and on stored beneficiary data.

IVMS101

InterVASP Messaging Standards version 1.01 - the data format used by virtual asset service providers (VASPs) to transmit originator and beneficiary information in compliance with the FATF Travel Rule. Builders implementing VASP travel rule compliance store and transmit IVMS101 payloads alongside each qualifying crypto asset transfer.

KYC State Machine

A finite state machine modelling the lifecycle of a customer's KYC verification status: pending_submission → documents_submitted → in_review → verified → expired → suspended. State transitions are triggered by verification system callbacks, analyst actions, or scheduled re-verification. Builders implement the KYC state machine as an event-sourced system with a full audit trail of every state transition.

LEI (Legal Entity Identifier)

A 20-character ISO 17442 alphanumeric code uniquely identifying legal entities participating in financial transactions. The Global LEI Index at gleif.org is the authoritative source. Builders validate LEIs using the checksum algorithm and store them on corporate customer records, using LEI lookups for EDD beneficial owner chaining.

OFAC SDN

The Specially Designated Nationals and Blocked Persons List maintained by the US Treasury's OFAC. Financial institutions must screen customers and transactions against the SDN list before providing services. Builders implement SDN screening using OFAC's published data files (SDN.xml) with fuzzy matching, and maintain a log of every screening result with the list date and match score.

OTP TOTP

Time-based One-Time Password (RFC 6238) - an OTP variant generated using a shared secret and the current timestamp, producing a 6–8 digit code valid for 30 seconds. Used as a second SCA factor. Builders implement TOTP on the server side using a HMAC-SHA1/SHA256 computation; seed secrets are stored encrypted. (RFC 6238)

PISP (Payment Initiation Service Provider)

A third-party provider authorised under PSD2 to initiate a payment from a customer's account at their bank, with explicit consent. PISPs must apply SCA before initiating each payment unless an SCA exemption applies. Builders creating PISP products implement the payment authorisation flow with dynamic linking to protect against manipulation. (PSD2 Art. 66, EUR-Lex 2015/2366/EU)

SAR (Suspicious Activity Report)

A confidential report filed with FinCEN (US) or the relevant national FIU when a financial institution detects suspicious activity suggesting money laundering or other financial crimes. US SARs use FinCEN Form 111 (FinCEN SAR) and must be filed within 30 days of detection via BSA E-Filing. (31 CFR § 1020.320)

SWIFT MT/MX

Messaging formats used in cross-border interbank wire transfers: MT (ISO 15022, legacy) and MX (ISO 20022, modern). Key fields include BIC codes for sending and receiving banks, originator IBAN, beneficiary IBAN, and remittance information. Travel Rule compliance requires populating the originator's name, address, and account number in the relevant MT/MX fields. Builders mapping MT to MX migration must handle the expanded character sets and nested XML structure of ISO 20022.

TRA (Transaction Risk Analysis)

A PSD2 SCA exemption allowing a PSP to skip SCA for transactions below €100 (or up to €500 at low fraud rates) when a real-time fraud risk score is below a defined threshold. Builders implementing TRA must compute the risk score before applying the exemption, log the exemption decision with the score and thresholds, and comply with the quarterly fraud-rate ceilings published in PSD2 RTS Annex III. (PSD2 RTS Art. 18, EUR-Lex 2018/389)

Travel Rule

The FinCEN requirement (31 CFR § 1010.410) that financial institutions transmit originator and beneficiary information alongside wire transfers of $3,000 or more. The equivalent FATF Recommendation 16 applies to virtual asset transfers. Builders implement Travel Rule by capturing originator/beneficiary structured data at initiation and passing it in SWIFT MT messages or IVMS101 payloads for VASP transfers.