> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
AML - Anti-Money Laundering
AML refers to the laws, regulations, and procedures designed to prevent the generation of income through illegal activities. US AML requirements under the Bank Secrecy Act (31 CFR Chapter X) require broker-dealers and banks to establish AML programmes, file SARs, and conduct customer due diligence. Builders must implement transaction-monitoring pipelines and threshold-alert workflows as components of an AML programme.
ATS - Alternative Trading System
An ATS is a broker-dealer-operated trading venue that matches orders for securities buyers and sellers outside of a national stock exchange. ATSs with significant volume thresholds may qualify as SCI entities under Regulation SCI. ATS operators must register with FINRA and file Form ATS with the SEC. Builders of ATS platforms must implement Regulation SCI controls if the volume thresholds are met. (17 CFR §§ 242.300–303)
BSA - Bank Secrecy Act
The BSA (31 U.S.C. § 5311 et seq.) is the primary US AML statute, requiring financial institutions to maintain records and file reports that have a high degree of usefulness in criminal, tax, and regulatory investigations. BSA mandates include Currency Transaction Reports (CTRs) for cash transactions over $10,000, SAR filings, and customer identification programmes. Builders must wire these filing workflows into transaction processing pipelines.
CDD - Customer Due Diligence
CDD is the process of verifying a customer's identity, understanding the nature of the customer relationship, and assessing the risk of financial crime. FinCEN's CDD Rule (31 CFR § 1010.230) requires covered institutions to collect beneficial ownership information for legal entity customers. Builders must implement KYC/CDD data models that capture and retain identity documents, PEP/sanctions screening results, and risk scores.
CFR - Code of Federal Regulations
The CFR is the codification of the general and permanent rules published in the Federal Register by the executive departments and agencies of the federal government. Title 17 of the CFR covers securities regulations (SEC rules). Title 31 covers financial regulations (FinCEN, AML). Software builders cite CFR provisions to identify the precise regulatory obligation their code must satisfy.
CFTC - Commodity Futures Trading Commission
The CFTC is the independent US federal agency responsible for regulating commodity futures, options, and swaps markets. CFTC Part 1.31 specifies records retention requirements for futures commission merchants and introducing brokers, paralleling the SEC's Rule 17a-4 WORM requirement. Platforms serving both securities and derivatives must comply with both regulators' records rules.
CTR - Currency Transaction Report
A CTR is a form that financial institutions must file with FinCEN for each cash transaction exceeding $10,000. Builders must implement CTR detection logic that aggregates related transactions within a single business day and auto-generates the CTR file in FinCEN SAR XML format for transmission. (31 CFR § 1010.311)
ECN - Electronic Communications Network
An ECN is an automated system that matches buy and sell orders for securities in real time. ECNs operate as ATSs and must comply with Regulation NMS order-protection and access rules. Builders of ECN technology must implement the Trade-Through Rule's intermarket sweep order (ISO) mechanism to ensure best-execution routing.
EDGAR - Electronic Data Gathering, Analysis, and Retrieval
EDGAR is the SEC's electronic filing and retrieval system, accessible at sec.gov/edgar. It receives company filings, makes them publicly available, and provides search APIs. Builders integrate EDGAR APIs to retrieve XBRL-tagged financial data, insider trading filings, and material event disclosures for compliance and analytical applications. (17 CFR Part 232)
FinCEN - Financial Crimes Enforcement Network
FinCEN is a bureau of the US Department of the Treasury that collects and analyses financial transaction data to combat domestic and international money laundering, terrorist financing, and other financial crimes. FinCEN publishes AML programme rules (31 CFR Chapter X) and receives SAR and CTR filings from covered financial institutions. Builders wire SAR and CTR submissions to FinCEN's BSA E-Filing System.
FINRA - Financial Industry Regulatory Authority
FINRA is the self-regulatory organisation that oversees registered broker-dealers in the United States. FINRA's rulebook (FINRA Manual) supplements SEC rules on books and records (Rule 4511), customer accounts (Rule 4512), business continuity (Rule 4370), and market surveillance. Compliance platforms for broker-dealers must implement both SEC and FINRA rule requirements.
FRO - Fixed Retention Obligation
An FRO is a record retention requirement specifying a defined, non-reducible retention period. Under Rule 17a-4(b)(1), broker-dealers must retain most records for not less than six years. This is an FRO: no exception, no shorter alternative. Builders must configure their retention engine to enforce the FRO floor regardless of any business request to delete records earlier.
GRC - Governance, Risk, and Compliance
GRC refers to the integrated approach for managing an organisation's governance, enterprise risk management, and regulatory compliance. In the fintech context, GRC platforms aggregate risk registers, compliance calendars, policy documents, and regulatory change tracking. Builders of GRC systems for broker-dealers must model the regulatory obligations of SEC Rule 17a-3/17a-4, FINRA rules, and applicable state securities regulations.
IIROC - Investment Industry Regulatory Organization of Canada
While not a US regulator, IIROC (now CIRO) governs Canadian investment dealers and trading. Cross-border platforms operating in both the US (SEC/FINRA) and Canada (CIRO) must implement dual retention and reporting compliance stacks. Builders should assess jurisdictional scope at the data model level to support multi-regulatory retention periods per record type.
ISE - Information Security Event
An ISE is any observed occurrence indicating a possible breach of information security or failure of controls. Under Regulation SCI, SCI entities must detect, assess, and report ISEs that affect critical SCI systems. Builders must implement automated ISE detection pipelines with SIEM integration and produce the SEC-required SCI event notification payload within one hour of detecting a critical event.
KYC - Know Your Customer
KYC is the process by which financial institutions verify the identity of their clients before and during a business relationship. KYC overlaps with CDD: both involve identity document collection, PEP and sanctions screening, and risk assessment. Builders must implement KYC onboarding workflows that capture government-issued ID, beneficial ownership, and risk tier, and store all artefacts in a retention-compliant manner.
LEI - Legal Entity Identifier
An LEI is a 20-character alphanumeric code identifying a legal entity participating in financial markets globally. LEIs are issued by Local Operating Units (LOUs) accredited by the Global LEI Foundation (GLEIF). SEC reporting, CFTC swaps reporting, and MiFID II transaction reporting all require LEI codes for counterparties. Builders must implement LEI validation and lookup against the GLEIF API as a pre-submission gate.
MNPI - Material Non-Public Information
MNPI is information about a company that is both material (a reasonable investor would consider it significant) and non-public (not yet disseminated to the market). Trading on MNPI is insider trading under Rule 10b-5. Builders must implement information-barrier controls to prevent MNPI from flowing between restricted-side (advisory) and public-side (trading) users within the same platform.
NMS - National Market System
NMS refers to the framework of rules and standards governing trading in US equity markets established by Regulation NMS (17 CFR Part 242). The NMS requires linkage between markets, best-bid-and-offer protection, and access to market data. Builders of order-routing systems must implement the Order Protection Rule (Rule 611) and Intermarket Sweep Order (ISO) logic to comply with NMS.
OMS - Order Management System
An OMS is a software platform that manages the lifecycle of a securities order from entry through execution and confirmation. OMSs interface with broker-dealers, routing logic, exchanges, and clearing systems. Under Rule 17a-3, all order memoranda - including order type, time of receipt, price, quantity, and execution venue - must be captured in the OMS and stored in a WORM-compliant manner.
PEP - Politically Exposed Person
A PEP is an individual who holds or has held a prominent public position (head of state, senior politician, military officer, or state-owned enterprise executive) and who presents heightened risk of corruption or money laundering. AML programmes require enhanced due diligence for PEP customers. Builders must integrate PEP screening into onboarding workflows using licensed PEP databases or APIs.
SAR - Suspicious Activity Report
A SAR is a report filed with FinCEN by a covered financial institution when it suspects a customer is engaging in money laundering, fraud, or other financial crimes. SARs must be filed within 30 days of initial detection (60 days if the suspect cannot be identified). SAR filings and supporting documentation must be retained for five years. Builders implement SAR workflow engines tracking case creation, investigation notes, approval, and FinCEN submission.
SCI - Systems Compliance and Integrity
SCI is the Regulation SCI programme requiring SCI entities to maintain systems with adequate capacity, integrity, resiliency, availability, and security. SCI mandates annual systems testing, business continuity exercises, and timely reporting of SCI events to the SEC. Builders of exchange and ATS infrastructure must build SCI event detection, classification, and notification pipelines.
SRO - Self-Regulatory Organisation
An SRO is a non-governmental organisation that has the authority to create and enforce regulations for its members. FINRA and the major stock exchanges are SROs. SROs supplement SEC rules with their own member rules. Builders of compliance systems must implement the applicable SRO rulebook alongside SEC rules, as SRO rules can be more prescriptive.
WORM - Write Once Read Many
WORM is a data storage paradigm ensuring that once records are written, they cannot be altered or deleted for the duration of the prescribed retention period. Rule 17a-4(f)(2) requires that electronic storage media used to retain broker-dealer records must be non-rewritable and non-erasable. Acceptable WORM implementations include certified third-party vendors, optical WORM media, and cloud object storage in Object Lock Compliance Mode.