Glossary

Anti-Money Laundering (AML) refers to the set of legal, regulatory, and organizational measures designed to prevent money laundering and terrorist financing.

Anti-Money Laundering (AML) is a core component of compliance frameworks and is closely linked to enhanced due diligence (EDD), customer due diligence (CDD), and risk-based control approaches. It applies to financial institutions and, increasingly, to non-financial businesses subject to regulatory obligations.

Anti-Money Laundering (AML) is a key regulatory requirement that obliges organizations to implement effective controls to detect, assess, and report suspicious activities.

Requirement to identify and verify beneficial owners of customers.

The individual who ultimately owns or controls an entity.

Transparency over beneficial ownership is essential for anti-money laundering (AML), know your customer (KYC) processes, and the identification of hidden conflicts of interest.

Transparency is essential for anti-money laundering (AML) and fraud prevention.

A vendor is effectively controlled by one individual.

Number of compliance violations.

Compliance breach frequency is a key metric in compliance and governance frameworks and is often analysed in conjunction with internal controls, fraud risk assessment, and monitoring systems. It can be broken down by type of violation (e.g. regulatory, internal, ethical).

Acts as an early indicator of weaknesses in governance, control environments, and organisational culture, and supports the management of compliance measures.

Multiple sanctions breaches.

Failure to comply with laws, regulations, or internal policies.

Compliance violations occur across various domains, including anti-money laundering (AML), data protection, competition law, and internal policies. They are often linked to weak internal controls, insufficient compliance governance, or lack of employee awareness.

May lead to significant legal, financial, and reputational risks and serves as a key indicator of weaknesses in compliance and control frameworks.

Ignoring sanctions requirements.

Criminal liability of corporations.

Corporate criminal liability refers to the legal concept that corporations can be held criminally responsible for offences committed within the organisation. It typically applies where there are deficiencies in organisational structure, internal controls, or oversight. The concept is closely linked to compliance, corporate governance, internal control systems, and organisational failure.

Establishes direct criminal risk for corporations and significantly increases the need for robust compliance, control, and governance frameworks.

Company liable for control failures.

Customer Due Diligence (CDD) is the risk-based process of establishing who a customer is and assessing the business relationship. In its regulatory sense, CDD supports the prevention of money laundering and terrorist financing: it covers customer identification and verification, identifying beneficial owners and taking reasonable measures to verify their identities, understanding the purpose and intended nature of the relationship, and ongoing scrutiny. (FATF, Recommendation 10)

The underlying discipline also matters to manufacturers, trading businesses and service providers seeking to prevent fraud. Checking that a customer and its representatives are genuine, and that a proposed transaction makes business sense, can reduce exposure to deception. This broader commercial practice should be distinguished from the specific CDD obligations imposed by law.

The Financial Action Task Force (FATF) sets the international framework for regulatory CDD. Its scope extends beyond financial institutions to designated non-financial businesses and professions, including real estate agents and trust and company service providers when undertaking specified activities. Applicable law determines the actual obligations. (FATF, Recommendations 10 and 22)

CDD connects onboarding information with the assessment of subsequent activity. Records need to remain relevant as ownership, business operations or transaction patterns change. Know Your Customer (KYC) is a related term whose scope varies in practice; CDD here includes both initial checks and ongoing due diligence. (Basel Committee on Banking Supervision, sections II.3–II.5)

Within AML/CFT frameworks, higher risks call for Enhanced Due Diligence (EDD). Simplified Due Diligence (SDD) depends on the applicable conditions and is unavailable under the FATF standard where money laundering or terrorist financing is suspected. (FATF, Interpretive Note to Recommendation 10)

Our international CDD reference guide explores this regulatory AML/CFT context through selected standards, legislation and supervisory guidance across eight jurisdictions.

Fraud prevention beyond financial services. Fictitious businesses, hijacked corporate identities and fabricated trade references can expose ordinary commercial businesses to fraud. Independent checks on identity and references help assess these risks. (Police.uk, Corporate identity and long/short firm fraud) A practical implication is to examine, where relevant, a representative’s authority, the commercial purpose of a transaction and unusual delivery, payment or refund instructions. Customer checks complement internal controls, including independent approval of unusual transactions.

What customer checks can establish. Documents may be false or outdated, and a customer’s conduct can change after onboarding. A database match or elevated risk rating is a reason to examine the underlying information, not proof of criminal activity. Creditworthiness and integrity also require distinct judgements: a business can default without committing fraud, while a reliable payment history does not rule out later deception.

Proportionality and de-risking. Excluding whole categories of customers to avoid assessing and managing their risks conflicts with the FATF’s risk-based approach. Disproportionate demands can deny legitimate customers access to financial services. (FATF, Financial Inclusion Guidance, paragraph 14 and section 1.5) The FATF definition of a politically exposed person (PEP) centres on a prominent public function. Expressing political criticism alone does not make someone a PEP. PEP status does not imply criminal conduct, and the FATF rejects refusal of a relationship solely on that basis. (FATF, PEP Guidance, paragraphs 1–2 and 10–13)

Debanking and possible misuse. Refusing or ending a banking relationship may be legally required or permitted on contractual or commercial grounds; a criminal conviction is not a universal prerequisite. Where required CDD cannot be completed, the FATF standard provides for refusal or termination of the relationship. (FATF, Recommendation 10) The lawfulness of a particular decision depends on the jurisdiction, account type, contract and circumstances. The UK Financial Ombudsman Service illustrates this individual assessment in its approach to closure complaints. (Financial Ombudsman Service, Bank account closures)

Customer checks can be misused if “compliance” becomes a pretext for excluding a person or business for unrelated reasons, such as finding their views unwelcome. Whether this has happened requires evidence; closure alone does not establish abuse. Sound practice calls for reliable, current information, documented reasons, proportionate measures and ways to correct errors and seek review. Applicable data protection and anti-discrimination rules, as well as any legal restrictions on disclosure, must be taken into account.

Illustrative scenario, based on the pattern of long firm fraud: A wholesaler supplies a new business customer that promptly settles several small invoices. The customer then places a much larger order on credit and requests delivery to a different address at short notice.

Before releasing the goods, the wholesaler checks the purchaser’s authority, verifies the delivery arrangements through independently confirmed contact details and reassesses the order against the credit limit. Depending on the findings, it may seek additional security or adjust the delivery terms.

Past payments provide useful context, but do not establish that the new order is genuine. The changes warrant enquiries while leaving room for a legitimate explanation. (Police.uk, Long and short firm fraud)

Legal framework for personal data protection.

Data protection law includes national and international frameworks such as the GDPR and the Swiss Data Protection Act and is closely linked to internal controls, forensic evidence handling, and internal investigations. It defines the legal boundaries for processing personal data, particularly in investigation, monitoring, and analytics contexts.

Establishes legal constraints and requirements for data use and significantly shapes the design of control, analytics, and investigation processes.

Limits on employee monitoring.

Deferred Prosecution Agreement (DPA) is an agreement between prosecutors and an organization to suspend criminal prosecution subject to specific conditions.

Deferred Prosecution Agreements (DPAs) are commonly used in compliance and corruption cases, particularly in connection with violations of anti-corruption laws or financial crime. Organizations typically agree to cooperate, conduct internal investigations, strengthen internal controls, and implement compliance enhancements.

Deferred Prosecution Agreements (DPAs) are a key enforcement tool, allowing organizations to avoid conviction while accepting significant financial penalties and compliance obligations.

A company agrees to pay fines, cooperate with authorities, and enhance compliance programs in exchange for deferred prosecution.

Enhanced Due Diligence (EDD) refers to enhanced verification and assessment procedures applied to higher-risk customers or transactions.

Enhanced Due Diligence (EDD) is part of risk-based compliance and anti-money laundering (AML) frameworks. It is applied in higher-risk situations, such as politically exposed persons (PEP), complex ownership structures, or cross-border relationships. EDD builds on Customer Due Diligence (CDD) by introducing more in-depth checks, particularly regarding source of wealth and source of funds.

Enhanced Due Diligence (EDD) is mandatory in high-risk scenarios and is designed to identify and mitigate risks related to money laundering, corruption, and other forms of financial crime.

Additional verification of source of funds and source of wealth for a high-risk customer.

EU-wide whistleblower protection framework.

The EU Whistleblower Directive (EU 2019/1937) establishes minimum standards for whistleblower protection and is closely linked to whistleblower protection, tips and whistleblower reports, and internal investigations. It requires organisations to implement secure internal and external reporting channels and defined procedural safeguards.

Provides a legally binding framework for whistleblowing systems and strengthens transparency, compliance, and fraud detection.

Internal reporting hotline.

Compliance with export control regulations.

Export control compliance involves adherence to national and international regulations (e.g. EU dual-use regulation, sanctions regimes) and is closely linked to compliance violations, regulatory reporting obligations, and internal controls. It is particularly relevant for companies operating in global supply chains or dealing with sensitive technologies.

Prevents unlawful transfers of goods and technology and mitigates regulatory, legal, and reputational risks.

License required for software export.

GDPR (General Data Protection Regulation) is a European Union regulation governing the processing of personal data and the protection of individuals’ privacy.

The GDPR is a key element of compliance and directly affects how organizations handle personal data. It is closely linked to information security, internal controls, and regulatory requirements for data protection and processing.

The GDPR requires organizations to handle personal data responsibly and imposes significant financial penalties and reputational risks in case of non-compliance.

Unlawful storage or processing of employee personal data without a valid legal basis.

Know Your Customer (KYC) refers to procedures used to identify and verify customers and business partners, including the assessment of identity, beneficial ownership, and risk profiles.

KYC is a core component of anti-money laundering (AML) frameworks and is closely linked to enhanced due diligence (EDD) and risk-based compliance approaches. It is applied during onboarding, transactions, and ongoing monitoring.

KYC provides the foundation for preventing money laundering, fraud, and sanctions violations and is a regulatory requirement in many industries.

Verification of customer identity and beneficial ownership before account opening.

Money Laundering is the process of concealing the origin of illicit funds to make them appear legitimate.

Money Laundering typically involves multiple stages, including placement, layering, and integration. It is closely linked to Fraud, Corruption, and organised crime, and is a key focus of regulatory frameworks such as anti-money laundering regimes.

Money Laundering enables criminal activities by legitimising illicit proceeds and exposes organisations to severe regulatory and reputational risks.

Complex transactions with no clear rationale.

A Politically Exposed Person (PEP) is an individual who holds or has held a prominent public function, as well as their close associates and family members, who present an elevated risk of corruption and money laundering.

PEPs are a key focus of anti-money laundering (AML) frameworks and require enhanced scrutiny under know your customer (KYC) and enhanced due diligence (EDD) processes. They are particularly relevant in cross-border relationships and high-risk jurisdictions.

PEPs are subject to enhanced monitoring and due diligence due to their increased exposure to corruption and financial crime risks.

A government minister identified as the beneficial owner of a corporate client.

Regulatory Enforcement Action refers to a formal action taken by a regulatory authority to enforce compliance with laws and regulations.

Regulatory Enforcement Actions typically arise from violations of compliance requirements, particularly in areas such as anti-money laundering (AML), corruption, or financial regulation. They may result from audits, investigations, or external reporting.

Regulatory Enforcement Actions are key mechanisms for enforcing regulatory standards and may have significant financial, operational, and reputational consequences for organizations.

A financial institution is fined for violating anti-money laundering (AML) regulations.

A Regulatory Reporting Obligation refers to the legal requirement to report specific events or suspicions to supervisory or law enforcement authorities.

Regulatory reporting obligations are a core element of anti-money laundering (AML) and compliance frameworks. They are closely linked to know your customer (KYC) processes, enhanced due diligence (EDD), and internal reporting mechanisms. Common examples include suspicious activity reporting.

Compliance with reporting obligations is mandatory; failure to report can result in significant penalties, legal consequences, and reputational damage.

Filing a suspicious activity report with the relevant financial intelligence unit.

Compliance with international sanctions regimes.

Sanctions compliance refers to adherence to national and international sanctions regimes, particularly concerning individuals, organisations, and states, and is closely linked to anti-money laundering (AML), know your customer (KYC), as well as transaction monitoring and screening processes. It is critical for financial institutions and globally operating companies with elevated regulatory exposure.

Violations can lead to severe legal, financial, and reputational consequences and therefore represent a key compliance risk.

Blocked payment to sanctioned entity.

A Suspicious Activity Report (SAR) is a formal report submitted to authorities regarding suspicious transactions or activities in accordance with legal requirements.

SARs are a core component of anti-money laundering (AML) frameworks and are closely linked to regulatory reporting obligations, know your customer (KYC), and customer due diligence (CDD). They are triggered by unusual or unexplained transaction patterns.

They are a key mechanism for detecting and preventing money laundering, terrorist financing, and other financial crimes.

Filing a report on unusual transaction patterns identified during monitoring.

The Swiss Data Protection Act (DPA) is Switzerland’s federal law governing the protection and processing of personal data by private and public entities.

The Swiss DPA is highly relevant in the context of internal investigations, forensic evidence handling, and IT controls. It is closely aligned with international frameworks such as the General Data Protection Regulation (GDPR) and influences data access, logging, and retention practices.

Compliance with the Swiss DPA is mandatory and defines how personal data must be collected, processed, and protected, particularly in investigative and control environments.

Restricting access to employee data during an internal investigation.

The systematic monitoring of transactions to detect anomalies.

Transaction monitoring is a core tool within anti-money laundering (AML), fraud detection methods, and data analytics detection. It is typically implemented in financial systems and ERP environments and relies on both rule-based and analytical approaches to identify anomalies.

Enables early detection of suspicious activities and is a key component of effective prevention and detection frameworks.

Alert triggered by unusual refund activity.

Whistleblower Protection refers to legal and organizational measures designed to protect individuals who report misconduct, particularly from retaliation.

Whistleblower protection is a core element of tips and whistleblower reports and compliance frameworks, and is closely linked to the prevention of whistleblower retaliation. It is often mandated by law in many jurisdictions.

Effective protection encourages reporting, strengthens trust in reporting systems, and enhances fraud detection capabilities.

Legal protection against dismissal after reporting misconduct.