Master glossary

241 terms whose meaning depends on context, jurisdiction, and control purpose.

Filter this index241 terms

50 Percent Rule: OFAC ownership guidance under which certain entities owned 50 percent or more, directly or indirectly in aggregate, by blocked persons are treated as blocked.
Account takeover: Unauthorized access to an account, often using compromised credentials, device, session, or social-engineering techniques.
Accountable action: A decision or operational act made by a person or permitted function with authority, evidence, and responsibility for its consequences.
Action acknowledgement: A response or record from the destination process confirming that an approved financial-crime action was executed, rejected, or remains pending.
Activity-based regulation: A regulatory approach that evaluates what a person or entity does rather than relying only on the technology label or incorporation form.
Address attribution: A documented assignment of a blockchain address or cluster to a person, service, or category, including source and confidence.
Adverse media: Publicly available information that may indicate financial-crime, integrity, or related risk and requires source-aware, identity-aware assessment.
Agentic workflow: A bounded workflow in which an AI system can plan, retrieve, call approved tools, or execute permitted tasks under controlled authority.
Alert: A system-generated prompt for review; it is not by itself a conclusion of suspicious activity.
AML: Anti-money laundering: measures intended to prevent and detect the use of the financial system to conceal, move, or benefit from illicit proceeds.
AMLA: The Authority for Anti-Money Laundering and Countering the Financing of Terrorism established by Regulation (EU) 2024/1620.
AMLD6: Directive (EU) 2024/1640 on member-state AML/CFT mechanisms; distinct from earlier instruments commonly called AMLD6 in other contexts.
AMLO: Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615).
AMLR: Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation.
APP scam: Authorised push payment scam, where a payer is deceived into authorising a payment.
Applicability assessment: A documented determination of how a global standard, legal requirement, policy, product, or service applies to a local entity or market.
APTCP: Japan’s Act on Prevention of Transfer of Criminal Proceeds.
Assessment methodology: FATF's framework for assessing technical compliance with its Recommendations and the effectiveness of AML/CFT/CPF systems.
Assurance: Independent or appropriately challenging evaluation of whether governance, risk management, and controls are designed and operate as intended.
Attribute-level lineage: Lineage recorded at the specific data-attribute level, including source, transformation, permission, quality, and decision use.
AUSTRAC: Australia’s financial-intelligence and AML/CTF regulator.
Authoritative source: The designated reliable origin for a defined fact or status, within a stated purpose and time.
Authorized push payment scam: A scam in which a customer is manipulated into authorizing a payment; customer authorization does not settle every legal or conduct question.
Authorized representative: A person or entity with documented power to act for a customer. Authority is distinct from ownership or beneficial ownership.
Back-testing: Retrospective testing of control performance against historical data or known events.
Beneficial owner: A natural person or persons who ultimately own or control a customer and/or the natural person on whose behalf a transaction or activity is being conducted, as defined by the applicable legal or policy regime.
Beneficiary: The intended recipient of a transfer; beneficiary identity, account, and institution data may have distinct quality issues.
Beneficiary risk: Risk associated with the receiving end of a payment based on behavior, links, controls, and contextual facts.
Binding: The degree to which a person presenting evidence or operating a session is linked to the claimed identity.
Blocking or freezing: A legally required restriction on dealing with property or funds under an applicable sanctions regime; effect depends on the regime.
Bridge: A mechanism that enables assets or representations of value to move between blockchain ecosystems; it can add technical, counterparty, and tracing complexity.
BSA: The Bank Secrecy Act, the U.S. statutory recordkeeping and reporting framework administered in significant part by FinCEN.
Business-wide risk assessment: A documented assessment of the enterprise's exposure across products, customers, channels, geographies, legal entities, and other relevant factors.
Calibration: The relationship between model score/probability and observed outcome in the defined use population.
Capacity: The risk-appropriate ability to make required decisions at required quality and speed; more than staffed headcount.
Case package: A structured evidence set assembled for a defined investigation, escalation, report, authority request, or decision.
Case strategy: A documented plan that states scope, questions, evidence, assumptions, owners, timing, and escalation triggers.
CDD: Customer due diligence; risk-based measures to understand and manage a customer relationship.
Central register: A registry operated by or for a public authority that holds specified information. Its access, coverage, verification, and legal effect vary by jurisdiction.
CFT: Countering the financing of terrorism: measures addressing the collection, movement, use, or availability of funds or economic resources connected to terrorist activity, subject to applicable law.
Chapter X: Treasury regulations in 31 CFR Chapter X implementing many BSA obligations.
CIP: Customer Identification Program; a specific U.S. regulatory term for certain financial institutions, including banks.
Close associate / RCA: A person known to have a close relationship with a PEP, as defined under an applicable regime; terminology varies.
Closure validation: Evidence-based confirmation that remediation addresses scope, cause, outcome, and recurrence risk.
Cluster: A set of addresses analytically associated with one another under a stated method; it is not inherently a legal person or a verified owner.
CNBV: Mexico’s Comisión Nacional Bancaria y de Valores, a financial-sector supervisory authority with AML/CFT roles within its remit.
Conceptual soundness: Whether a model's theory, assumptions, methodology, and intended use are appropriate for the stated decision.
Configuration debt: Accumulated undocumented or weakly governed parameter, rule, interface, and exception changes that raise control risk.
Control: The power to direct the management, policy, or material decisions of an entity or arrangement. Control can arise through ownership, voting, appointment rights, contract, trustee/protector powers, or other means.
Control coverage: The extent to which the population, data, routes, and timing intended by a control are actually reached.
Control economics: The analysis of cost, risk reduction, quality, customer friction, and resilience across a financial-crime decision path.
Control hypothesis: A precise statement of population, trigger, expected action, owner, timing, evidence, and outcome that can be tested.
Control object: A business/data/evidence object that a financial-crime control depends on, such as identity, ownership, transaction, case, control, or obligation.
Control objective: The risk-reduction or legal-compliance result a control is designed to achieve, expressed independently from a particular system or procedure.
Control owner: The named person accountable for a control's design, operation, monitoring, evidence, and remediation.
Control spine: The connected seven-stage enterprise framework used in this module: understand exposure; prevent; interdict; detect; investigate; act/report/restrict; assure and redesign.
Control stack: The connected data, technology, workflow, people, policy, evidence, and assurance components that deliver a control outcome.
Correspondent bank: A bank that provides services, such as payments, clearing, settlement, or FX access, to another financial institution.
Coverage: The extent to which all intended records, entities, events, products, channels, and time periods reach a control.
CPF: Counter-proliferation financing: measures addressing financing and related financial activity connected to the proliferation of weapons of mass destruction and associated targeted financial sanctions frameworks.
Critical activity: An activity whose failure would materially impair legal compliance, control effectiveness, customer protection, or operational resilience.
Critical data element: A data item whose failure would materially impair a financial-crime decision, control, report, or evidence package.
Crypto-asset service provider: A regulated term under EU MiCA for in-scope crypto-asset services; it should not be assumed to be identical to FATF's VASP definition.
Customer declaration: Information supplied by or for the customer. It may be required and useful, but should be distinguished from independent corroboration.
Customer risk profile: A documented understanding of risk factors, purpose, expected activity, and control needs relevant to a customer relationship.
Customer vulnerability: A context that can affect a person's ability to recognize, resist, or recover from financial harm and requires careful, non-stigmatizing handling.
DAML: Defence Against Money Laundering, a UKFIU/NCA process that requires careful fact- and law-specific use.
Data contract: A controlled agreement describing interface fields, quality, timing, use, error handling, ownership, and reconciliation.
Data localization: A requirement or constraint related to where data must be stored, processed, accessed, or transferred.
Data provenance: The documented origin and history of data, including source, custody, transformations, and use.
Decision path: The linked process, data, authority, evidence, and assurance steps that produce an operational financial-crime decision.
DeFi: Decentralized-finance arrangements using distributed-ledger technology and smart contracts; their risk treatment depends on functions and persons with control or influence.
Degraded mode: A defined way to operate a service when normal capability is unavailable or unsafe, with limits, authority, and reconciliation.
Delegation: Assignment of an activity or decision authority under a defined mandate while retained accountability and oversight remain clear.
Design effectiveness: Whether a control, if operated as intended, is capable of addressing its stated risk and objective.
DIA: New Zealand Department of Internal Affairs, the sole AML/CFT supervisor from 1 July 2026 according to current official sources.
Digital-currency identifier: A blockchain address or related identifier that can be relevant to a sanctions, fraud, or AML/CFT control.
Direct applicability: The characteristic of an EU regulation that applies as EU law without the same transposition mechanism as a directive, subject to its own provisions and dates.
Disposition: The recorded case decision and rationale; it must be distinct from any later account, payment, or reporting action.
Drift: Material change in data, relationships, performance, use population, workflow, or outcome that can affect model behavior.
Dual-use item: An item that can have both civil and military applications and may be subject to export-control rules.
Economic-security risk: Enterprise risk covering sanctions, export controls, trade, national-security, and related legal or policy exposure.
EDD: Enhanced due diligence; additional risk-based or required measures for higher-risk relationships or events.
Effective date: The date on which an attribute or relationship began or ceased to be true. It is different from a source retrieval date.
Effectiveness: The extent to which a system produces intended outcomes in its actual risk context; distinct from the formal presence of laws, policies, or controls.
Effectiveness outcome: A measurable or evidence-supported indication that a control has produced its intended prevention, detection, action, reporting, or risk-reduction result.
End use: The intended application or use of goods, technology, or services that can affect export-control or sanctions risk.
End user: The ultimate user of goods, technology, or services; it may differ from purchaser, consignee, intermediary, or freight forwarder.
Entity List: A U.S. BIS list that can impose licensing requirements and related restrictions for specified entities and end users.
Entity resolution: The process of deciding whether records across sources refer to the same legal person, arrangement, or natural person.
Event-driven review: A review triggered by a material change or signal, rather than solely by a scheduled date.
Evidence fallback: A lawful alternative information pattern used when the normal data path is unavailable or restricted.
Evidence lineage: The ability to trace a conclusion, decision, action, or report to its source data, methodology, policy/legal basis, analysis, and approval record.
Evidence replay: Reconstruction of a past decision using contemporaneous source data, versions, analysis, authority, and action proof.
Exception: A controlled, time-bound deviation from an approved rule or procedure.
Exception rate: The share of work that cannot follow the standard path and needs additional evidence, specialist judgment, or escalation.
Explainability: The ability to understand and communicate the evidence, logic, assumptions, and limitations relevant to a model-supported result.
Export: A term whose scope depends on the applicable regime and may include export, reexport, transfer, or release of controlled items or technology.
Fact table: A structured record that separates source facts, dates, amounts, parties, transactions, sources, and confidence from inference.
Fallback: A tested alternate process or capability used to preserve a required control outcome during a disruption or unsafe condition.
False negative: A risk event or condition that the control should have identified but did not. A false-negative assessment can be direct, sampled, inferred, or scenario based.
False positive: An alert that does not support the intended concern after appropriate review; it is not necessarily a system defect.
FATF-style regional body (FSRB): A regional organization that participates in the FATF Global Network and carries out, among other activities, mutual evaluations in its region.
Federated analysis: A design pattern in which analytic logic operates across distributed/local data without necessarily centralizing all raw records.
Federated query: An authorized query to a local source system that returns a bounded result without transferring the full underlying dataset.
FinCEN: The U.S. Treasury bureau that administers key BSA rules, collects and analyzes financial intelligence, and operates specified information-sharing programs.
FINTRAC: Canada’s Financial Transactions and Reports Analysis Centre, with reporting, financial-intelligence and compliance functions.
FIU: Financial Intelligence Unit; national reporting and intelligence functions differ by Member State.
FIU-IND: Financial Intelligence Unit-India.
Foundation model: A broadly trained AI model adaptable to multiple tasks, often including language or multimodal capability.
FRAML: A coordinated fraud-risk and AML operating approach that shares permitted intelligence and controls while preserving distinct legal standards and decision rights.
GenAI: Generative AI that can produce text, code, images, or other content from instructions and context.
Global Core: The common enterprise standards, taxonomy, evidence expectations, decision architecture, data semantics, and assurance discipline that should remain coherent across markets.
Global core / local edge: An operating design that standardizes control objectives, taxonomy, data/evidence discipline, and governance while localizing legal accountability, execution, data permissions, reporting, and supervisory engagement.
Historic lookback: Retrospective assessment of records, actions, reports, or outcomes potentially affected by a known or suspected control defect.
Human-in-the-loop: A governance design requiring defined human review or approval; effectiveness depends on real authority and evidence access.
Identity confidence: An evidence-based assessment of how well the enterprise can rely on an identity claim for a specific decision.
Immediate Outcome: One of the eleven outcome areas FATF uses to assess the effectiveness of a national AML/CFT/CPF system.
Independent evaluation: Review performed with sufficient independence, competence, scope, access, and authority to challenge the program or control owner.
Information sharing: A controlled disclosure or exchange of information that requires an applicable authority, purpose, and safeguards.
Inherent risk: Risk before controls or mitigation.
Interdiction: A timely decision that stops, holds, rejects, blocks, restricts, challenges, or routes an event before a prohibited, harmful, or otherwise unacceptable outcome occurs.
Interim control: A temporary, owned, and tested risk-reducing measure operated while permanent remediation is implemented.
Interpretive Note: FATF material that elaborates how a Recommendation should be applied or understood in the national implementation framework.
Intervention: A proportionate action intended to prevent, authenticate, delay, warn, pause, recover, or otherwise reduce harm.
Investigation: A controlled inquiry that gathers and analyzes relevant facts to support an accountable decision; it is not a finding of wrongdoing.
Issue taxonomy: A controlled set of categories and relationships used to classify defects, causes, impacts, dependencies, and remediation across a program.
JAFIC: Japan Financial Intelligence Center.
Kill switch: The technical and operational ability to suspend an AI component, its tool access, or its actions and transition safely to fallback.
KYC: Know your customer; a practical operational label, not a single universal legal construct.
KYC Direction: RBI’s Master Direction - Know Your Customer (KYC) Direction, 2016, as updated from time to time.
Legal arrangement: In FATF terminology, express trusts or other similar legal arrangements. The legal treatment differs by jurisdiction.
Legal basis: The applicable legal ground for a processing or transfer activity under the relevant law; it must be assessed in context.
Legal floor: The minimum binding legal and regulatory requirement; not subject to commercial waiver.
Legal person: An entity, other than a natural person, that can establish a permanent customer relationship with a financial institution or otherwise own property, usually including companies, bodies corporate, foundations, and similar entities.
Legal-entity accountability: Responsibility of an entity and its accountable officers for applicable obligations and its actual customer, product, and market risk.
Letter of credit: A trade-finance instrument in which a bank undertakes to honor compliant presentation of specified documents, subject to its terms.
LFPIORPI: Mexico’s Federal Law for the Prevention and Identification of Operations with Illicit Resources.
License: An authorization that may permit activity otherwise restricted, subject to exact legal scope, dates, and conditions.
Lineage: The end-to-end record of data origin, transformation, access, use, disclosure, retention, and deletion.
Local Edge: The legally accountable and market-specific layer of a global control system: local law, supervisory practice, data permission, reporting, operating workflow, language, and market execution.
Local overlay: An approved and tested market-specific requirement, configuration, process, data use, or evidence pattern layered on the Global Core.
Minimum necessary: A proportionality principle requiring information, access, or sharing to be limited to what is necessary for the defined purpose.
Mixer: A service or mechanism designed to obfuscate transaction provenance by pooling, splitting, or otherwise altering transaction paths.
MLRs: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
Model risk: Risk of adverse consequences from incorrect or misused model outputs, assumptions, data, implementation, or governance.
Mule account: An account used to receive, move, or conceal illicit value; the account holder's knowledge and role require investigation, not assumption.
Mutual evaluation: A FATF or FSRB peer review of a jurisdiction's AML/CFT/CPF system, including technical compliance and effectiveness analysis.
National competent authority: A national body with AML/CFT supervisory or related responsibilities within the EU framework.
Nested relationship: An indirect use of a correspondent relationship through another respondent or intermediary, often with limited direct visibility.
Nominee: A person or entity that holds a position or interest on behalf of another person. Nominee status must be identified and understood; it does not by itself establish beneficial ownership.
OFAC 50 Percent Rule: OFAC’s rule that property and interests in property of entities owned, directly or indirectly, 50 percent or more in the aggregate by blocked persons are considered blocked.
Offshore VASP: A VASP providing services into a jurisdiction from another jurisdiction, potentially creating supervisory and information-sharing blind spots.
OFSI: Office of Financial Sanctions Implementation, within HM Treasury.
Open-account trade: A trade arrangement in which goods are shipped before payment is made, often creating less structured document visibility for a financial institution.
Operating effectiveness: Whether the control executed as designed for the intended population and period, supported by evidence.
Operating model: The arrangement of people, decision rights, processes, services, systems, evidence, and governance used to deliver outcomes.
Ordering institution: The institution that initiates a transfer instruction on behalf of the originator in the relevant payment context.
Originator: The person or entity that initiates a transfer from an account or otherwise gives the transfer instruction.
Ownership graph: A dated network of persons, entities, arrangements, and relationships used to represent direct/indirect ownership, control, authority, benefit, and related roles.
Payment repair: A controlled correction or enrichment of payment data or instruction; it must preserve original facts and decision history.
PCMLTFA: Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Act.
PEP: Politically exposed person; a person entrusted with a prominent public function, with definitions and measures set by applicable regimes.
Person with significant control (PSC): A UK company-law term that has a specified legal meaning. It should not be used as a global synonym for beneficial owner.
PIPL: People’s Republic of China Personal Information Protection Law.
PMLA: India’s Prevention of Money-laundering Act, 2002.
POCA: Proceeds of Crime Act 2002.
Population coverage: The degree to which the complete and intended population of customers, entities, transactions, accounts, products, or events is subject to a control.
Population reconciliation: Comparison between an authoritative in-scope population and the population that reached a downstream control or process.
Precision: The share of selected alerts/predictions that are relevant under a defined evaluation outcome.
Proliferation financing: Providing funds or financial services related to the development or movement of WMD-related capabilities in the relevant legal and standards context.
PSC: Person with Significant Control, a Companies House corporate-transparency concept distinct from every firm’s own CDD conclusion.
Pseudonymization: Processing that reduces direct identifiability while retaining a controlled link that may permit re-identification under safeguards.
Purpose limitation: The obligation to collect and use personal data only for specified, explicit, legitimate purposes subject to lawful exceptions.
RACI: A role map identifying who is responsible, accountable, consulted, and informed for a decision or activity.
Recall: A request or mechanism to attempt recovery of a payment; it does not guarantee return of funds.
Regional evidence graph: A linked set of entities, people, transactions, reports, actions and sources that retains country-specific facts and accountability.
Registry intelligence: Data from corporate, beneficial-ownership, licensing, regulated-market, or comparable registers used to establish, corroborate, or challenge KYB facts.
Reject: A decision not to process a transaction; it is not automatically equivalent to a block or freeze.
Reopening trigger: A defined new fact, linked event, quality finding, request, or behavior change that requires a closed case to be reassessed.
Residual risk: Risk remaining after considering the design and operation of controls; it is not necessarily acceptable risk.
Respondent bank: A financial institution that receives correspondent services from another institution.
Restrictive measures: EU and national measures, including financial sanctions, that require their own legal and operating decision path.
Retained accountability: The institution’s continuing responsibility for an outsourced or automated activity, including governance and evidence.
Risk acceptance: A formally authorized decision to accept a defined residual risk within stated limits, duration, evidence, and escalation requirements.
Risk appetite: The boundary system that distinguishes prohibited, conditional, acceptable, and escalated exposure.
Risk scenario: A structured description of a threat exploiting a vulnerability through a route in the business with plausible impact.
Risk-based approach: A method of identifying, assessing, understanding, monitoring, managing, and mitigating risk with measures proportionate to the risk identified and applicable legal requirements.
Root cause: The underlying design, governance, data, process, capacity, incentive, dependency, or oversight condition that allowed an issue to occur or persist.
Rule pack: A versioned set of jurisdictional or product-specific conditions governing data collection, access, use, transfer, retention, and action.
SAR: Suspicious Activity Report filed with FinCEN under applicable BSA rules; confidential and distinct from a judicial finding.
SAR/STR: A jurisdiction-specific suspicious activity or suspicious transaction report submitted under the applicable regime and threshold.
SAT: Mexico’s Servicio de Administración Tributaria; relevant to the preventive-law operating environment.
Scenario: Documented detection logic, often rules or thresholds, designed to identify a defined behavior in a stated population.
Scenario test: A controlled test of expected and adverse conditions, including disruption, change, failure, unusual volume, or time-critical action.
SCR: Hong Kong Significant Controllers Register.
Section 314(a): A FinCEN information-sharing program supporting certain law-enforcement requests to financial institutions.
Section 314(b): A statutory voluntary information-sharing framework available to eligible participating financial institutions subject to conditions.
Segmentation: Grouping exposure units by risk-relevant characteristics so treatment and aggregation can differ meaningfully.
Service catalog: A controlled description of a service's customer, scope, owners, inputs, outputs, evidence, levels, dependencies, and fallback.
Shared service: A capability performed for more than one entity or market under defined scope, performance, governance, and evidence.
Smart contract: Code deployed to a distributed ledger that executes logic under defined conditions; it may be associated with identifiable developers, operators, users, or controllers.
Source lineage: The trace of where data, legal rules, risk signals, and decisions originated and how they were used.
Source of funds (SOF): The origin and traceable path of specific funds involved in a transaction or relationship.
Source of record: The authoritative system or repository for a defined data item, subject to stated scope and quality conditions.
Source of wealth (SOW): How a person accumulated overall wealth sufficient to make the relationship or activity plausible.
Source provenance: Information about where a data point originated, how it was obtained, and what legal/operational restrictions apply to its use.
Stablecoin: A crypto-asset designed to maintain stable value relative to a reference; risk analysis must consider issuer, reserve, redemption, distribution, custody, and transfer functions.
STR: Suspicious Transaction Report under Canada’s FINTRAC reporting framework; do not use the label as a substitute for country-specific report analysis.
Straight-through processing: Automated processing without manual intervention; it is an operational mode, not proof that risk was assessed correctly.
Surge capacity: Reserved ability to absorb abnormal demand without silently degrading service levels, quality, or risk controls.
Sustainable remediation: Corrective action that resolves historical and future-state scope, causal conditions, evidence, ownership, validation, and recurrence monitoring.
System effectiveness: The ability to prove that connected controls, people, data, decisions, evidence, and assurance deliver intended risk outcomes in the context of the relevant exposure.
System of record: The controlled repository that holds the official workflow, determination, or evidence for a defined object or process.
Targeted financial sanctions: Asset-freezing and related measures directed at designated persons, entities, or other targets under an applicable regime.
Technical compliance: The extent to which a jurisdiction has enacted the laws, powers, institutions, and other technical elements required by the relevant FATF Recommendations.
Tension escalation: The controlled process for resolving a conflict between global standard, local legal obligation, risk appetite, capability, or market action.
Third-party relationship: An arrangement in which an external party provides an activity, service, technology, data, model, or dependency relevant to the institution.
Three lines: A governance model distinguishing management ownership, risk/compliance oversight, and independent internal audit assurance.
Tipping off: Improperly disclosing a report, investigation, or related information where law or policy restricts the disclosure.
Trade diversion: Rerouting, re-exporting, or otherwise redirecting goods, technology, or value away from a stated or permitted destination or end user.
Trade-based money laundering: Moving or disguising illicit value through trade transactions, often by misrepresenting price, quantity, quality, goods, parties, or other trade facts.
Transformation debt: Unresolved data, process, governance, training, or evidence gaps carried forward after a change is declared complete.
Translation debt: An accumulated gap between an external standard or obligation and the implemented operating capability, including gaps in interpretation, policy, data, design, configuration, workflow, evidence, or governance.
Transliteration: Rendering a name from one script into another; a control-relevant source and match attribute, not a single definitive identity field.
Travel Rule: The requirement under FATF's virtual-asset framework for VASPs and other obliged entities in scope to obtain, hold, and exchange specified originator and beneficiary information in the prescribed context.
Trustee: A person or entity holding legal title to trust property and administering the trust under its terms and applicable law.
Tuning: Controlled adjustment to detection logic to improve coverage, investigative value, capacity, or customer impact.
U.S. nexus: The facts that may connect conduct to a U.S. legal, regulatory, supervisory, or sanctions requirement.
UIF: Mexico’s Unidad de Inteligencia Financiera.
UKFIU: United Kingdom Financial Intelligence Unit, housed in the National Crime Agency.
Unhosted wallet: A wallet controlled directly by a user rather than an identified intermediary; it may change due diligence and transfer-control design.
Value leakage: Cost, delay, rework, risk, or customer friction created when a control is not designed around the whole decision path.
VASP: A virtual-asset service provider under FATF's activity-based definition; local scope and licensing treatment vary.
VDA: Virtual digital asset, a defined term relevant to India’s 2023 PMLA notification.
Verification: A controlled process that tests an identity or other claim through defined methods and produces a recorded result with limitations.
Version control: Recorded identification and governance of the specific code, rule, model, list, configuration, schema, or content used at a point in time.
Wallet: A technical and/or service arrangement that manages private keys or allows interaction with virtual assets; custody and control models vary.
Workaround debt: Accumulated informal local processes or exceptions that obscure scope, reduce evidence, and increase change and assurance risk.
Workflow orchestration: The controlled routing, assignment, escalation, approval, and evidence capture that moves a case or task through a process.
Workforce mix: The deliberate allocation of standardized, assisted, specialist, independent-review, and management work.

Opening the library index…