BR-ANAC-PLH key terms

The collection of statutes, rules, and supervisory guidance that governs an institution's conduct and establishes the boundaries within which its compliance program must operate.

A government body empowered to license, examine, sanction, or instruct the entities within its jurisdiction, and whose expectations shape the compliance program's priorities.

The structured process of translating each applicable legal requirement into specific internal owners, controls, and evidence, so that no obligation is left unassigned or untested.

The amount and type of compliance risk an institution is willing to accept in pursuit of its objectives, expressed in statements that guide escalation and resource decisions.

A documented evaluation that ranks inherent risks by likelihood and impact, then adjusts for the effectiveness of existing controls to produce a residual risk rating.

The level of risk that would exist if no controls were in place, used as the starting point before mitigation is considered in a risk assessment.

The risk remaining after existing controls are applied, which determines whether additional mitigation or escalation to senior management is required.

A governance structure in which operational units own risk, an independent compliance function monitors and advises, and internal audit provides assurance to the governing body.

An integrated set of policies, controls, training, monitoring, and reporting mechanisms designed to prevent, detect, and correct violations of legal and regulatory obligations.

The allocation of compliance responsibilities, reporting lines, and decision rights among the board, senior management, and control functions, documented so accountability is clear.

Written statements that set mandatory standards and step-by-step instructions for everyday activities, converting regulatory requirements into practical guidance staff can follow consistently.

Processes, checks, and safeguards built into workflows that prevent errors or misconduct, detect them promptly, and provide evidence that required steps were actually performed.

A control that divides a transaction or process among different people so that no single individual can initiate, approve, record, and conceal an improper activity.

A control requiring a second, independent person to review and approve a decision or transaction before it proceeds, reducing the risk of error or deliberate misconduct.

A documented schedule specifying which roles may authorize which types and sizes of decisions, ensuring that commitments are made at an appropriate level of seniority.

A schedule that defines which roles receive which compliance training, how often, in what format, and how completion and understanding will be verified.

The visible commitment of senior leaders to ethical conduct, expressed through their decisions, communications, and willingness to prioritize compliance over short-term results.

An environment in which staff feel safe to raise concerns about misconduct without fear of retaliation, supported by accessible channels and visible follow-through on reported issues.

Legal and internal safeguards that prohibit retaliation against individuals who report suspected wrongdoing in good faith, including confidentiality of their identity where permitted.

Ongoing, largely automated surveillance of transactions and activities against defined thresholds or rules, intended to detect anomalies quickly enough for timely intervention.

Periodic, sample-based examination of whether a specific control operates as designed and whether its evidence is reliable, producing a pass, fail, or partially effective conclusion.

An independent function that assesses the adequacy of the compliance program and reports its findings directly to the board or audit committee, free from management influence.

The process of reviewing monitoring alerts to judge whether they reflect genuine risk, closing false positives with documented rationale and escalating true matches for investigation.

A structured, documented inquiry into suspected misconduct that gathers evidence, interviews relevant parties, and reaches a reasoned conclusion while preserving fairness and confidentiality.

The tracking of a reported concern from intake through investigation, decision, and closure, maintaining a complete record of actions, owners, and timelines.

A time-bound schedule of corrective actions that addresses the root cause of a deficiency, assigns an accountable owner, and defines how completion will be validated.

A disciplined method for identifying the underlying process, incentive, or cultural factor that allowed a failure, rather than stopping at the immediate error.

A formal measure imposed by a regulator, such as a fine, restriction, or mandated remediation, which carries consequences for the institution and may require program changes.

The process of comparing customers, transactions, and counterparties against designated-party and embargo lists to prevent prohibited dealings and to freeze or block as required.

The information gathering and verification performed before and during a relationship to confirm a customer's identity, business purpose, and source of funds or wealth.

Additional, more intrusive scrutiny applied to higher-risk relationships, such as politically exposed persons or complex ownership structures, including senior approval and closer ongoing review.

A situation where a personal, financial, or other interest could improperly influence professional judgment, requiring disclosure, recusal, or another documented mitigation.

A statement of the ethical standards and behavioral expectations that apply to all staff, describing how to handle dilemmas and where to seek guidance.

The duty to limit access to sensitive information to those with a legitimate need to know, protecting both individual privacy and the integrity of investigations.

A defined schedule specifying how long each category of compliance record must be kept, where it is stored, and how it is destroyed once the retention period ends.

A chronological, tamper-resistant log of who accessed or changed a record and when, enabling reconstruction of events during reviews, investigations, or examinations.

The rules governing the lawful collection, use, sharing, and cross-border transfer of personal information, including the rights owed to the individuals concerned.