IBSL Diploma in Compliance Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Compliance function role

An independent second-line function that advises the business, monitors adherence to obligations, and educates staff, while remaining separate from revenue-generating activities and reporting to the board or a board committee.

Three lines model

A governance structure where the business owns and manages risk, risk and compliance oversee and challenge, and internal audit provides independent assurance directly to the governing body.

Risk-based approach

Allocating compliance effort in proportion to assessed risk, so that higher-likelihood and higher-impact exposures receive more monitoring, deeper due diligence, and more senior oversight.

Inherent versus residual risk

Inherent risk is the exposure before controls are considered; residual risk is what remains after control effectiveness is assessed, and it is compared against risk appetite.

Risk appetite statement

A board-approved declaration of how much and what type of risk the firm is willing to accept, expressed in measurable thresholds that trigger escalation when breached.

Compliance risk assessment

A periodic exercise mapping legal and regulatory obligations to business processes, rating exposures, evaluating control strength, and producing a prioritised plan of remediation and monitoring.

Regulatory obligation mapping

Converting each applicable rule into specific controls with named owners and evidence sources, so gaps between rules and controls become visible and auditable.

Compliance monitoring

Ongoing, usually automated or sample-based surveillance by the second line to detect control failures early, distinct from independent audit testing performed by the third line.

Control testing

A structured examination of a sample of transactions or records to conclude whether a control is designed appropriately and operated effectively throughout the review period.

Tone at the top

The visible commitment of senior leadership to ethical conduct and compliance, demonstrated through decisions, incentives, resourcing, and responses to breaches rather than statements alone.

Conflicts of interest

Situations where personal, financial, or organisational interests could improperly influence judgement; managed by avoiding, then controlling, and only lastly disclosing the conflict.

Chinese walls

Information barriers separating teams whose knowledge could create conflicts or misuse of inside information, supported by physical, system, and reporting-line controls.

Personal account dealing

Staff trading in their own accounts, controlled through pre-clearance, restricted lists, minimum holding periods, and independent review of exceptions against policy thresholds.

Gifts and entertainment register

A log recording hospitality and gifts above a set value, reviewed by compliance to confirm they are proportionate, not intended to influence decisions, and permissible under local rules.

Whistleblowing channel

A confidential route for staff to report suspected misconduct, offering protection from retaliation and escalation independent of managers implicated in the concern.

Remediation closure evidence

Proof that a corrective action has been implemented and tested as effective; policy revision alone does not close a finding without demonstrated control operation.

Root cause analysis

A method of tracing a compliance failure beyond the immediate error to underlying drivers such as unclear ownership, weak training, or misaligned incentives, so recurrence is prevented.

Key compliance indicator

A metric used to track compliance performance, ideally forward-looking, such as overdue actions, training completion, or control test failure rates, reported to senior management.

Regulatory breach notification

The duty to inform the supervisor of specified breaches within set timeframes, providing accurate facts, impact assessment, and a remediation plan, while preserving a record of the exchange.

Money laundering stages

Placement introduces illicit cash into the financial system; layering obscures its origin through complex transactions; integration returns the funds as apparently legitimate assets.

Customer due diligence

Identifying the customer and beneficial owner, verifying identity from independent sources, understanding purpose and expected activity, and refreshing the information on a risk-based cycle.

Beneficial ownership

The natural persons who ultimately own or control a legal entity or arrangement, typically identified by ownership thresholds and control tests, and verified before the relationship is established.

Enhanced due diligence

Additional scrutiny applied to higher-risk relationships, including source of wealth checks, senior sign-off, more frequent review, and closer transaction monitoring.

Politically exposed person

A person entrusted with prominent public functions, plus close associates and family, who presents heightened corruption risk and requires enhanced due diligence and senior approval.

Sanctions screening

Comparing customers, counterparties, and payments against designated lists; potential matches are adjudicated, and breaches can occur without intent under strict liability regimes.

Suspicious activity report

A confidential filing to the financial intelligence unit when suspicion of money laundering or terrorist financing arises, made without tipping off the customer involved.

Record retention period

The minimum time identification and transaction records must be kept under applicable law; firms apply the longest relevant period across the jurisdictions where they operate.

Data minimisation

Collecting and holding only personal data necessary for the stated purpose, reducing breach impact and supporting the storage limitation and accountability principles.

Outsourcing accountability

The principle that a regulated firm remains responsible for outsourced activities, requiring due diligence, audit rights, monitoring, and a viable exit plan in the contract.

Market conduct risk

The risk of harm to clients or market integrity from unfair treatment, unsuitable advice, undisclosed costs, or misuse of information, managed through product and sales controls.

Compliance training effectiveness

Evidence that training changed behaviour, measured through assessment results, monitoring outcomes, and targeted follow-up rather than attendance completion alone.

Regulatory change management

A process to identify new and amended rules, assess impact on policies and systems, assign owners, and implement changes before the effective date with tracked evidence.