IBSL Diploma in Compliance Exam key terms

The possibility of legal or regulatory sanctions, financial loss, or reputational damage arising from an institution's failure to comply with applicable laws, regulations, rules, and internal standards. It is assessed by combining likelihood and impact.

The risk that a change in laws or regulations, or a misinterpretation of existing ones, harms an institution's operations, capital, or licence to operate. It is a subset of broader compliance risk.

A governance framework in which business units own and manage risk (first line), a compliance or risk function oversees and advises (second line), and internal audit provides independent assurance (third line).

The dedicated unit responsible for identifying compliance obligations, advising the business, monitoring adherence, and reporting on compliance risk to senior management and the board. It is normally independent of revenue-generating activities.

The individual charged with day-to-day leadership of the compliance function, including setting the compliance plan, advising staff, escalating breaches, and acting as a contact point for regulators.

The full set of policies, procedures, controls, training, monitoring, and reporting arrangements an organisation puts in place to prevent, detect, and respond to breaches of obligations. Its effectiveness is usually tested periodically.

Allocating compliance resources in proportion to the likelihood and severity of harm, so higher-risk customers, products, channels, and jurisdictions receive more scrutiny. It is a core expectation in anti-money-laundering and sanctions regimes.

Processes and safeguards designed to give reasonable assurance that an organisation meets its objectives, operates efficiently, reports reliably, and complies with laws. They include preventive, detective, and corrective controls.

Ongoing surveillance and periodic independent checks that verify whether controls are operating as designed and whether staff follow procedures. Findings feed into remediation plans and management reporting.

An independent, objective assurance function that evaluates the effectiveness of risk management, control, and governance, including compliance arrangements, and reports directly to the board or audit committee.

The structure of board oversight, committees, delegated authorities, and reporting lines that determines who is accountable for compliance decisions and how information reaches senior management.

The signals senior leaders send through their words and actions about the importance of ethical conduct and compliance. A credible tone requires leaders to be held to the same standards as other staff.

The shared values, attitudes, and behaviours that determine how an organisation's people actually treat compliance obligations in daily work. It is often assessed through staff surveys, incident data, and incentive structures.

The protected reporting, usually internally but sometimes to a regulator, of suspected wrongdoing or breaches by employees or others. Effective schemes require confidential channels and protection against retaliation.

An environment in which staff feel safe to raise concerns, challenge decisions, and report errors without fear of blame or retaliation. It depends on visible leadership support and follow-through on reported issues.

Situations where a person's private interests, or a firm's own interests, could improperly influence professional judgement or decisions. They are managed through disclosure, segregation of duties, or recusal.

Payments, benefits, or non-monetary advantages offered or received that could impair the duty to act in a client's best interests. Rules typically require disclosure, or prohibit them where they create unacceptable conflicts.

Offering, promising, giving, requesting, or accepting an advantage to influence the recipient's conduct improperly. Many regimes also cover bribing foreign public officials and failure to prevent bribery by associated persons.

The abuse of entrusted power for private gain, including bribery, extortion, nepotism, and embezzlement. Compliance programmes address it through risk assessment, due diligence, gifts policies, and training.

The process of identifying a customer, verifying their identity, understanding the purpose of the relationship, and assessing risk before or during onboarding. Enhanced measures apply to higher-risk relationships.

The wider set of practices for establishing who a client is, how they will use the relationship, and whether they present a risk of financial crime. It underpins ongoing monitoring of transactions.

Additional, more intrusive checks applied to higher-risk customers, such as politically exposed persons or those in high-risk jurisdictions. It may include source-of-wealth checks and senior sign-off.

A reduced level of customer checks permitted only where risk is demonstrably low, for example certain regulated products or publicly listed companies. It never allows a firm to skip identification entirely.

The identity of the natural persons who ultimately own or control a legal entity or arrangement, usually defined by ownership thresholds or control tests. Firms must identify them and understand the ownership chain.

A person entrusted with prominent public functions, and their close family and associates, who presents higher corruption risk. Relationships with them generally trigger enhanced due diligence and senior approval.

A report filed by a regulated firm to the national financial intelligence unit describing transactions or behaviour that may indicate money laundering or terrorist financing. Tipping off the customer is prohibited.

The process of disguising the origin of proceeds of crime so they appear legitimate, typically through placement, layering, and integration stages. Firms must detect and report suspected cases.

Disclosing to a customer or third party that a suspicious activity report has been or may be made, which can prejudice an investigation. It is a criminal offence in many jurisdictions.

Checking customers, counterparties, and transactions against designated persons and restricted-country lists before or during processing. It relies on accurate reference data and documented escalation of potential matches.

Restrictive measures imposed by governments or international bodies, such as asset freezes, travel bans, or trade embargoes, to influence behaviour. Firms must comply with the regimes that apply to them.

A screening alert that appears to match a designated person but on investigation does not. Firms must resolve them promptly and document the rationale to avoid excessive friction and backlog.

Risk-based checks on suppliers, agents, distributors, and other intermediaries before and during the relationship, covering ownership, integrity, and sanctions exposure. It supports compliance with anti-bribery and financial crime obligations.

Delegating a function or activity to an external provider while the regulated firm remains responsible for the activity and its compliance outcomes. It requires due diligence, written agreements, and ongoing oversight.

The process for identifying new or amended rules, assessing their impact on policies, systems, and controls, and implementing changes on time. It typically includes horizon scanning and a regulatory change log.

A formal review by a supervisory authority of a firm's compliance with applicable rules, often involving information requests, interviews, and sample testing. Findings may lead to remediation requirements or enforcement action.

A public body empowered to licence, supervise, and sanction regulated firms in a given sector or jurisdiction. It sets expectations, conducts examinations, and can impose corrective or disciplinary measures.

Formal measures a regulator takes against a firm or individual for breaches, such as fines, restrictions on business, public censure, or prohibition. Firms may be required to remediate and report progress.

Rules governing employees' dealings in securities for their own accounts, designed to prevent insider dealing and conflicts. They usually require pre-clearance, holding periods, and regular attestation.

Behaviour that undermines market integrity, including insider dealing, unlawful disclosure of inside information, and market manipulation. Firms must have surveillance and reporting arrangements in place.