BCCILA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Distributed ledger

A record replicated across multiple independent participants who reach agreement on updates without a single central administrator. Blockchain is a subset that batches transactions into hash-linked blocks.

Hash collision resistance

The property that finding two different inputs producing the same hash output is computationally infeasible. It underpins tamper-evidence in blockchains and the integrity assumptions courts may rely on.

Probabilistic finality

Settlement assurance that increases with each confirmation block, because a deep reorganization becomes exponentially expensive. Common in proof-of-work chains and relevant when timing legal completion of a transfer.

Merkle inclusion proof

A logarithmic-size set of hashes letting a verifier confirm a transaction is in a block without downloading the whole block. Light clients and auditors use it to prove existence.

Private key control

Whoever holds the private key can sign transfers, so legally the key holder usually controls the asset. Custody arrangements must define who holds keys and who bears loss.

Howey test

A US securities-law framework asking whether there is an investment of money in a common enterprise with an expectation of profit from the efforts of others. Promoter marketing is key evidence.

MiCA token categories

EU rules distinguish asset-referenced tokens, e-money tokens, and other crypto-assets, imposing white-paper, reserve, and notification duties according to category. Classification precedes compliance design.

FATF Recommendation 15

Requires virtual asset service providers to be licensed or registered and supervised for AML/CFT, and obliges countries to assess and mitigate virtual-asset risks. It anchors most national VASP regimes.

Travel rule

An AML requirement that originator and beneficiary identifying information accompany qualifying virtual asset transfers between providers, mirroring wire-transfer rules. Self-hosted wallets need a documented policy.

Reverse solicitation

The principle that a client approaching a foreign firm on its own initiative may not trigger local licensing, unlike active marketing into that market. Regulators read it narrowly.

Order of precedence clause

Contract language stating whether natural-language terms or code prevails when they conflict. Without it, a court must infer intent from ambiguous evidence, raising dispute risk.

Oracle problem

Smart contracts cannot natively access off-chain facts, so they rely on data feeds. The legal question is who bears loss when a feed is wrong, stale, or manipulated.

Upgradeable proxy contract

A pattern separating storage from logic so code can be replaced. It enables remediation and court-ordered fixes but introduces a trusted admin whose powers must be disclosed.

Digital signature validity

Electronic signatures are generally enforceable where there is intent to sign and a reliable, tamper-evident association with the record. Blockchain signatures can satisfy this if evidence is preserved.

Formal verification limits

Mathematical proof that code matches a written specification. It does not prove the specification reflects the parties' commercial intent, so legal review remains necessary.

Risk-based approach

An AML principle requiring controls proportionate to assessed money-laundering and terrorist-financing risk by customer, product, channel, and geography, documented and kept current.

Beneficial ownership threshold

The ownership or control level at which a natural person must be identified, commonly 25 percent though jurisdiction-specific. Control can exist through other means without any ownership.

Tipping off

Disclosing to a customer that a suspicious transaction report has been or may be filed. Prohibited because it can defeat investigation; reporting duties apply regardless of underlying legality.

Blockchain clustering heuristic

Attribution technique assuming addresses spent together share an owner, plus change-address detection. Results are probabilistic indicators supporting, not replacing, corroborating evidence.

Sanctions screening

Checking customers and counterparties against prohibited-party lists. It is a strict-liability prohibition on dealing, distinct from risk-scored suspicious-activity monitoring.

GDPR erasure conflict

A data subject's right to erasure clashes with immutable ledgers. Mitigations include keeping personal data off-chain, hashing or encrypting it, and destroying decryption keys.

Data controller

The entity determining why and how personal data is processed. It bears primary accountability, including for choosing lawful bases and responding to data subject requests.

Breach notification clock

Under GDPR, qualifying personal data breaches must be reported to the supervisory authority within 72 hours of awareness, with records kept for all breaches regardless of notification.

Key management controls

Safeguards for cryptographic keys: segregation of duties, multi-signature or MPC approval, hardware security modules, backups, and tested recovery. Weak key custody is a primary loss vector.

Realization event

A taxable point such as selling crypto for fiat, trading one asset for another, or buying goods. Receipt of staking rewards is typically ordinary income at fair value.

Cost basis method

The rule allocating acquisition cost to disposals, such as FIFO, specific identification, or average cost where allowed. The method must be applied consistently and documented.

Indefinite-lived intangible

A US GAAP classification for qualifying crypto-assets measured at cost and written down for impairment, with no upward revaluation until disposal. Gains appear only on sale.

Staking reward taxation

Rewards are generally ordinary income at fair market value when received, and that value becomes the cost basis for any later disposal, which may then produce capital gain or loss.

Three lines model

A governance structure where business units own risk, compliance and risk functions set frameworks, and internal audit provides independent assurance to the board.

Residual risk score

The risk remaining after existing controls are applied, as distinct from inherent risk. It drives remediation priority and is reported to senior management and the board.

Governance capture risk

Concentration of voting tokens or delegated pools lets a small group control protocol decisions. Timelocks, quorum rules, and delegation transparency reduce but do not remove it.

Targeting test

A jurisdictional nexus standard asking whether a firm actively solicits or serves residents, which can trigger local licensing even without physical presence. Marketing language is evidence.