Audit Readiness
Compliance evidence glossary: KYC/AML terms, defined plainly
Plain definitions of the terms used in KYC/AML evidence review, from beneficial ownership and adverse media to maker-checker review, evidence packs and hash-chained audit trails.
The same word can mean different things in a screening tool, a policy and an audit finding. This glossary defines the terms used in our articles, in the sense a reviewer needs: what the term covers, and what it does not prove.
Definitions and thresholds set in law differ between jurisdictions. Where a term has a legal definition, check the rule that applies to your institution.
Customer due diligence
KYC (know your customer). Establishing who a customer is, who owns and controls it, what it intends to do and what risk it presents, and keeping that knowledge current. In an evidence review, KYC is a set of source-backed claims, not a status. See KYC evidence review beyond name screening.
Customer due diligence (CDD). The measures an institution applies to identify the customer and verify its identity, identify the beneficial owners and take reasonable measures to verify who they are, check who may act for the customer, understand the purpose and intended nature of the relationship, and monitor it. The FATF Recommendations set the international standard; national law sets the detail.
Enhanced due diligence (EDD). Additional measures for higher-risk situations, for example more evidence of the source of funds or wealth, approval at a more senior level or closer monitoring. When EDD applies is set by law and by the institution's risk assessment.
Source of funds and source of wealth. Source of funds is where the money used in the relationship or transaction comes from. Source of wealth is how the customer came to hold their overall wealth. Both are claims that need evidence in proportion to the risk.
Request for information (RFI). A request to the customer or a third party for a document or an answer that could change the assessment. A useful RFI says what is missing and why it matters, and the response stays with the case. See an adverse-media item from source to escalation.
Risk rating. The institution's assessment of the risk a customer presents, made under a defined method and policy version. A rating is a judgment; the record should show which factors drove it.
Ownership and control
Beneficial owner. The natural person or persons who ultimately own or control a customer, or on whose behalf it acts. Ownership thresholds are set by the applicable law, and control can exist without any ownership interest.
Ownership and control chain. The sequence of holdings and control rights that connects a customer to the people or entities behind it. Each link should be a dated, sourced relationship, and percentages are combined only under the rules of the regime that applies. See sanctions exposure through ownership and control chains.
Nominee. A person who holds shares or a position on behalf of someone else. A nominee arrangement can hide the beneficial owner, so the record needs evidence of who gives the instructions.
Screening
Sanctions screening. Comparing customers and related parties against sanctions lists. A screen is a query at a point in time: a clear result means no unresolved match in the sources and parameters used, not that the customer has no sanctions exposure.
Politically exposed person (PEP). A person who is or has been entrusted with a prominent public function. The international standard also applies PEP measures to their family members and close associates. PEP status brings additional due diligence, whose extent depends on the type of PEP and the risk; it is not by itself a finding of wrongdoing.
Adverse media. Negative information about a customer or a related party in news, court, regulatory or other public sources. An item needs its source, its link to the subject and a human disposition before it affects a decision. See our adverse-media screening approach.
Possible match, true match and false positive. A possible match is a screening result that could refer to the subject. Review decides whether it is a true match, the same person or entity, or a false positive, a different one, using identifiers such as date of birth, nationality or registration number.
Disposition. The recorded outcome of reviewing a possible match or a finding, with the reason, the evidence used and the person who made it.
Review and decision
Agent. In our usage, software that performs defined compliance work, such as gathering and checking evidence or preparing findings, for a person to review. Agents prepare; people decide.
Human-in-the-loop. An operating model in which people review and decide on automated work. It is meaningful only when the person can see the work, challenge it and change the outcome. Under the EU Anti-Money Laundering Regulation, which applies to most of the firms it covers from 10 July 2027, decisions that result from automated processes or AI systems to enter, refuse or maintain a business relationship, or to change the extent of due diligence, must be subject to meaningful human intervention (Article 76(5)). See choosing an AI agent for KYC/AML evidence.
Maker-checker (four-eyes review). A control in which one person prepares a recommendation and a second person reviews it and decides whether to approve it. It adds assurance when the checker can question and return the work, and the record keeps both. See a challenged four-eyes review.
MLRO. The money laundering reporting officer: in many institutions, the person who receives internal reports of suspicion, decides whether to report them to the authorities and oversees the anti-money laundering controls. Titles and responsibilities vary by jurisdiction. See the KYC case walkthrough.
Escalation. Passing a case to a reviewer with more authority, with a defined question and the evidence behind it.
Accepted evidence gap. A missing item a decision proceeds without, accepted by an accountable person with a rationale, the alternative evidence relied on and any conditions. It cannot waive due diligence the law requires.
Evidence and records
Provenance. Where a piece of evidence came from: the issuer or provider, when it was retrieved, which version it is and how it entered the case.
Source-linked fact. A statement taken from a source that keeps its reference to that source, so a reviewer can check it.
Decision record. The record of a decision: who decided, under which authority and policy, on what evidence, with what rationale and conditions.
Audit trail. The sequence of recorded actions on a case: who did what, when, and to which record.
Hash. A short, fixed-length value computed from data with a cryptographic function. Computing it again later and comparing it with a reference value kept safe shows whether the data has changed. It does not show whether the data was true or complete. See the NIST Secure Hash Standard.
Hash-chained audit trail. An audit trail in which each event's hash covers the previous event's hash, so a later change to a recorded event should make verification fail from that point, as long as the reference values are kept where whoever writes the trail cannot change them. It is tamper-evident; it is not proof that every event was recorded.
Evidence pack. The exported record of an assessment: sources, facts, screening records, gaps, reviewer actions, the decision and integrity information, organised so another officer can reconstruct the decision. See audit-ready evidence packs.
Reconstruction. The test that another authorised officer can establish what was known, what was uncertain, which policy applied and who decided, without the original reviewer. FATF Recommendation 11 asks institutions to keep transaction records sufficient to reconstruct individual transactions, and to keep due diligence records and the results of any analysis. See reconstructing a customer approval.
Agents do the work. Humans make the call.
Many KYC/AML terms name what a source says, what a check found, what was inferred or what a person decided; a good record keeps them apart.
A clear screen, a matching hash and an approved status each establish less than they seem to; the definitions below say how much.
Definitions and thresholds set in law vary by jurisdiction; check the rule that applies to you.
→What is the difference between customer due diligence and enhanced due diligence?
Customer due diligence is the standard set of measures to identify the customer and verify its identity, identify its beneficial owners and take reasonable measures to verify them, understand the relationship and monitor it. Enhanced due diligence adds measures where the risk is higher, such as more evidence of the source of funds, senior approval or closer monitoring. The law and the institution's risk assessment decide when it applies.
→Does a clear sanctions screen mean a customer has no sanctions exposure?
No. It means the query, run on that date with those names, identifiers and lists, left no unresolved match. Exposure can also arise through ownership and control, which a name screen does not establish.
→Is a hash-chained audit trail the same as an immutable record?
No. Hash chaining can make later changes to recorded events detectable, if the reference values are kept out of reach of whoever writes the trail. It does not prevent changes, and it cannot show that an event was recorded in the first place.
