AML and KYC glossary.

Plain-English definitions of the KYC and AML terms used in compliance work across the EU, Luxembourg and Mauritius. Each entry points to the relevant law or supervisory practice where that helps.

Adverse media

Negative news or other public information linking a person or company to crime, fraud, corruption or other risks relevant to due diligence.

Adverse media screening searches news and other public sources for reports about a customer, its beneficial owners or related parties. A result does not prove wrongdoing, so it is assessed for reliability and relevance and may lead to enhanced due diligence or a review of the relationship. It is a common trigger for event-driven reviews during ongoing monitoring.

AIFM (Alternative Investment Fund Manager)

Alternative Investment Fund Manager: a firm authorised to manage alternative investment funds such as private equity, real estate or hedge funds.

AIFMs are regulated under the EU AIFM Directive (2011/61/EU), implemented in Luxembourg by the law of 12 July 2013 and supervised by the CSSF. They are obliged entities under AML law, responsible for due diligence on investors and appropriate checks on the investments their funds make. Many Luxembourg management companies hold both UCITS and AIFM authorisations.

AML (Anti-Money Laundering)

Anti-Money Laundering: the laws, controls and procedures designed to stop criminals from passing off illegal funds as legitimate money.

AML rules require obliged entities such as banks, fund managers, fund administrators and TCSPs to know their customers, monitor activity and report suspicions to the national financial intelligence unit. The term is usually paired with CFT (countering the financing of terrorism). International standards come from the FATF Recommendations; in the EU they are set out in the AML Regulation and AMLD6, and in Mauritius mainly in FIAMLA 2002.

AMLA (EU Anti-Money Laundering Authority)

The EU Anti-Money Laundering Authority, based in Frankfurt and set up by Regulation (EU) 2024/1620 to coordinate and strengthen AML supervision.

AMLA's founding regulation has applied since 1 July 2025, and the authority is building up its staff and drafting technical standards and guidelines under the AMLR. From 2028 it is due to supervise directly a limited group of high-risk credit and financial institutions active in at least six Member States, with no more than 40 in the first selection. All other obliged entities remain under national supervisors, such as the CSSF in Luxembourg, which AMLA coordinates, and it also supports cooperation between national FIUs.

AMLD6 (Directive (EU) 2024/1640)

Directive (EU) 2024/1640, which Member States transpose to organise national AML supervisors, FIUs, beneficial ownership registers and risk assessments.

AMLD6 works alongside the AMLR: the regulation sets the obligations for firms, while the directive sets up the national authorities and registers around them. Most provisions must be transposed by 10 July 2027, with earlier deadlines for beneficial ownership register access rules (10 July 2026) and a later one for a single access point to real estate information (10 July 2029). The label AMLD6 is also used for Directive (EU) 2018/1673 on combating money laundering by criminal law, so it helps to check which text is meant.

AMLR (EU Regulation 2024/1624)

Regulation (EU) 2024/1624, the EU single rulebook on AML, with directly applicable due diligence, ownership and reporting rules from 10 July 2027.

As a regulation, the AMLR applies directly in every Member State without national transposition, and it takes over most firm-level obligations from the earlier AML directives. It harmonises rules on CDD, beneficial ownership, PEPs, reliance and reporting for obliged entities, including credit and financial institutions, fund managers and TCSPs. Most provisions apply from 10 July 2027, with 10 July 2029 for football agents and professional football clubs. AMLA is drafting the technical standards and guidelines that set out the details.

Business-wide risk assessment (BWRA)

A firm's documented assessment of the money laundering, terrorist financing and sanctions evasion risks it faces across its whole business.

The BWRA considers customers, products and services, countries and delivery channels, and takes account of EU and national risk assessments. It shapes the firm's policies, controls and customer risk scoring. Under Article 10 of the EU AML Regulation it must be documented, kept up to date, regularly reviewed and made available to supervisors on request, and AMLA is preparing guidelines on its content.

CDD (Customer Due Diligence)

Customer Due Diligence: the measures used to identify and verify a customer and its beneficial owners and to understand the purpose of the relationship.

CDD typically includes identifying and verifying the customer, identifying and verifying beneficial owners, assessing the purpose and intended nature of the relationship, and conducting ongoing monitoring. The depth of CDD is scaled to risk, from simplified to enhanced measures. Under the EU AML Regulation, CDD rules apply directly in all Member States from 10 July 2027, and AMLA is preparing technical standards on the information to be collected.

EDD (Enhanced Due Diligence)

Enhanced Due Diligence: extra checks applied when a customer, country, product or transaction carries a higher money laundering or terrorist financing risk.

EDD can include collecting more information on the customer and beneficial owners, establishing source of funds and source of wealth, obtaining senior management approval, and monitoring the relationship more closely. EU law requires EDD in defined cases, such as relationships with politically exposed persons or links to high-risk third countries. It also applies wherever a firm's own risk assessment identifies higher risk.

Four-eyes principle

A control where a decision needs review and approval by a second, independent person before it takes effect.

In KYC and AML work, the four-eyes principle is commonly applied to customer acceptance, risk rating changes, alert closures and approval of high-risk relationships. It reduces the risk of error and of one person overriding controls. The term comes from governance practice, and supervisors look for this kind of segregation of duties along with a record of who reviewed and approved each decision.

KYB (Know Your Business)

Know Your Business: due diligence on a company or other legal entity, covering its legal existence, ownership, control and the people acting for it.

KYB applies KYC principles to corporate customers. It usually includes checking registry records and constitutional documents, identifying directors and authorised signatories, and identifying the beneficial owners behind the entity. For TCSPs, management companies and fund administrators, most clients are entities, so KYB makes up a large share of onboarding work.

KYC (Know Your Customer)

Know Your Customer: the process of identifying and verifying a customer and understanding who they are, before and during a business relationship.

KYC covers collecting identity information, verifying it against reliable documents or sources, and understanding the purpose of the relationship. In the EU it forms part of the customer due diligence rules in AML law, which the AML Regulation (EU) 2024/1624 harmonises from 10 July 2027. Luxembourg applies these rules through the law of 12 November 2004 under CSSF supervision, and Mauritius through FIAMLA 2002 and the FIAML Regulations 2018 under FSC and Bank of Mauritius supervision.

ManCo (Management Company)

Management Company: in EU funds, a firm authorised to manage investment funds; in Mauritius, an FSC-licensed firm that administers global business companies.

In Luxembourg, ManCo usually means a UCITS management company authorised under the law of 17 December 2010 and supervised by the CSSF, often also authorised as an AIFM. A ManCo carries AML responsibilities for the funds it manages, including due diligence on investors and on the assets the funds invest in. In Mauritius, a Management Company is licensed by the FSC under the Financial Services Act 2007 to set up and administer global business companies and to act as corporate trustee, a role closer to that of a TCSP.

Ongoing monitoring

The continuous review of a business relationship and its transactions to confirm they match what is known about the customer and its risk profile.

Ongoing monitoring has two parts: scrutinising transactions for unusual patterns, and keeping customer documents and information up to date. Under Article 26 of the EU AML Regulation, customer information must be updated at least once a year for higher-risk customers and at least every five years for all others. A change in a customer's circumstances also requires a review.

PEP (Politically Exposed Person)

Politically Exposed Person: someone who holds or has held a prominent public function, such as a minister, senior judge, ambassador or central bank director.

Because their position carries a higher risk of bribery or corruption, EU law requires enhanced due diligence for PEPs, including senior management approval and establishing source of wealth and source of funds. The same measures apply to family members (spouse or partner, children and their partners, parents, and for the most senior functions such as heads of state, heads of government and ministers, siblings) and to persons known to be close associates. Under the EU AML Regulation, enhanced measures continue for at least 12 months after the person leaves office.

Perpetual KYC (pKYC)

Perpetual KYC: keeping customer files current on a continuous basis, with reviews triggered by relevant changes as well as by the review calendar.

pKYC is an industry practice without a formal definition in EU law. Typical triggers include a change of ownership or directors, a new sanctions or PEP match, adverse media, or unusual activity. It supports the legal duty to keep CDD information up to date and to review a customer when relevant circumstances change.

RBE (Luxembourg Register of Beneficial Owners)

Luxembourg's central register of the beneficial owners of companies and other registered entities, set up by the law of 13 January 2019.

The Registre des bénéficiaires effectifs (RBE) is operated by Luxembourg Business Registers (LBR), and registered entities must file their beneficial owner details and keep them up to date. Professionals subject to AML obligations must report discrepancies between the register and their own due diligence findings. Public online access was suspended after the Court of Justice of the EU ruling of 22 November 2022, and a law in force since 1 February 2025 restricts access to authorities, AML professionals and persons who can show a legitimate interest.

Risk-based approach

Matching the intensity of AML controls to the level of risk, so that more effort goes to higher-risk customers, products, channels and countries.

The risk-based approach is the central principle of the FATF Recommendations and of EU AML law. Firms assess their exposure in a business-wide risk assessment, rate each customer, and apply simplified, standard or enhanced measures accordingly. Supervisors such as the CSSF in Luxembourg and the FSC in Mauritius expect the reasoning behind each rating to be documented.

Sanctions screening

Checking customers, beneficial owners and counterparties against official sanctions lists so that no funds or services reach designated persons.

Relevant lists include the EU consolidated list of financial sanctions and UN Security Council designations, plus national lists where they apply. Screening takes place at onboarding, whenever lists change and whenever customer details change, and each possible match is reviewed to confirm or discount it. The EU AML Regulation also requires firms to assess the risk that targeted financial sanctions are evaded or not implemented.

SDD (Simplified Due Diligence)

Simplified Due Diligence: reduced due diligence measures that may be applied when a relationship has been assessed and documented as low risk.

SDD keeps the obligation to perform due diligence in place while allowing some measures to be adjusted, for example by collecting less information or verifying identity later. Under the EU AML Regulation, any postponed verification must be completed within 60 days of the relationship being established. Firms must still monitor the relationship and move to standard measures if the risk changes.

Source of funds

The origin of the specific money used in a transaction or business relationship, such as a salary, a property sale or a company dividend.

Source of funds explains where the money for a particular transaction or investment came from and how it reached the customer. It is assessed for higher-risk relationships, including PEPs, and evidence can include bank statements, sale contracts or dividend records. It is closely related to source of wealth, which looks at how the customer's overall wealth was built.

Source of wealth

The origin of a customer's total wealth, explaining how their overall assets were accumulated over time.

Source of wealth looks at the activities that generated a person's net worth, such as employment, business ownership, inheritance or investments. EU law requires it to be established for politically exposed persons and it is a common enhanced due diligence measure in other higher-risk cases. The explanation should be plausible for the customer's profile and supported by proportionate evidence.

STR / SAR (Suspicious Transaction or Activity Report)

Suspicious Transaction or Activity Report: a report a firm files with its financial intelligence unit when it suspects money laundering or terrorist financing.

Firms must report promptly when they know, suspect or have reasonable grounds to suspect that funds are linked to criminal activity or terrorist financing, regardless of the amount, including attempted transactions. In Luxembourg, reports go to the Cellule de renseignement financier (CRF) through the goAML system; in Mauritius, they go to FIU Mauritius, which FIAMLA requires within five working days of the suspicion arising. Firms must not tell the customer that a report has been filed or is being considered (tipping off).

TCSP (Trust or Company Service Provider)

Trust or Company Service Provider: a firm that forms or administers companies and trusts, or provides directors, registered offices or trustee services.

TCSPs are obliged entities under FATF standards and EU AML law because their services can be misused to hide who owns or controls an entity. In Luxembourg, many act as domiciliation agents or corporate service providers, supervised by the CSSF or another authority depending on their licence or profession. In Mauritius, management companies licensed by the FSC carry out this role for global business companies.

UBO (Ultimate Beneficial Owner)

Ultimate Beneficial Owner: the natural person who ultimately owns or controls a company or legal arrangement, directly or indirectly.

Under the current EU directive regime, a shareholding or ownership interest of more than 25% is an indication of beneficial ownership. The EU AML Regulation, applicable from 10 July 2027, sets the test at 25% or more, counted through every level of an ownership chain, and also covers control exercised by other means. Where no person meets these tests, the senior managing officials are identified instead, and firms keep a record of the steps taken.

See Fidify on a real file.

Bring a sample entity and your AML rules. We will show you how Fidify handles them.

Book a demo Explore services