Compliance Acronyms and Definitions in Seven Countries
FATF, PEP, UBO, CDD, inherent and residual risk: what each acronym and each term means, and further down, those of each country.
Prevention speaks a common language set by the FATF: politically exposed persons, the ultimate beneficial owner, customer due diligence, the risk-based approach, inherent and residual risk. This glossary gives those shared acronyms and the definitions of risk management first and then, separately, the acronyms of each of the seven countries, with the words of its own law and the names of its authorities.
Acronyms Shared by the Region
The international standard and the terms every country uses.
- FATF
- Financial Action Task Force
- The intergovernmental body that sets the 40 Recommendations against the use of the economy for illicit funds, terrorism and proliferation, and publishes the lists of high-risk jurisdictions three times a year.
- GAFILAT
- Financial Action Task Force of Latin America
- The FATF-style regional body of Latin America, which evaluates its member countries.
- CFATF
- Caribbean Financial Action Task Force
- The FATF-style regional body of the Caribbean basin, to which Venezuela belongs.
- UNSC
- United Nations Security Council
- Its sanctions committees publish the lists of designated persons that every obligated subject must search, and whose funds must be frozen.
- OFAC
- Office of Foreign Assets Control
- The office of the United States Treasury that publishes the SDN list, known in the region as the Clinton List.
- PEP
- Politically exposed person
- Who holds or held a prominent public function, and their relatives and close associates. They call for enhanced due diligence.
- UBO
- Ultimate beneficial owner
- The natural person who ultimately owns or controls a client, even through other companies. Each country sets the ownership percentage from which it counts.
- CDD
- Customer due diligence
- Identifying and verifying the client and its beneficial owner, understanding the purpose of the relationship and following it over time. Also called KYC.
- EDD
- Enhanced due diligence
- More information, more verification and approval at a higher level, for the clients of higher risk. Some norms call it extended or intensified.
- RBA
- Risk-based approach
- Putting more controls where the risk is higher and fewer where it is lower, instead of doing the same with everyone.
- DNFBP
- Designated non-financial businesses and professions
- Lawyers, notaries, accountants, real estate agents, dealers in precious metals and stones and other businesses that the FATF asks countries to oblige.
- FIU
- Financial intelligence unit
- The authority that receives the suspicious operation reports of a country. Each one has its own name: see the acronyms by country.
- TF
- Terrorist financing
- Providing or collecting funds, of licit or illicit origin, for terrorist acts or organizations.
- PF
- Proliferation financing
- Funding the manufacture, acquisition or transfer of nuclear, chemical or biological weapons and their means of delivery.
- NPO
- Non-profit organization
- Foundations, associations and similar bodies, which the FATF asks to protect from being used to finance terrorism.
- VASP
- Virtual asset service provider
- Who exchanges, transfers or keeps virtual assets on behalf of others, such as an exchange platform.
Definitions of Risk Management
The vocabulary of the risk assessment, from the factor to the plan.
- Risk management
- The process by which an entity identifies, measures, controls and monitors its exposure to being used for illicit funds, terrorism or proliferation.
- Entity risk assessment
- The measurement of the risk of the business as a whole, by its clients, products, channels and places. It is not the client risk matrix: the law asks for both.
- Methodology
- The document that says how the risk is identified, measured and controlled: scales, methods, weights, owners and how often. The board approves it.
- Risk factors
- The sources of the risk: clients, products and services, distribution channels and geographic location. An entity can add others.
- Segmentation
- Dividing each factor into groups that are alike inside and different from each other.
- Risk variable
- Each concrete element of a factor: a type of client, a product, a channel, a country.
- Distribution channels
- The means through which the entity offers its products and services: an office, an agent, a website, an application.
- Risk event
- A situation, internal or external, through which the risk could materialize. It is written as one sentence: who does what, and what it could be used for.
- Probability
- How possible it is that an event occurs, measured with a datum: a number or a percentage of clients, alerts, operations or incidents in a period.
- Impact
- The consequences for the entity if the event occurs, measured on each associated risk.
- Associated risks
- The ways the harm reaches the entity: reputational, legal or compliance, operational and contagion.
- Reputational risk
- Losing clients or income because of bad publicity, true or not, about the entity.
- Legal or compliance risk
- Sanctions, fines, compensation or lawsuits for breaching the law or the norms.
- Operational risk
- Losses from failures in people, processes, technology or infrastructure, or from external events.
- Contagion risk
- Harm that reaches the entity through a related person or company.
- Inherent risk
- The risk of an event before any control, from its probability and its impact.
- Control
- Mitigator
- A policy, procedure, process or tool that reduces the probability or the impact of an event. Preventive if it acts before, detective if it acts after.
- Control rating
- How well a control works: whether it is documented, when it acts, how often it runs and the compliance and effectiveness its tests measured.
- Residual risk
- The risk that remains after applying the controls to the inherent risk.
- Risk matrix
- A table that crosses two scales, such as probability and impact, or inherent risk and control rating, and gives a level in each cell.
- Heat map
- The risk matrix painted by colours, with each event in its cell, so that the board sees where the risk concentrates.
- Disaggregated and consolidated form
- Disaggregated: the level of each event, variable, segment and factor. Consolidated: events add up into variables, variables into segments, segments into factors and factors into the risk of the entity.
- Emerging risk
- A risk that appears with a change in the environment, such as a new technology, a new product or a new behaviour of clients or criminals, and that the controls do not yet cover.
- Strengthening plan
- The actions for the events whose residual risk stays above the level the entity tolerates, each with its owner and its deadline.
- Materialized event
- A risk event that actually happened. It is recorded and feeds the next review of the methodology.
- Red flag
- A sign that calls for a closer look at a client or an operation. It is not proof.
- Unusual and suspicious operation
- Unusual: it does not match the profile of the client. Suspicious: after the analysis it has no reasonable justification, and it is reported to the financial intelligence unit.
- Prevention manual
- The document with the policies and procedures of prevention of the entity, approved by its board. Each country gives it its own name.
Acronyms by Country
Each country with the words of its law and the name of its authorities.
Panama
- BC/FT/FPADM
- Capital laundering (blanqueo de capitales), terrorist financing and proliferation financing, as the Panamanian law names them.
- UAF
- Financial Analysis Unit (Unidad de Análisis Financiero), the financial intelligence unit of Panama, which receives the ROS.
- SSNF
- Superintendency of Non-Financial Obligated Subjects, the supervisor of the SONF.
- SONF
- Non-financial obligated subjects: the activities and professions that Law 23 of 2015 obliges, such as lawyers, accountants, real estate agents and free zone companies.
- ROS
- Suspicious operation report (Reporte de Operación Sospechosa) of Panama, filed with the UAF.
- RUBF
- Single registry of ultimate beneficial owners of Panamanian legal entities, kept through the resident agent.
Mexico
- PLD/FT
- Prevention of money laundering (lavado de dinero) and terrorist financing, the usual acronym in Mexico.
- LFPIORPI
- The Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin, the «Anti-Laundering Law».
- UIF
- Financial Intelligence Unit of the Ministry of Finance (SHCP).
- SAT
- Tax Administration Service, which supervises the vulnerable activities and receives their Notices (Avisos).
- AV
- Vulnerable activities, listed in article 17 of the LFPIORPI. They file Notices when an operation reaches the threshold; Mexico has no ROS for them.
- UMA
- Unit of Measurement and Update, in which the thresholds of the LFPIORPI are expressed; INEGI publishes it every year.
Colombia
- LA/FT/FPADM
- Asset laundering (lavado de activos), terrorist financing and proliferation financing in Colombia.
- UIAF
- Financial Information and Analysis Unit, which receives the ROS of Colombia.
- SIREL
- The online reporting system of the UIAF.
- SAGRILAFT
- Self-control and comprehensive risk management system for LA/FT/FPADM that the Superintendencia de Sociedades requires of companies.
- SARLAFT
- Risk management system for LA/FT of the entities supervised by the Superintendencia Financiera.
- PTEE
- Transparency and Business Ethics Programme, against transnational bribery and corruption.
Guatemala
- LD/FT/FPADM
- Money or other assets laundering (lavado de dinero u otros activos), terrorist financing and proliferation financing, in Decree 15-2026.
- IVE
- Special Verification Intendancy of the Superintendency of Banks, the financial intelligence unit of Guatemala.
- SIB
- Superintendency of Banks of Guatemala.
- RTS
- Suspicious transactions report, filed with the IVE (article 30 of Decree 15-2026).
- PO
- Obligated person (persona obligada): who the law obliges to prevent, listed in article 3 of Decree 15-2026.
Dominican Republic
- LA/FT
- Asset laundering (lavado de activos) and terrorist financing, under Law 155-17.
- UAF
- Financial Analysis Unit (Unidad de Análisis Financiero) of the Dominican Republic, which receives the ROS through goAML.
- ROS
- Suspicious operation report of the Dominican Republic.
- DGII
- Directorate General of Internal Taxes, the supervisor of the non-financial obligated subjects.
- goAML
- The reporting platform of the United Nations that the UAF uses.
Ecuador
- ALA/CFT
- Anti-money laundering (antilavado de activos) and countering the financing of terrorism, the acronym of the law.
- UAFE
- Financial and Economic Analysis Unit, the financial intelligence unit of Ecuador.
- RESU
- The report of operations that equal or exceed the legal threshold, of every kind and not only in cash.
- NO ROS / NO RESU
- The report of non-existence, filed when there was nothing to report in the period.
- SCVS
- Superintendency of Companies, Securities and Insurance.
Venezuela
- LC/FT/FPADM
- Capital legitimation (legitimación de capitales), terrorist financing and proliferation financing.
- UNIF
- National Financial Intelligence Unit, which receives the RAS.
- RAS
- Suspicious activities report (Reporte de Actividades Sospechosas), filed with the UNIF.
- LOCDOFT
- Organic Law against Organized Crime and Terrorist Financing (2012).
- SUDEBAN
- Superintendency of the Banking Sector Institutions.
Frequently Asked Questions
Because each law names the crime its own way, and the acronym follows the law: BC in Panama, LC in Venezuela, LD in Guatemala, LA in Colombia, the Dominican Republic and Ecuador, and PLD in Mexico. A document for one country should use the words of that country.
The ROS (Panama, Colombia, the Dominican Republic, Ecuador), the RAS (Venezuela) and the RTS (Guatemala) report a suspicious operation or activity. The Notice (Mexico) is filed by vulnerable activities when an operation reaches a threshold, suspicious or not.
The inherent risk is the risk before any control; the residual is what remains after the controls. A good control lowers the residual; without controls, the residual is the whole inherent risk.
No. The FATF sets the international standard. GAFILAT and CFATF are regional bodies in the style of the FATF that evaluate their member countries against that standard.
Comply With the Words of Your Country
COX speaks the law of each of the seven countries: the reports, the risks and the forms follow the country of your company.
Guides on this topic:
The 40 FATF Recommendations Red flags in seven countries Risk matrix and heat map Risk events