This glossary explains key terminology used across Business Services / Professional Services in the specialized field of Regulatory Affairs And Regtech Practice. It helps executives and practitioners navigate regulatory submissions, compliance controls, financial-crime prevention, digital reporting, privacy obligations, and supervisory technology.
0–9 A B C D E F G H I J K L M N O P Q R S T U V X
| 0–9 | |
| 3LoD | Three Lines of Defense: A governance model that allocates responsibility among operational management, risk and compliance oversight, and independent internal audit. |
| 510(k) | Premarket Notification under Section 510(k) of the Federal Food, Drug, and Cosmetic Act: A United States medical-device submission used to demonstrate that a device is substantially equivalent to a legally marketed predicate device. |
| A | |
| ABC | Anti-Bribery and Corruption: The policies, risk assessments, due-diligence controls, monitoring, and investigations used to prevent improper payments and related misconduct. |
| ADR | Adverse Drug Reaction: A harmful and unintended response to a medicinal product that may trigger pharmacovigilance assessment, reporting, labeling changes, or other regulatory action. |
| AE | Adverse Event: An unfavorable medical occurrence associated with the use of a health product, whether or not a causal relationship has been established. |
| AEOI | Automatic Exchange of Information: A framework through which tax authorities routinely exchange specified financial-account information to improve cross-border tax transparency. |
| AI | Artificial Intelligence: Computational methods used in regulatory technology for document classification, obligation mapping, surveillance, risk detection, and reporting, while also creating governance and explainability requirements. |
| AIFMD | Alternative Investment Fund Managers Directive: The European Union framework governing managers of hedge funds, private-equity funds, real-estate funds, and other alternative investment funds. |
| ALCOA+ | Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, and Available: A set of principles used to assess the integrity and reliability of regulated life-sciences data and records. |
| AML | Anti-Money Laundering: The laws, controls, monitoring, and reporting processes intended to prevent criminals from disguising the origins or ownership of illicit funds. |
| AMLA | Anti-Money Laundering Act of 2020: A United States law that modernized financial-crime regulation, strengthened beneficial-ownership reporting, and expanded enforcement and information-sharing authorities. |
| AMLA | European Union Authority for Anti-Money Laundering and Countering the Financing of Terrorism: The European Union authority responsible for coordinating national supervisors and directly supervising selected high-risk financial institutions. |
| AMLD | Anti-Money Laundering Directive: A term used for successive European Union directives establishing requirements for customer due diligence, beneficial ownership, reporting, and financial-crime supervision. |
| ANDA | Abbreviated New Drug Application: A United States submission seeking approval for a generic drug based principally on equivalence to an approved reference product. |
| API | Active Pharmaceutical Ingredient: The component of a medicinal product that produces its intended pharmacological effect and is subject to manufacturing, quality, and submission requirements. |
| API | Application Programming Interface: A defined connection that allows regulatory systems to exchange data with government portals, screening services, case-management platforms, and reporting applications. |
| APRA | Australian Prudential Regulation Authority: Australia’s prudential supervisor for banks, insurers, and most superannuation entities, including capital, governance, resilience, and risk-management requirements. |
| ASIC | Australian Securities and Investments Commission: Australia’s corporate, markets, financial-services, and consumer-credit regulator. |
| AUSTRAC | Australian Transaction Reports and Analysis Centre: Australia’s financial-intelligence unit and anti-money-laundering and counter-terrorism-financing regulator. |
| B | |
| BaFin | Bundesanstalt für Finanzdienstleistungsaufsicht: Germany’s Federal Financial Supervisory Authority, overseeing banks, insurers, securities markets, and regulated financial-service providers. |
| BCBS | Basel Committee on Banking Supervision: The international standard-setting body for bank prudential regulation, including capital, liquidity, risk-data, and supervisory principles. |
| BCR | Binding Corporate Rules: Internal data-protection rules approved by supervisory authorities to support transfers of personal data within multinational corporate groups. |
| BLA | Biologics License Application: A United States submission requesting permission to market a biological product based on evidence of safety, purity, potency, and manufacturing control. |
| BOI | Beneficial Ownership Information: Information identifying the individuals who ultimately own or control a legal entity, collected to improve corporate transparency and financial-crime prevention. |
| BSA | Bank Secrecy Act: The principal United States statute requiring financial institutions to maintain anti-money-laundering programs, records, and specified transaction reports. |
| C | |
| CAPA | Corrective and Preventive Action: A structured process for investigating nonconformities, correcting root causes, preventing recurrence, and documenting the effectiveness of remediation. |
| CBER | Center for Biologics Evaluation and Research: The United States Food and Drug Administration center responsible for regulating vaccines, blood products, cellular and gene therapies, and certain other biologics. |
| CCPA | California Consumer Privacy Act: A California law granting consumers rights over personal information and imposing notice, access, deletion, sale-sharing, and service-provider obligations. |
| CDD | Customer Due Diligence: The process of identifying and verifying customers and beneficial owners, understanding the relationship’s purpose, and assessing financial-crime risk. |
| CDER | Center for Drug Evaluation and Research: The United States Food and Drug Administration center responsible for regulating prescription, generic, and over-the-counter drugs. |
| CDRH | Center for Devices and Radiological Health: The United States Food and Drug Administration center responsible for medical devices and radiation-emitting electronic products. |
| CE | Conformité Européenne: A conformity marking indicating that a product meets applicable European Union safety, health, and environmental requirements before being placed on the market. |
| CFR | Code of Federal Regulations: The codified body of general and permanent rules issued by United States federal agencies and a primary reference for regulated requirements. |
| CFPB | Consumer Financial Protection Bureau: The United States agency responsible for administering and enforcing federal consumer-financial laws and supervising covered institutions. |
| CFT | Countering the Financing of Terrorism: Controls designed to detect and prevent funds or other assets from being made available for terrorist purposes. |
| CFTC | Commodity Futures Trading Commission: The United States regulator for derivatives markets, including futures, options, and swaps. |
| CIP | Customer Identification Program: A United States requirement for covered financial institutions to obtain and verify identifying information when customers open accounts. |
| CMC | Chemistry, Manufacturing, and Controls: The portion of a medicinal-product submission describing composition, manufacturing processes, analytical methods, specifications, stability, and quality controls. |
| CMS | Compliance Management System: The governance, policies, controls, monitoring, training, issue management, and reporting used to manage an organization’s regulatory obligations. |
| COPPA | Children’s Online Privacy Protection Act: A United States law governing the online collection, use, and disclosure of personal information from children under age 13. |
| COREP | Common Reporting: The European prudential-reporting framework through which regulated institutions submit standardized capital, risk, leverage, liquidity, and related data. |
| CPRA | California Privacy Rights Act: A California law that expanded consumer privacy rights, introduced additional obligations for sensitive information, and created a dedicated enforcement agency. |
| CRD | Capital Requirements Directive: The European Union directive establishing governance, authorization, supervision, and prudential requirements for credit institutions and investment firms. |
| CRR | Capital Requirements Regulation: The directly applicable European Union rulebook covering regulatory capital, credit risk, market risk, liquidity, leverage, and prudential reporting. |
| CRS | Common Reporting Standard: The global tax-transparency standard for collecting and automatically exchanging information about financial accounts held by nonresidents. |
| CSA | Computer Software Assurance: A risk-based approach promoted by the United States Food and Drug Administration for establishing confidence in software used in production and quality systems. |
| CSRD | Corporate Sustainability Reporting Directive: The European Union framework requiring covered companies to make standardized sustainability disclosures and obtain assurance over reported information. |
| CTA | Clinical Trial Application: A submission requesting authorization to conduct a clinical trial in a jurisdiction, supported by protocol, product, safety, and investigator information. |
| CTA | Corporate Transparency Act: A United States law requiring many legal entities to report information about their beneficial owners to the federal financial-intelligence unit. |
| CTD | Common Technical Document: The internationally harmonized five-module structure used to organize quality, nonclinical, and clinical information in medicinal-product applications. |
| CTMS | Clinical Trial Management System: A system used to plan, track, document, and report clinical-study activities, milestones, sites, subjects, and regulatory records. |
| CTR | Clinical Trials Regulation: The European Union framework governing authorization, conduct, transparency, safety reporting, and supervision of interventional clinical trials. |
| CTR | Currency Transaction Report: A report filed for cash transactions exceeding an applicable threshold or otherwise meeting prescribed reporting criteria. |
| CSV | Computer System Validation: Documented evidence that a regulated computerized system consistently performs as intended and meets predefined requirements. |
| D | |
| DAC6 | Directive on Administrative Cooperation 6: European Union rules requiring intermediaries and, in some cases, taxpayers to disclose reportable cross-border tax arrangements. |
| DMA | Digital Markets Act: The European Union regulation imposing conduct obligations on designated large digital-platform gatekeepers to promote contestable and fair digital markets. |
| DoC | Declaration of Conformity: A manufacturer’s formal statement that a product satisfies all applicable regulatory requirements necessary for market access. |
| DORA | Digital Operational Resilience Act: The European Union framework requiring financial entities to manage technology risk, test resilience, report major incidents, and oversee critical third-party providers. |
| DPA | Data Processing Agreement: A contract defining how a processor handles personal data on a controller’s behalf, including security, confidentiality, subprocessing, and assistance obligations. |
| DPA | Data Protection Authority: An independent public regulator responsible for supervising and enforcing privacy and personal-data laws within its jurisdiction. |
| DPIA | Data Protection Impact Assessment: A documented assessment used to identify and mitigate privacy risks arising from processing likely to create a high risk to individuals. |
| DPO | Data Protection Officer: An independent role that advises on privacy compliance, monitors controls, supports impact assessments, and liaises with regulators and data subjects. |
| DSA | Digital Services Act: The European Union regulation governing online intermediaries and platforms, including content governance, transparency, risk assessment, and user-protection duties. |
| DSAR | Data Subject Access Request: A request by an individual to obtain information about the processing of their personal data and, where applicable, a copy of that data. |
| DSUR | Development Safety Update Report: A periodic report that presents an annual review and evaluation of safety information for an investigational medicinal product. |
| E | |
| E2B | ICH E2B — Clinical Safety Data Management: Data Elements for Transmission of Individual Case Safety Reports: The international standard governing the structure and electronic transmission of individual pharmacovigilance case reports. |
| EBA | European Banking Authority: The European Union authority that develops banking standards, promotes supervisory convergence, and coordinates stress testing and regulatory reporting. |
| ECB | European Central Bank: The central bank for the euro area and the direct prudential supervisor of significant participating banks under the Single Supervisory Mechanism. |
| eCTD | Electronic Common Technical Document: The standardized electronic format used to submit, manage, and update medicinal-product application dossiers across their lifecycle. |
| EDD | Enhanced Due Diligence: Additional investigation, approval, documentation, and monitoring applied to higher-risk customers, beneficial owners, products, transactions, or jurisdictions. |
| EDGAR | Electronic Data Gathering, Analysis, and Retrieval: The United States Securities and Exchange Commission system through which companies and other filers submit and publish required disclosures. |
| EDPB | European Data Protection Board: The independent European Union body that promotes consistent application of data-protection law and coordinates national supervisory authorities. |
| EDPS | European Data Protection Supervisor: The independent authority that supervises personal-data processing by European Union institutions and advises on privacy-related legislation and policy. |
| EEA | European Economic Area: The common market comprising European Union member states plus Iceland, Liechtenstein, and Norway, frequently used to define regulatory and data-transfer scope. |
| eIDAS | Electronic Identification, Authentication and Trust Services: The European Union framework for electronic identification and regulated trust services such as electronic signatures, seals, timestamps, and certificates. |
| EIOPA | European Insurance and Occupational Pensions Authority: The European Union authority supporting consistent supervision and rulemaking for insurance and occupational-pension sectors. |
| EMA | European Medicines Agency: The European Union agency coordinating scientific evaluation, supervision, and pharmacovigilance for medicinal products. |
| EMIR | European Market Infrastructure Regulation: The European Union framework for derivatives clearing, risk mitigation, trade reporting, central counterparties, and trade repositories. |
| ESEF | European Single Electronic Format: The electronic reporting format requiring specified European issuers to publish annual financial reports in a standardized, machine-readable form. |
| ESMA | European Securities and Markets Authority: The European Union authority that develops securities-market rules, promotes supervisory convergence, and directly supervises certain market entities. |
| F | |
| FATCA | Foreign Account Tax Compliance Act: A United States tax-transparency regime requiring foreign financial institutions and other entities to identify and report specified United States account holders. |
| FATF | Financial Action Task Force: The international standard-setting body for combating money laundering, terrorist financing, and proliferation financing. |
| FCA | Financial Conduct Authority: The United Kingdom regulator responsible for conduct supervision, market integrity, competition, and consumer protection across financial services. |
| FCPA | Foreign Corrupt Practices Act: A United States law prohibiting bribery of foreign officials and requiring covered issuers to maintain accurate books, records, and internal accounting controls. |
| FDA | Food and Drug Administration: The United States agency regulating drugs, biologics, medical devices, food, cosmetics, tobacco products, and other health-related products. |
| FDIC | Federal Deposit Insurance Corporation: The United States agency that insures bank deposits, supervises specified financial institutions, and manages failed-bank resolutions. |
| FinCEN | Financial Crimes Enforcement Network: The United States financial-intelligence unit responsible for administering and enforcing the Bank Secrecy Act framework. |
| FINMA | Swiss Financial Market Supervisory Authority: Switzerland’s regulator for banks, insurers, financial institutions, markets, and financial-market infrastructures. |
| FINRA | Financial Industry Regulatory Authority: The United States self-regulatory organization overseeing broker-dealers and associated persons under Securities and Exchange Commission supervision. |
| FINREP | Financial Reporting: The standardized European supervisory framework through which regulated institutions submit financial information to prudential authorities. |
| FIU | Financial Intelligence Unit: A national authority that receives, analyzes, and disseminates reports and intelligence concerning suspected financial crime. |
| FRTB | Fundamental Review of the Trading Book: The Basel market-risk framework revising trading-book boundaries, risk measurement, capital calculations, and model-approval requirements. |
| FSMA | Financial Services and Markets Act: A foundational United Kingdom statutory framework for financial-services authorization, supervision, enforcement, and market regulation. |
| FSMA | Food Safety Modernization Act: A United States law emphasizing preventive controls, supply-chain oversight, produce safety, inspections, and rapid response to food-safety risks. |
| FTC | Federal Trade Commission: The United States agency enforcing competition and consumer-protection laws, including requirements affecting privacy, advertising, security, and unfair practices. |
| G | |
| GCP | Good Clinical Practice: The international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human participants. |
| GDPR | General Data Protection Regulation: The European Union’s principal privacy framework, governing lawful processing, individual rights, accountability, security, data transfers, and breach notification. |
| GLBA | Gramm-Leach-Bliley Act: A United States financial-services law imposing privacy, information-sharing, and customer-information security obligations on covered institutions. |
| GLP | Good Laboratory Practice: Quality principles governing the organization, performance, documentation, and reporting of nonclinical laboratory studies used in regulatory submissions. |
| GMP | Good Manufacturing Practice: Requirements ensuring regulated products are consistently manufactured and controlled according to appropriate quality standards. |
| GPAI | General-Purpose Artificial Intelligence: Models capable of performing a wide range of tasks and subject to specific risk-management, transparency, and documentation duties under emerging artificial-intelligence regulation. |
| GRC | Governance, Risk, and Compliance: An integrated approach and supporting technology for managing obligations, policies, controls, risks, evidence, issues, and assurance activities. |
| GVP | Good Pharmacovigilance Practices: European guidance describing the systems and processes required to monitor, assess, communicate, and manage medicinal-product safety. |
| GxP | Good “x” Practice: An umbrella term for regulated life-sciences quality practices, with the variable representing areas such as clinical, laboratory, manufacturing, or pharmacovigilance work. |
| H | |
| HIPAA | Health Insurance Portability and Accountability Act: A United States law establishing privacy, security, and breach-notification requirements for protected health information handled by covered entities and business associates. |
| HKMA | Hong Kong Monetary Authority: Hong Kong’s central banking institution and principal prudential supervisor for authorized deposit-taking institutions. |
| HTA | Health Technology Assessment: A multidisciplinary evaluation of a health technology’s clinical, economic, organizational, ethical, and social implications to inform coverage and access decisions. |
| I | |
| ICAAP | Internal Capital Adequacy Assessment Process: A bank’s documented assessment of whether its capital resources are adequate for its risk profile, strategy, stress scenarios, and regulatory obligations. |
| ICH | International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use: The international body that develops harmonized guidelines for pharmaceutical quality, safety, efficacy, and multidisciplinary regulatory topics. |
| ICO | Information Commissioner’s Office: The United Kingdom authority responsible for enforcing data-protection, freedom-of-information, and related information-rights legislation. |
| ICSR | Individual Case Safety Report: A structured pharmacovigilance record describing one or more suspected adverse reactions experienced by an individual patient. |
| ICT | Information and Communication Technology: The systems, infrastructure, applications, and communications services addressed by digital-resilience, cybersecurity, outsourcing, and operational-risk requirements. |
| IDE | Investigational Device Exemption: A United States authorization permitting an investigational medical device to be used in a clinical study to collect safety and effectiveness evidence. |
| IDMP | Identification of Medicinal Products: A family of international data standards supporting consistent identification and exchange of medicinal-product, substance, organization, and reference information. |
| IFU | Instructions for Use: Regulated product information explaining safe and effective operation, indications, warnings, precautions, maintenance, and disposal. |
| ILAAP | Internal Liquidity Adequacy Assessment Process: A bank’s documented evaluation of its liquidity and funding risks, controls, stress testing, contingency arrangements, and available resources. |
| IND | Investigational New Drug Application: A United States submission that must become effective before an unapproved drug or biologic can generally be tested in human clinical trials. |
| IOSCO | International Organization of Securities Commissions: The global standard-setting body for securities regulation, market integrity, investor protection, and cooperation among market regulators. |
| IRB | Institutional Review Board: An independent committee that reviews research involving human participants to protect their rights, safety, and welfare. |
| ISO 37001 | International Organization for Standardization 37001 — Anti-Bribery Management Systems: An international standard specifying requirements and guidance for establishing, implementing, maintaining, and improving anti-bribery controls. |
| ISO 37301 | International Organization for Standardization 37301 — Compliance Management Systems: An international standard specifying requirements and guidance for an effective organizational compliance-management system. |
| IVDR | In Vitro Diagnostic Medical Devices Regulation: The European Union framework governing classification, conformity assessment, clinical evidence, registration, and post-market oversight of in vitro diagnostics. |
| iXBRL | Inline Extensible Business Reporting Language: A format that embeds machine-readable reporting tags within a human-readable document, supporting standardized regulatory and financial disclosures. |
| J | |
| JFSA | Financial Services Agency of Japan: Japan’s national regulator for banking, securities, insurance, financial-market conduct, and related supervisory matters. |
| K | |
| KID | Key Information Document: A standardized precontractual disclosure explaining the features, risks, costs, and potential performance of a packaged retail investment or insurance product. |
| KIID | Key Investor Information Document: A concise standardized disclosure designed to help retail investors understand and compare covered investment funds. |
| KRI | Key Risk Indicator: A quantitative or qualitative measure used to signal changing compliance exposure, control weakness, or proximity to a risk threshold. |
| KYB | Know Your Business: The process of verifying a legal entity, its ownership, business activities, authorization status, and associated financial-crime risks. |
| KYC | Know Your Customer: The controls used to identify and verify customers, understand expected activity, assess risk, and maintain current records throughout the relationship. |
| KYT | Know Your Transaction: Transaction-level analysis used to identify unusual patterns, sanctions exposure, illicit counterparties, or activity inconsistent with a customer’s risk profile. |
| L | |
| LCR | Liquidity Coverage Ratio: A prudential metric requiring banks to hold enough high-quality liquid assets to withstand a specified short-term stress period. |
| LEI | Legal Entity Identifier: A globally standardized identifier used to distinguish legal entities in financial transactions, regulatory reports, and reference-data systems. |
| LGPD | Lei Geral de Proteção de Dados Pessoais: Brazil’s general personal-data protection law, establishing processing principles, individual rights, security duties, and regulatory enforcement mechanisms. |
| LLM | Large Language Model: A machine-learning model capable of analyzing and generating text, increasingly used for regulatory research, obligation extraction, policy comparison, and compliance support. |
| M | |
| MA | Marketing Authorization: Formal regulatory approval allowing a medicinal product to be placed on the market for specified indications and conditions of use. |
| MAA | Marketing Authorization Application: A dossier submitted to obtain permission to market a medicinal product, including quality, nonclinical, clinical, labeling, and risk-management information. |
| MAH | Marketing Authorization Holder: The legal entity responsible for an authorized medicinal product, including ongoing quality, safety, labeling, and regulatory-maintenance obligations. |
| MAR | Market Abuse Regulation: The European Union framework prohibiting insider dealing, unlawful disclosure, and market manipulation while establishing surveillance and disclosure duties. |
| MAS | Monetary Authority of Singapore: Singapore’s central bank and integrated regulator for banking, insurance, capital markets, payments, and financial crime. |
| MDR | Medical Device Regulation: The European Union framework governing medical-device classification, conformity assessment, clinical evidence, registration, traceability, and post-market surveillance. |
| MedDRA | Medical Dictionary for Regulatory Activities: The standardized international medical terminology used to code and analyze adverse events, indications, medical history, and other regulatory information. |
| MHRA | Medicines and Healthcare products Regulatory Agency: The United Kingdom agency responsible for regulating medicines, medical devices, blood components, and associated product safety. |
| MiCA | Markets in Crypto-Assets Regulation: The European Union framework governing crypto-asset issuers and service providers, including authorization, disclosure, conduct, custody, and market-abuse requirements. |
| MiFID II | Markets in Financial Instruments Directive II: The European Union directive governing investment services, trading venues, investor protection, market structure, governance, and transaction transparency. |
| MiFIR | Markets in Financial Instruments Regulation: The directly applicable European Union rules covering market transparency, transaction reporting, trading obligations, and access to financial-market infrastructure. |
| ML | Machine Learning: Computational methods that learn patterns from data and support screening, anomaly detection, case prioritization, regulatory classification, and predictive compliance analytics. |
| ML/TF | Money Laundering and Terrorist Financing: The paired financial-crime risks addressed through customer due diligence, monitoring, reporting, governance, and risk-based controls. |
| MLR | Money Laundering Regulations: The United Kingdom rules imposing customer due-diligence, recordkeeping, governance, reporting, and risk-assessment obligations on regulated businesses. |
| MLRO | Money Laundering Reporting Officer: The designated officer responsible for overseeing financial-crime controls and evaluating internal suspicions for possible external reporting. |
| MRA | Matter Requiring Attention: A formal supervisory finding requiring a regulated institution to remediate a significant weakness within an agreed timeframe. |
| MSB | Money Services Business: A regulated category covering activities such as money transmission, currency exchange, check cashing, and certain payment or virtual-asset services. |
| N | |
| NCA | National Competent Authority: A domestic regulator designated to implement, supervise, or enforce a regional or national regulatory framework. |
| NDA | New Drug Application: A United States submission seeking approval to market a new drug based on evidence of safety, effectiveness, manufacturing quality, and appropriate labeling. |
| NIS2 | Network and Information Systems Directive 2: The European Union cybersecurity framework imposing risk-management, incident-reporting, governance, and supply-chain duties on covered essential and important entities. |
| NLP | Natural Language Processing: Technology used to extract obligations, entities, topics, changes, and risk signals from regulations, filings, policies, communications, and case records. |
| NPI | Nonpublic Personal Information: Personally identifiable financial information protected under United States financial-privacy requirements and related security rules. |
| NSFR | Net Stable Funding Ratio: A prudential metric intended to ensure that banks maintain a stable funding profile over a one-year horizon. |
| O | |
| OCC | Office of the Comptroller of the Currency: The United States federal regulator responsible for chartering, supervising, and regulating national banks and federal savings associations. |
| ODD | Ongoing Due Diligence: Continuing review of customer information, ownership, transactions, and risk so records remain current and unusual activity can be identified. |
| OFAC | Office of Foreign Assets Control: The United States Treasury office that administers and enforces economic and trade sanctions. |
| ORSA | Own Risk and Solvency Assessment: An insurer’s forward-looking evaluation of its risk profile, capital needs, solvency position, and risk-management effectiveness. |
| OTSI | Office of Trade Sanctions Implementation: The United Kingdom authority responsible for implementing and enforcing specified trade sanctions and supporting regulated parties’ compliance. |
| P | |
| PBRER | Periodic Benefit-Risk Evaluation Report: A pharmacovigilance report that periodically evaluates cumulative safety information and the evolving benefit-risk profile of an approved medicinal product. |
| PEP | Politically Exposed Person: An individual entrusted with a prominent public function who may present elevated corruption or money-laundering risk, along with specified relatives and associates. |
| PF | Proliferation Financing: The provision or movement of funds or financial services connected with nuclear, chemical, or biological weapons proliferation and related delivery systems. |
| PHI | Protected Health Information: Individually identifiable health information subject to United States healthcare privacy and security requirements. |
| PII | Personally Identifiable Information: Information that identifies or can reasonably be linked to an individual and therefore requires appropriate privacy, security, retention, and disclosure controls. |
| PIPL | Personal Information Protection Law: China’s comprehensive personal-information law governing processing, individual rights, sensitive information, cross-border transfers, and organizational accountability. |
| PMA | Premarket Approval: The United States Food and Drug Administration’s most stringent premarket review pathway for high-risk medical devices. |
| PMS | Post-Market Surveillance: The systematic collection and evaluation of information about a regulated product after commercialization to identify safety, performance, and compliance issues. |
| PRA | Prudential Regulation Authority: The United Kingdom authority responsible for the safety, soundness, and prudential supervision of banks, insurers, and designated investment firms. |
| PRIIPs | Packaged Retail and Insurance-Based Investment Products: A European regulatory framework requiring standardized information about risks, costs, and potential outcomes for specified retail investment products. |
| PSD2 | Payment Services Directive 2: The European Union framework governing payment-service providers, customer authentication, account access, transparency, and consumer protection. |
| PSMF | Pharmacovigilance System Master File: A detailed description of the system through which a marketing authorization holder fulfills its medicinal-product safety obligations. |
| PSUR | Periodic Safety Update Report: A scheduled post-authorization report summarizing worldwide safety data and evaluating whether a medicinal product’s benefit-risk balance has changed. |
| PV | Pharmacovigilance: The science and activities concerned with detecting, assessing, understanding, communicating, and preventing adverse effects or other medicine-related problems. |
| Q | |
| QMS | Quality Management System: The documented governance, processes, controls, records, and improvement mechanisms used to ensure regulated work consistently meets applicable requirements. |
| QP | Qualified Person: A legally designated European pharmaceutical professional who certifies that each medicinal-product batch complies with authorization and manufacturing requirements before release. |
| QPPV | Qualified Person Responsible for Pharmacovigilance: The designated European professional responsible for establishing and maintaining a marketing authorization holder’s pharmacovigilance system. |
| R | |
| RAC | Regulatory Affairs Certification: A professional credential demonstrating knowledge of regulatory requirements and product-development processes in specified geographic or sectoral contexts. |
| RAPS | Regulatory Affairs Professionals Society: A professional organization providing education, certification, publications, and networking for healthcare-product regulatory professionals. |
| RBA | Risk-Based Approach: A method of allocating controls and resources according to the nature, likelihood, and impact of identified regulatory or financial-crime risks. |
| RCM | Regulatory Change Management: The process of identifying regulatory developments, assessing applicability and impact, assigning actions, updating controls, and retaining implementation evidence. |
| RegTech | Regulatory Technology: Technology that supports compliance activities such as regulatory monitoring, identity verification, screening, surveillance, control testing, case management, and reporting. |
| REMS | Risk Evaluation and Mitigation Strategy: A United States Food and Drug Administration-required safety program for certain medicines with serious risks that cannot be managed through labeling alone. |
| RFI | Request for Information: A formal supervisory or regulatory request requiring an organization to provide records, data, explanations, or evidence within a defined timeframe. |
| RIA | Regulatory Impact Assessment: A structured evaluation of a proposed rule’s objectives, alternatives, costs, benefits, risks, and effects on affected parties. |
| RIM | Regulatory Information Management: The processes and systems used to control product registrations, submissions, commitments, correspondence, labeling, authority data, and regulatory status across markets. |
| RMP | Risk Management Plan: A lifecycle document describing a medicinal product’s safety profile, pharmacovigilance activities, and measures for minimizing identified or potential risks. |
| RoPA | Records of Processing Activities: The documented inventory of personal-data processing purposes, categories, recipients, transfers, retention periods, and security measures maintained for privacy accountability. |
| RPA | Robotic Process Automation: Software-based automation used to execute repeatable compliance tasks such as data collection, reconciliation, screening, evidence gathering, and report preparation. |
| RTS | Regulatory Technical Standards: Detailed European rules developed under primary legislation to specify how particular regulatory requirements must be implemented. |
| RWA | Risk-Weighted Assets: Bank exposures adjusted for prescribed risk levels and used as the denominator in regulatory capital ratios. |
| RWD | Real-World Data: Health-related data collected outside conventional randomized clinical trials, including information from electronic records, claims, registries, and devices. |
| RWE | Real-World Evidence: Clinical evidence about a medical product’s use, benefits, or risks derived from analysis of real-world data. |
| S | |
| SAE | Serious Adverse Event: An adverse event meeting defined seriousness criteria, such as death, hospitalization, disability, congenital anomaly, or another medically important condition. |
| SaMD | Software as a Medical Device: Software intended for one or more medical purposes that performs those purposes without being part of a physical medical-device product. |
| SAR | Serious Adverse Reaction: A suspected reaction to a medicinal product that meets defined seriousness criteria and may require expedited or periodic safety reporting. |
| SAR | Suspicious Activity Report: A confidential filing made to a financial-intelligence unit when activity may involve money laundering, fraud, terrorist financing, sanctions evasion, or another offense. |
| SCA | Strong Customer Authentication: A European payment-security requirement using at least two independent authentication factors for specified electronic transactions and account access. |
| SCC | Standard Contractual Clauses: European Commission-approved contractual safeguards used to support certain transfers of personal data outside the European Economic Area. |
| SDN | Specially Designated Nationals and Blocked Persons List: The United States sanctions list identifying blocked persons and entities with whom covered parties are generally prohibited from dealing. |
| SEC | Securities and Exchange Commission: The United States federal agency responsible for securities-market regulation, issuer disclosure, investor protection, and enforcement. |
| SFDR | Sustainable Finance Disclosure Regulation: The European Union framework requiring financial-market participants and advisers to disclose sustainability risks, impacts, and product characteristics. |
| SFTR | Securities Financing Transactions Regulation: The European Union framework requiring reporting and transparency for repos, securities lending, margin lending, and certain collateral arrangements. |
| SM&CR | Senior Managers and Certification Regime: The United Kingdom accountability framework assigning documented responsibilities to senior managers and requiring firms to assess the fitness of specified personnel. |
| SmPC | Summary of Product Characteristics: The regulator-approved European document describing a medicinal product’s composition, indications, dosing, contraindications, warnings, adverse reactions, and pharmacological properties. |
| SOP | Standard Operating Procedure: A controlled document specifying how a regulated activity must be performed consistently, compliantly, and with appropriate evidence. |
| SOX | Sarbanes-Oxley Act: A United States law imposing corporate-governance, financial-reporting, internal-control, auditor-independence, and executive-certification requirements on public companies. |
| SPL | Structured Product Labeling: A United States electronic standard for exchanging machine-readable drug labeling and related product information. |
| SREP | Supervisory Review and Evaluation Process: The European prudential process through which supervisors assess a bank’s risks, governance, capital, liquidity, and necessary supervisory measures. |
| SSI | Sectoral Sanctions Identifications List: A United States sanctions list imposing specified financing, debt, equity, or other restrictions on designated entities without necessarily blocking all property. |
| STR | Suspicious Transaction Report: A filing submitted to a financial-intelligence unit when a transaction or attempted transaction may involve illicit funds or criminal activity. |
| SupTech | Supervisory Technology: Technology used by regulatory authorities to collect data, monitor institutions, identify risks, automate analysis, and support supervisory decisions. |
| SUSAR | Suspected Unexpected Serious Adverse Reaction: A serious suspected reaction whose nature or severity is inconsistent with existing product information and may require expedited reporting. |
| T | |
| TBML | Trade-Based Money Laundering: The movement or disguise of criminal value through trade transactions, often using mispricing, false documentation, multiple invoicing, or phantom shipments. |
| TFR | Transfer of Funds Regulation: The European Union framework requiring specified payer and payee information to accompany transfers of funds and certain crypto-assets. |
| TGA | Therapeutic Goods Administration: Australia’s regulator for medicines, medical devices, biologicals, and other therapeutic goods. |
| TMF | Trial Master File: The collection of essential documents demonstrating that a clinical trial was conducted and managed in accordance with regulatory and good-practice requirements. |
| TMS | Transaction Monitoring System: A rules-based, statistical, or machine-learning platform that identifies financial activity requiring investigation for possible crime or sanctions concerns. |
| TOPRA | The Organisation for Professionals in Regulatory Affairs: A professional membership organization supporting education, qualifications, standards, and career development for healthcare regulatory professionals. |
| U | |
| UBO | Ultimate Beneficial Owner: The natural person who ultimately owns or controls a customer or legal entity, including through indirect ownership or other means of control. |
| UCITS | Undertakings for Collective Investment in Transferable Securities: The European Union framework for regulated retail investment funds, including authorization, diversification, custody, disclosure, and cross-border distribution requirements. |
| UDI | Unique Device Identification: A standardized system of device identifiers and database records that supports medical-device traceability, recalls, safety monitoring, and supply-chain control. |
| UK GDPR | United Kingdom General Data Protection Regulation: The United Kingdom’s principal data-protection framework governing lawful processing, individual rights, accountability, security, and international transfers. |
| UTI | Unique Transaction Identifier: A globally standardized identifier used to link and reconcile records for the same reportable derivatives transaction across counterparties and repositories. |
| V | |
| VASP | Virtual Asset Service Provider: A person or business conducting specified virtual-asset exchange, transfer, safekeeping, administration, or financial services and therefore subject to applicable financial-crime controls. |
| X | |
| XAI | Explainable Artificial Intelligence: Methods that make automated outputs understandable to users, validators, auditors, and regulators, supporting accountability and effective challenge. |
| XBRL | Extensible Business Reporting Language: An open standard for tagging and exchanging machine-readable financial, prudential, tax, and sustainability-reporting data. |