Regulation LayerRegulation Layer
Glossary

The regulatory ecosystem,
defined term by term.

Every authority, law, layer, power, control and jurisdiction that shapes compliance. Full explanations, practical next steps and official sources.

404
terms defined
15
categories
144
authorities
27
jurisdictions

Browse by category

All terms

Showing 404 of 404 terms

Kinds of authority

Accreditation body

An independent body that assesses and recognises organisations against its standards; losing accreditation can halt operations even though the body cannot enforce law.

Read the full entry : Accreditation body

Intelligence model

Activity

The specific thing a business does that triggers obligations, such as payments, lending, data processing or drug manufacturing.

Read the full entry : Activity

Foundations

Audit trail

A chronological, tamper-evident record of who did what, when and on what basis, linking each action to the obligation it served.

Read the full entry : Audit trail

Kinds of authority

Authority type

The role an authority plays over a regulated organisation: governance, regulation, supervision, enforcement, licensing, accreditation or standards setting.

Read the full entry : Authority type

Guidance & supervisory instruments

CFPB guidance

Interpretive rules, advisory opinions, circulars, bulletins and supervisory highlights issued by the Consumer Financial Protection Bureau.

Read the full entry : CFPB guidance

Foundations

Compliance hierarchy

The order of authority a regulated organisation sits within: legislatures at the top, regulators and supervisors below them, then standards, professional and accreditation bodies.

Read the full entry : Compliance hierarchy

Foundations

Compliance obligation

Any duty an organisation must meet, whatever its source: a statute, a regulation, guidance, a supervisory expectation, an industry standard, a licence condition or a contract.

Read the full entry : Compliance obligation

Controls & evidence

Control

A specific, testable action an organisation performs to meet an obligation, with an owner, a frequency, a test and evidence on every run.

Read the full entry : Control

Compliance areas

Cybersecurity

Protecting systems and data through governance, technical controls, monitoring and incident response, as required by law, regulators and standards.

Read the full entry : Cybersecurity

Controls & evidence

Data protection

Safeguarding personal and sensitive data against loss, misuse and unauthorised access, as required by privacy and security laws.

Read the full entry : Data protection

Laws & regulations

Dodd-Frank Act (Dodd-Frank)

The 2010 US Dodd-Frank Wall Street Reform and Consumer Protection Act, passed after the financial crisis to reshape financial regulation.

Read the full entry : Dodd-Frank Act

Laws & regulations

DORA (DORA)

The EU Digital Operational Resilience Act, applying from January 2025, setting ICT risk, incident reporting, testing and third-party rules for financial entities.

Read the full entry : DORA

Guidance & supervisory instruments

EDPB guidelines

Guidelines and opinions adopted by the European Data Protection Board to ensure consistent application of the GDPR.

Read the full entry : EDPB guidelines

Laws & regulations

EMA requirements

EU requirements for medicines coordinated by the European Medicines Agency, covering authorisation, pharmacovigilance and clinical trials.

Read the full entry : EMA requirements

Jurisdictions

EMEA (EMEA)

Europe, the Middle East and Africa: the EU and its member states, the UK, the Gulf states and African markets.

Read the full entry : EMEA

Industries & activities

Environmental

Environmental compliance across industries: air emissions, water quality, waste disposal, hazardous materials and climate reporting.

Read the full entry : Environmental

Laws & regulations

EU AI Act

The EU Artificial Intelligence Act (2024/1689), a risk-based regulation of AI systems, with obligations phasing in from 2025.

Read the full entry : EU AI Act

Jurisdictions

European Union

A union of 27 member states with a multi-level model: EU authorities write rules and standards, national regulators enforce them.

Read the full entry : European Union

Supervision & examination

Examination

A supervisor’s structured review of a firm, requesting evidence that controls operated as required over a period.

Read the full entry : Examination

Guidance & supervisory instruments

FCA Handbook guidance

Guidance in and alongside the UK Financial Conduct Authority Handbook, including guidance provisions, finalised guidance and Dear CEO letters.

Read the full entry : FCA Handbook guidance

Kinds of authority

Federal regulator

A national-level regulator in a federal system such as the United States or Canada, operating alongside state or provincial authorities.

Read the full entry : Federal regulator

Laws & regulations

FERC regulations

Regulations of the US Federal Energy Regulatory Commission for interstate electricity, gas and oil pipelines, in Title 18 of the CFR.

Read the full entry : FERC regulations

Supervision & examination

FFIEC

The US Federal Financial Institutions Examination Council, which sets uniform examination principles and publishes examination manuals for US financial institutions.

Read the full entry : FFIEC

Industries & activities

Fintech

Technology-led financial services providers, often operating through licences, partnerships or banking-as-a-service.

Read the full entry : Fintech

Laws & regulations

GDPR (GDPR)

The EU General Data Protection Regulation (2016/679), the main EU law on personal data, applying since May 2018.

Read the full entry : GDPR

Laws & regulations

GENIUS Act

The US federal framework for payment-stablecoin issuers, covering reserves, disclosures, redemption and federal and state chartering.

Read the full entry : GENIUS Act

Foundations

GRC (GRC)

Governance, risk and compliance: the software category, and the discipline, of managing policies, risks, controls and compliance obligations across an organisation.

Read the full entry : GRC

Laws & regulations

HIPAA (HIPAA)

The US Health Insurance Portability and Accountability Act of 1996, best known for its privacy, security and breach notification rules for health information.

Read the full entry : HIPAA

Foundations

Impact note

A short analysis of how a regulatory change affects an organisation’s obligations and controls, usually with proposed changes for the owner to approve.

Read the full entry : Impact note

The five layers

Industry standard (Layer 5)

A framework published by a standards body that becomes a requirement through regulation, contract, audit or supervisory expectation. The fifth layer.

Read the full entry : Industry standard

Standards & frameworks

ISO accreditation

Formal recognition by a national accreditation body that a laboratory, certification or inspection body is competent under the relevant ISO standard.

Read the full entry : ISO accreditation

Standards & frameworks

ISO/IEC 27001 (ISO 27001)

The international standard for information security management systems, against which organisations can be certified.

Read the full entry : ISO/IEC 27001

Controls & evidence

KYB (KYB)

Know your business: verifying the identity, ownership and risk of legal-entity customers.

Read the full entry : KYB

Controls & evidence

KYC (KYC)

Know your customer: verifying the identity of individual customers and assessing their risk.

Read the full entry : KYC

Industries & activities

Lending

Extending credit, an activity that triggers fair lending, disclosure, licensing and prudential obligations.

Read the full entry : Lending

Laws & regulations

MiCA (MiCA)

The EU Markets in Crypto-Assets Regulation, regulating crypto-asset issuers and service providers across the EU.

Read the full entry : MiCA

Jurisdictions

Middle East

A region where law is made by assemblies, royal decrees and ministerial councils, and financial free zones run their own regimes.

Read the full entry : Middle East

Laws & regulations

MiFID II (MiFID II)

The EU Markets in Financial Instruments framework for investment firms and trading venues, with its companion regulation MiFIR.

Read the full entry : MiFID II

Jurisdictions

New York

A US state whose financial regulator, NYDFS, sets influential rules for banks, insurers and virtual currency firms.

Read the full entry : New York

Standards & frameworks

NIST SP 800 series

NIST’s Special Publications on computer security, including SP 800-53 security controls and SP 800-171 for controlled unclassified information.

Read the full entry : NIST SP 800 series

Controls & evidence

Obligation

A specific, citable requirement extracted from a statute, regulation, guidance, supervisory expectation or standard.

Read the full entry : Obligation

Guidance & supervisory instruments

OCC bulletins

Bulletins published by the Office of the Comptroller of the Currency to communicate guidance, rule changes and supervisory expectations to national banks.

Read the full entry : OCC bulletins

Guidance & supervisory instruments

OPC guidance

Guidance from Canada’s Office of the Privacy Commissioner on applying PIPEDA and federal privacy law.

Read the full entry : OPC guidance

Guidance & supervisory instruments

OSFI guidelines

Guidelines issued by Canada’s Office of the Superintendent of Financial Institutions setting prudential expectations for federally regulated financial institutions.

Read the full entry : OSFI guidelines

Industries & activities

Payments (activity)

Initiating, processing or settling payments for others, an activity that triggers licensing, safeguarding and AML duties wherever it is performed.

Read the full entry : Payments (activity)

Standards & frameworks

PCI DSS (PCI DSS)

The Payment Card Industry Data Security Standard, required by card brands for anyone storing, processing or transmitting cardholder data.

Read the full entry : PCI DSS

Controls & evidence

PEP (PEP)

Politically exposed person: someone in a prominent public function, or their family and close associates, requiring enhanced due diligence.

Read the full entry : PEP

Controls & evidence

Permit condition

A binding operating limit attached to an environmental or safety permit, setting thresholds, monitoring frequencies and reporting duties.

Read the full entry : Permit condition

Laws & regulations

PIPEDA (PIPEDA)

Canada’s Personal Information Protection and Electronic Documents Act, the federal private-sector privacy law.

Read the full entry : PIPEDA

Compliance areas

Privacy

Rules on collecting, using, sharing and protecting personal information, and on individuals’ rights over it.

Read the full entry : Privacy

Kinds of authority

Provincial regulator

A regulator operating at Canadian provincial level, such as a securities commission, utility board, insurance regulator or privacy commissioner.

Read the full entry : Provincial regulator

Foundations

RegTech

Regulatory technology: the use of software, data and AI to meet regulatory requirements more efficiently and effectively than manual processes.

Read the full entry : RegTech

The five layers

Regulation (Layer 2)

A binding, detailed rule made by an agency under powers granted by statute. The second of the five layers.

Read the full entry : Regulation

Laws & regulations

Regulation B

The US consumer financial regulation (Equal Credit Opportunity) that implements the Equal Credit Opportunity Act, prohibiting discrimination in any aspect of a credit transaction.

Read the full entry : Regulation B

Laws & regulations

Regulation C

The US consumer financial regulation (Home Mortgage Disclosure) that implements the Home Mortgage Disclosure Act, requiring many lenders to collect and report mortgage lending data.

Read the full entry : Regulation C

Laws & regulations

Regulation DD

The US consumer financial regulation (Truth in Savings) that implements the Truth in Savings Act, requiring clear disclosure of deposit account terms.

Read the full entry : Regulation DD

Laws & regulations

Regulation E

The US consumer financial regulation (Electronic Fund Transfers) that implements the Electronic Fund Transfer Act, protecting consumers who use electronic payments.

Read the full entry : Regulation E

Laws & regulations

Regulation P

The US consumer financial regulation (Privacy of Consumer Financial Information) that implements the privacy provisions of the Gramm-Leach-Bliley Act for consumer financial information.

Read the full entry : Regulation P

Laws & regulations

Regulation V

The US consumer financial regulation (Fair Credit Reporting) that implements the Fair Credit Reporting Act for those who furnish and use consumer report information.

Read the full entry : Regulation V

Laws & regulations

Regulation X

The US consumer financial regulation (Real Estate Settlement Procedures) that implements the Real Estate Settlement Procedures Act for mortgage settlement and servicing.

Read the full entry : Regulation X

Laws & regulations

Regulation Z

The US consumer financial regulation (Truth in Lending) that implements the Truth in Lending Act, requiring clear disclosure of credit terms and costs.

Read the full entry : Regulation Z

Foundations

Regulatory ecosystem

The layered network of lawmakers, regulators, supervisors, standard-setters and professional bodies that together shape what a regulated organisation must do.

Read the full entry : Regulatory ecosystem

The five layers

Regulatory guidance (Layer 3)

Published explanations of how an authority expects its rules to be met. The third layer: often not law, but routinely what examiners check.

Read the full entry : Regulatory guidance

Foundations

Regulatory intelligence model

The set of linked data fields a regulatory intelligence platform captures for every obligation: jurisdiction, industry, sub-industry, activity, authority, authority type, regulation, guidance, controls and enforcement actions.

Read the full entry : Regulatory intelligence model

Regulatory powers

Regulatory powers

The set of things an authority is legally able to do: make law, write rules, examine, license, fine, revoke, set standards and refer for prosecution.

Read the full entry : Regulatory powers

Foundations

Regulatory relationship chain

The ten linked steps from where a business operates to the proof that it complied: jurisdiction, industry, activity, regulator, regulation, requirement, guidance, control, audit evidence and enforcement action.

Read the full entry : Regulatory relationship chain

Supervision & examination

Risk assessment

A structured evaluation of the risks a firm faces, used by supervisors to set intensity and by firms to prioritise controls.

Read the full entry : Risk assessment

Compliance areas

Safety

Rules protecting workers, users and the public from harm caused by products, processes and operations.

Read the full entry : Safety

Enforcement

Sanctions

Restrictive measures imposed by governments on countries, entities or individuals; also, penalties imposed by authorities for violations.

Read the full entry : Sanctions

Controls & evidence

SAR / STR (SAR)

Suspicious activity report or suspicious transaction report: a confidential report to the financial intelligence unit when there are reasonable grounds to suspect crime.

Read the full entry : SAR / STR

Standards & frameworks

SOC 2 (SOC 2)

An AICPA attestation report on a service organisation’s controls relevant to security, availability, processing integrity, confidentiality and privacy.

Read the full entry : SOC 2

Standards & frameworks

SOC frameworks (SOC)

The AICPA’s System and Organization Controls reporting frameworks: SOC 1 for financial reporting controls, SOC 2 for security and related criteria, and SOC 3 for general use.

Read the full entry : SOC frameworks

Industries & activities

Stablecoin

A crypto asset designed to hold a stable value, usually against a fiat currency, regulated under MiCA, the GENIUS Act and state regimes.

Read the full entry : Stablecoin

Kinds of authority

State regulator

A regulator operating at US state level, such as a banking, insurance or securities department, attorney general or privacy agency.

Read the full entry : State regulator

The five layers

Statutory law (Layer 1)

Law passed by a legislature. The first of the five layers: it sets the legal frame and usually delegates the detail to regulators.

Read the full entry : Statutory law

Kinds of authority

Supervisory authority

A body that monitors regulated firms through examinations, reviews and risk assessments, often shaping expectations more than the underlying law.

Read the full entry : Supervisory authority

The five layers

Supervisory expectation (Layer 4)

What supervisors and examiners look for in practice, set out in examination manuals, supervisory reviews and statements rather than in law. The fourth layer.

Read the full entry : Supervisory expectation

Foundations

SupTech

Supervisory technology: the regulator-side counterpart of RegTech, used by supervisors to collect data, monitor firms and analyse risk.

Read the full entry : SupTech

Controls & evidence

Travel Rule

FATF Recommendation 16: originator and beneficiary information must travel with transfers, including virtual-asset transfers.

Read the full entry : Travel Rule

Compliance areas

UDAAP (UDAAP)

Unfair, deceptive or abusive acts or practices: the US consumer protection standard enforced by the CFPB under the Dodd-Frank Act.

Read the full entry : UDAAP

Laws & regulations

UK GDPR (UK GDPR)

The UK’s retained version of the GDPR, which, with the Data Protection Act 2018, governs personal data in the UK after Brexit.

Read the full entry : UK GDPR

Industries & activities

VASP (VASP)

Virtual asset service provider: FATF’s term for businesses that exchange, transfer, hold or issue virtual assets for others; in the EU, a crypto-asset service provider (CASP).

Read the full entry : VASP
Request early access →