Glossary
Ce contenu n’est pas encore disponible dans votre langue.
Terms are listed alphabetically. Where a page explains a term fully, the definition links to it.
Account event: Something that happens to a customer’s account that isn’t a payment, such as a sign-in, a failed one-time code or PIN, a SIM swap or a profile change. Real-time rules use them to spot account takeover. See Account events.
Active version: The version of a rule whose hits create alerts or decisions. A rule has at most one. See Rules and versions.
Adverse media: Negative news about a person or business — fraud allegations, corruption, criminal charges. One of the risk designation types.
Agent: A shop or individual that takes cash in and pays cash out on behalf of a mobile money operator. Agents are a common place for cash to enter the system, so they have their own rules — see G. Mobile money and agents.
Alert: A notice that one or more rules matched for the same customer, account or counterparty, waiting for a person to review it. An alert is either dismissed with a disposition or moved into a case. See Alerts and cases.
Alert queue: The open alerts, ordered riskiest first: by severity, then score. See Alerts and cases.
AML — anti-money laundering: The laws, controls and processes that stop criminals from disguising the proceeds of crime as legitimate money. See What is transaction monitoring?
API key: A secret that lets one of your systems — not a person — talk to SpeculaPro, for example to send transactions. Each key has scopes that limit what it can do. See the security model.
AI assistant: An optional helper that reads an open alert and says whether it looks like a false positive or needs investigating, with its reasons. On a case it writes a short summary for whoever picks the case up and suggests what to do next (a false positive, a report to consider, more investigation, or not enough to tell). A person can ask about one alert or case, or about the whole queue in a batch. On a draft STR or SAR made from a case it drafts the narrative, for the person writing the report to correct and sign. On a rule it reads how the rule’s alerts ended and suggests settings worth testing in a backtest. It only advises: a person decides, and nothing happens to the alert or the case. Off until a workspace switches it on. See AI assistant.
Audit log: The permanent, append-only record of every change and every sensitive action. See Audit trail.
Anomaly score: A number from 0 to 1 saying how unusual a transaction is compared with a workspace’s own recent transactions. About 0.5 is ordinary; closer to 1 is more unusual. Rules can read it; it decides nothing by itself. See Risk models.
Analytics store: An optional second database (ClickHouse) holding a copy of transactions, decisions, rule hits, alerts and cases, for questions that span many months. The main database stays the record that counts, and the copy can always be rebuilt from it. See Analytics store.
Backfill: Copying history that already exists into a store that was set up later, as speculapro analytics backfill does for the analytics store.
Backtesting: Running a rule version over past transactions to see how many hits and alerts it would have produced, and on whom, compared with the live version, before it is approved. A scheduled rule is tested by simulating every run of its schedule and comparing it with what the rule actually raised. See Backtesting.
Base currency: The currency a workspace reports in — GHS for a Ghanaian institution. Every amount is also stored converted to it. See Money and currencies.
BCEAO: Banque Centrale des États de l’Afrique de l’Ouest, the central bank of the eight UEMOA states. It sets their AML/CFT thresholds and e-money rules.
Blind index: A way of searching for an encrypted value (a phone number, a Ghana Card number) without decrypting anything. See the security model.
Break-glass administrator: An administrator who keeps a SpeculaPro password and authenticator app when the workspace requires single sign-on, so someone can still get in if the identity provider fails. See Single sign-on.
BVN (Bank Verification Number): Nigeria’s 11-digit biometric identifier for bank customers, run by the CBN and NIBSS. Send bvn_verified: true once validated. See Jurisdiction attributes.
camt.053: The ISO 20022 bank-to-customer statement: what was booked on an account. SpeculaPro reads it as transactions. See ISO 20022 files.
Case: A file for investigating one customer, account or counterparty, holding its alerts, comments and decisions on a permanent timeline. Numbered like SP-2026-000123. See Alerts and cases.
Case timeline: The permanent record of everything that happened to a case: comments, assignments, escalations, alerts joining, closure and approvals. Nobody can edit it; the one exception is the erasure of a customer under data protection law, which removes the free text from their closed cases’ entries. See Alerts and cases.
CDC — change data capture: Following the inserts, updates and deletes a database records, and turning them into a feed. SpeculaPro uses it to read a core-banking database without the institution building an integration. See Change data capture.
Cell: One region’s complete, independent SpeculaPro installation on a multi-region service: its own database, queue, cache and application. See Data residency and regions.
CEL — Common Expression Language: The small, safe language SpeculaPro rules are written in. It cannot loop forever or touch anything outside the data it is given. See Rule engine.
CENTIF: Cellule nationale de traitement des informations financières, the financial intelligence unit of each UEMOA state and of Guinea. It receives suspicious transaction reports (DOS) and cash transaction reports (DTE).
CFT — countering the financing of terrorism: The companion to AML: stopping money reaching terrorist groups. Often written together as AML/CFT.
Change request: A sensitive change waiting for a second person’s approval, with the maker’s reason and the before and after. It is applied only when someone else approves it, and expires after 7 days. See Approvals.
Chargeback: A card payment reversed by the card issuer, usually because the cardholder disputed it.
ClickHouse: An open-source database built for adding up very large numbers of rows quickly. SpeculaPro can use it as its optional analytics store.
Clearance (screening): A reviewer’s decision that a potential match is a false positive. See Reviewing a potential match.
Counterparty: The other side of a transaction — the person or business your customer paid or was paid by. Often not your customer.
CTR — cash transaction report: A report to the FIU of a cash transaction above a set amount, required whether or not anything looks suspicious. SpeculaPro can draft them daily: see Cash transaction reports.
Custom role: A role your workspace defines itself, with exactly the permissions a job needs, often cloned from a built-in role. See Custom roles.
Data protection officer (DPO): The person responsible for an institution’s compliance with data protection law. In SpeculaPro, the built-in role that runs the Privacy area. See Data protection.
Data residency: The requirement, or the choice, that data is stored and processed in a particular country or region. See Data residency and regions.
Data subject request (DSR): A request from a person to see, correct, erase, restrict, object to or take away their personal data, with a legal deadline. See Data subject requests.
Dead-letter topic (DLQ): Where a record that couldn’t be processed is set aside, unchanged and with the reasons, instead of blocking everything behind it or being lost. See Kafka topics.
Debezium: An open-source tool, run on Kafka Connect, that publishes a database’s changes to Kafka topics as change events. SpeculaPro reads those topics as a cdc data source. See Change data capture.
Degraded decision: A real-time decision SpeculaPro couldn’t complete within the workspace’s time budget, for example because a dependency was slow. The workspace’s fail-open or fail-closed policy gives the answer instead, and the answer says so. See Real-time decisions.
Decision API: The real-time endpoint your system calls before completing a payment, which answers allow, step_up, review or block. See Real-time decisions.
Delisted: Removed from a sanctions list. A potential match on an entry that has left its list is marked delisted. See Potential matches.
Deprovisioning: Taking away someone’s access when they leave or change jobs. With SCIM, your identity provider does it for you: the SpeculaPro account is deactivated and its sessions end.
Designation: See risk designation.
Directory: On a multi-region service, the small global look-up that knows which region each workspace is in. It holds workspace slugs and regions, and no personal data.
Disposition: The outcome recorded when an alert is dismissed (false positive, no action, duplicate) or a case is closed (false positive, true positive with no report, report filed, customer exited, duplicate, or other). See Choosing a disposition.
DOS — déclaration de soupçon: The suspicious transaction report filed with a CENTIF in the UEMOA states and Guinea. See Filing with a CENTIF.
Dormant account: An account with no activity for a long period. Sudden activity on one is a classic warning sign — see C. Velocity and behaviour change.
Drift: A model’s recent transactions no longer looking like the ones it was trained on, so its scores shift. Measured with the population stability index. See Risk models.
DTE — déclaration de transaction en espèces: The cash transaction report filed with a CENTIF (called DSTE in Côte d’Ivoire). See Filing with a CENTIF.
E.164: The international phone number format: a plus sign, the country code and the number, with no spaces or leading zero, such as +233244123456.
Entity: Anything SpeculaPro keeps records about: a customer, account, counterparty or device.
Escalation: Moving a case up to a more senior level: analyst (1), then senior analyst (2), then MLRO (3). Escalating raises the case’s priority and restarts its deadline. A person escalates a case, or its escalation policy does when a deadline passes. See Escalation and SLAs.
Escalation policy: A workspace setting that says where a kind of case goes: the level it opens at, the team and the time each level has, whether a missed deadline escalates it by itself, and whether closing it needs a second person. A new case follows the first policy in use that fits it. See Escalation policies.
External id: Your system’s own reference for a transaction or customer. SpeculaPro uses it to recognise and ignore duplicates.
Fail open / fail closed: What a workspace wants when a real-time decision can’t be completed in time. Fail open lets the payment through (allow); fail closed holds it for a person (review). Set under Settings → Workspace. See Workspace settings.
False positive: An alert that turns out, after investigation, not to be suspicious. Every monitoring programme has them; tuning rules to reduce them without missing real cases is ongoing work.
Failover: Switching to a standby when a system fails. A SpeculaPro region fails over inside itself, never to another region.
Fan-in / fan-out: Fan-in: many different senders paying one account. Fan-out: one account paying many different recipients. Both are typical of money mules. See D. Mule and network patterns.
False positive (screening): A potential match that turns out to be a different person or organisation with a similar name. Most potential matches are false positives. Clearing one puts the pair on the good-guy list.
FATF — Financial Action Task Force: The international body that sets AML/CFT standards and publishes lists of high-risk jurisdictions.
Feature: A pre-computed figure a rule can ask for, such as “total cash-in for this account over 7 days”. See Feature store.
FIA: Financial Intelligence Agency, the name the Sierra Leone and Liberia jurisdictions use for each country’s financial intelligence unit (Sierra Leone’s name is to verify with counsel).
FIC — Financial Intelligence Centre: Ghana’s financial intelligence unit. It receives STRs and CTRs.
File drop: A directory on an SFTP server, or a bucket prefix, where your systems leave files for SpeculaPro to collect on a schedule. See File drops.
FIU — financial intelligence unit: The national agency that receives suspicious transaction reports. In Ghana, the FIC.
4-eyes (four-eyes) principle: A rule that an important action needs two different people: one to do it and one to approve it. Also called maker-checker. SpeculaPro enforces it for rule versions, suppressions, closing high and critical cases, and reports, and your workspace can require it for sensitive administrative changes too. See Approvals.
FX rate: The exchange rate used to convert an amount into the base currency. Stored with every converted amount.
FRC — Financial Reporting Centre: Kenya’s financial intelligence unit, which receives suspicious and cash transaction reports.
Good-guy list: The record of cleared false positives. A customer and list entry on it are not raised again until the list entry or the customer’s screened details change.
goAML: The reporting software, built by the United Nations Office on Drugs and Crime, that many FIUs — including Ghana’s FIC — use to receive reports. SpeculaPro exports reports as goAML XML. See Filing with goAML.
GOWA: go-whatsapp-web-multidevice, a small server you run yourself that holds a WhatsApp session for one phone number. SpeculaPro sends WhatsApp notifications through it. See WhatsApp through GOWA.
Held (alert or subject): An alert that always calls for a person’s own look: a sanctions alert, a critical alert, or an alert whose subject is designated PEP, relative or close associate of a PEP, or sanctioned (for an account, where the customer who owns it is). A held alert has no tick box in the queue and is never closed in bulk, and the AI assistant never calls it a false positive. In the API it is held: true on the alert. Advice of likely false positive given before an alert became held is no longer shown as current: the page marks it no longer stands (superseded in the API) and the assistant is asked about the alert again. A case is held when it is a sanctions case, is critical, is about a held subject, or holds a held alert: the assistant’s likely false positive never stands on a held case.
Hit: One rule matching once. Hits are grouped into alerts.
IdP (identity provider): The system that holds your staff’s work accounts and signs them in, such as Microsoft Entra ID, Okta, Google Workspace, Keycloak or ADFS.
ISO 20022: The international standard for payment messages, used by banks and interbank systems such as GhIPSS. See ISO 20022 files.
Jurisdiction: The country rules a workspace follows: FIU and report format, cash thresholds, identifier formats, FATF lists and recommended rule packs. See Jurisdictions.
KYC — know your customer: Identifying customers and understanding the activity to expect from them.
KYC tier: A level of identity checking, each allowing different transaction limits. Mobile money wallets in Ghana commonly have tiers, with low limits for minimal ID and higher limits once full ID is verified. See A. Thresholds and reporting.
Lawful basis: The legal ground for processing a category of personal data, such as a legal obligation (AML record keeping) or legitimate interests (fraud prevention). See Registers.
Inline screening: The check a real-time decision makes itself on the name of a counterparty it has no screening result for, against the sanctions lists held in memory. See A counterparty seen for the first time.
Installation list: A sanctions list kept once for the whole installation and the same for every workspace: the official lists, the national lists the operator imports, and provider feeds. Only the installation writes it. See Sanctions lists.
Isolation forest: The kind of model behind the anomaly score. It measures how few random yes-or-no questions it takes to single a transaction out from the rest: the fewer, the more unusual. It needs no examples of fraud to learn from.
Layering: The second stage of laundering: moving money through many transactions to hide its origin.
Legal hold: An instruction to keep data whatever its age, for litigation, an inspection or an investigation; the retention purge skips it. See Retention and legal holds.
List: A set of values — countries, merchant codes, accounts, devices — that rules check against. See Lists.
List version: One fetched or imported copy of a sanctions list, kept with its date, file fingerprint and what changed. See Sanctions lists.
Logical replication: PostgreSQL’s built-in way of sending the row changes of chosen tables (a publication) to another system. SpeculaPro reads it directly as a postgres_cdc data source.
LSN — log sequence number: A position in PostgreSQL’s write-ahead log. SpeculaPro stores the LSN up to which every change was dealt with (its checkpoint).
Maker-checker: Dual control: one person (the maker) proposes a change, and a different person (the checker) approves it before it takes effect. In SpeculaPro the proposal is a change request. See Approvals and 4-eyes principle.
MCC — merchant category code: A four-digit code describing a card merchant’s type of business. Some, such as gambling or money transfer, are higher risk.
Minor units: The smallest unit of a currency — pesewas for the cedi. GHS 12.50 is stored as 1,250. See Money and currencies.
Match threshold: The score, from 0.50 to 0.99, at or above which a screened name becomes a potential match. The default is 0.85. See How matching works.
Model card: The document kept with each risk model version: what it is, what it was trained on, what it is for and not for, its limits and who approved it. See The model card.
MLRO — money laundering reporting officer: The person legally responsible for deciding whether to report suspicious activity, and for the AML programme. Sometimes called the compliance officer.
MoMo: Mobile money — a wallet held on a mobile phone number, such as MTN MoMo, Telecel Cash or AT Money.
Mule (money mule): Someone whose account is used to receive and pass on criminal money, knowingly or not.
OFAC: The Office of Foreign Assets Control of the US Treasury, which publishes the US sanctions lists, including the SDN list.
OIDC (OpenID Connect): A modern standard for signing in through an identity provider, built on OAuth 2.0. One of the two single sign-on protocols SpeculaPro supports.
Pack (rule pack): A bundle of library rules for a country or sector, such as gh-psp. See the rule library.
pain.001: The ISO 20022 customer credit transfer initiation: payments a customer asked the bank to make. SpeculaPro reads them as outgoing, pending transfers. See ISO 20022 files.
Parameter: A tunable value in a rule — a threshold amount, a time window, a count. You change parameters, not the rule’s logic.
Pending approval: A case whose closure has been proposed and is waiting for a second person to approve or reject it. See Four-eyes closing.
PEP — politically exposed person: Someone who holds, or recently held, a prominent public role — a minister, senior judge, senior military officer, head of a state company. PEPs are not criminals, but their position makes them a higher bribery and corruption risk, so their transactions get extra scrutiny. See Risk designations.
PEP RCA: A relative or close associate of a PEP. Treated similarly.
Percentile (of a score): Where a transaction’s anomaly score falls among the scores of the transactions the model was trained on, from 0 to 100. 99 is the most unusual 1%.
Placement: The first stage of laundering: getting criminal cash into the financial system.
Post-event: Monitoring that runs after a transaction has completed. See What is transaction monitoring?
Potential match (hit): A customer or counterparty that looks like an entry on a sanctions or PEP list, with a score and an explanation. A question for a person to answer, not a finding. See Potential matches. To work one, see Reviewing a potential match.
POCAMLA: Kenya’s Proceeds of Crime and Anti-Money Laundering Act, 2009.
Precision (of a rule): Of the real-time decisions a rule took part in that were later labelled, the share that turned out to be fraud: fraud ÷ (fraud + legitimate). Low precision means the rule stops or delays many genuine payments. See Feedback and fraud labels.
Priority: How urgent a case is: low, medium, high or critical. It starts from the alert’s severity, rises one step with each escalation, and sets the case’s SLA deadline.
Privileged role: A role holding an administration, approval or security permission. SCIM gives or removes one only if the workspace allows it. See Privileged roles.
Provider: The organisation that runs SpeculaPro as a hosted service for institutions. A self-hosted installation has none.
Provider console: The separate web app the provider’s staff use to run a hosted service: workspaces, plans, notices, suspension and support access. It never shows what a workspace holds. See The provider console.
PSI — population stability index: A standard figure comparing two spreads of values, used to measure drift. Under 0.1 is stable; 0.1 to 0.25 is moderate; above 0.25 is significant.
Real-time: Monitoring that runs before a transaction completes and can stop it.
Real-time decision: SpeculaPro’s answer, before a payment goes ahead, on whether to allow it, ask for a step_up, hold it for review or block it, with the rules that led to it. See Real-time decisions.
Region: A place where a multi-region service runs, with a short key (such as gh) set by the operator. A workspace is pinned to one region.
Re-screen: Screening people again, either everyone or only those a list change could affect. See Screening settings.
Replication slot: PostgreSQL’s bookmark for one reader of its changes. The database keeps its write-ahead log from the slot’s position until the reader confirms it, so an abandoned slot fills the disk. See Postgres replication for DBAs.
Report indicator: A code from the FIU’s list saying why a report is filed, such as a typology or red flag. See Reporting settings.
Reporting entity ID (rentity_id): The number your FIU (the FIC in Ghana) gives each reporting institution in goAML. It is required on every report. See Reporting settings.
Retention category: A kind of data with its own retention period and end-of-period action, such as transactions, customer records or the audit log. See Retention and legal holds.
Rotation due: The mark on an API key whose creator has been deactivated while the key still works; cleared by rotating or revoking the key. See Managing API keys.
Risk designation: A flag on a customer or counterparty — PEP, sanctioned, high risk, adverse media, watchlist, or a custom type. See Risk designations.
Risk model: A model trained on one workspace’s transactions that gives each new transaction an anomaly score. See Risk models.
Risk rating: A customer’s overall risk level: unrated, low, medium, high or unacceptable.
Role: A named set of permissions given to users, such as Analyst or MLRO. See Roles and permissions.
SAML 2.0: An older, widely used standard for signing in through an identity provider by exchanging signed XML assertions. One of the two single sign-on protocols SpeculaPro supports.
Sanctions: Legal restrictions on dealing with named people, companies or countries, published by the UN, governments and others. Dealing with a sanctioned party is usually forbidden outright.
SAR — suspicious activity report: Another name for an STR, used in some countries.
Screening: Checking customers and counterparties against sanctions and PEP lists. See Sanctions and PEP screening.
Screening provider: A commercial or open data service your institution licenses for PEP and enhanced data. See Providers.
SCIM: System for Cross-domain Identity Management, a standard that lets an identity provider create, update and deactivate accounts in other systems. See SCIM provisioning.
SDN (Specially Designated Nationals): OFAC’s main sanctions list.
Score: A number expressing how risky a hit, alert or case is. Used to order queues and drive escalation.
Separation of duties: Keeping the person who does something important apart from the person who approves it, so no one person can act alone. SpeculaPro’s roles follow it, and warns when a role holds both sides. See Roles and permissions.
Severity: A rule’s own rating of how serious a match is: low, medium, high or critical.
Service notice: On the hosted service, a banner from SpeculaPro across the app: maintenance, an incident, or something needing attention.
SFTP: File transfer over SSH. SpeculaPro signs in with a key and checks the server’s pinned host key. See File drops.
Shadow model: A risk model version scoring real transactions with its scores recorded and hidden from every rule, before it may go live. Not the same as a rule’s shadow mode.
Shadow version: A rule version that runs on live data and records hits but never creates alerts — used to test a change safely. See Rules and versions.
SIM swap: Moving a phone number to a new SIM card. Fraudsters do it to receive a victim’s one-time codes and take over their wallet.
Single logout (SLO): Signing out in one place ending the session in the other. With SAML, signing out at your identity provider ends your SpeculaPro sessions, and the other way round. See Signing out.
SLA — service level agreement: Here, the deadline for working a case, set from its priority (by default 4 hours for critical up to 7 days for low), or from the case’s escalation policy when it gives the level its own time, and restarted when it is escalated or reopened. A deadline that passes is recorded on the case as Deadline missed. See Escalation and SLAs.
Smurfing: See structuring.
SSO (single sign-on): Signing in to SpeculaPro with your organisation’s work account at its identity provider instead of a separate password. See Single sign-on.
STR — suspicious transaction report: A report to the FIU that a transaction or pattern is suspected to involve crime. The main output of an AML programme. See Drafting an STR from a case.
Step-up: Asking the customer to prove it’s really them before a payment goes ahead, for example with a one-time code, 3-D Secure or a fingerprint. One of the four answers a real-time decision can give.
Structuring: Splitting money into amounts just below a reporting threshold to avoid a report — for example, several deposits of GHS 9,800 instead of one of GHS 49,000. Also called smurfing when several people do the depositing. See B. Structuring and smurfing.
Support access: On the hosted service, a time-limited, read-only look inside a workspace by SpeculaPro’s support staff, which someone in the workspace must approve first. See Support access.
Support session: The read-only session a member of SpeculaPro’s staff opens under an approved support access. Every read is in the audit log.
Suspended workspace: A workspace the provider has switched off access to on the hosted service. Its data is kept. See A suspended workspace.
Suppression: A time-limited, approved exception that stops known-good activity from creating alerts. See Suppressions.
Tenant: The technical name for a workspace. See Workspaces and tenancy.
Tipping off: Telling someone they are being investigated or have been reported. An offence.
Top-up (AI assistant calls): Calls a service provider adds to a workspace’s monthly AI assistant allowance for the current calendar month, unasked or in answer to a request from the workspace’s administrators. Available at once; unused ones do not carry over. See Adding calls for a month.
Tombstone: The permanent record kept when the provider deletes a workspace on schedule: which workspace, when, and the two members of staff who proposed and approved it.
Passkey: A way to sign in with your device’s own check (fingerprint, face or PIN) instead of a password and a code. The device holds a key that works only for your SpeculaPro address, so it can’t be typed into a fake page. See Passkeys.
Recovery code: One of ten single-use codes you are given when you set up your authenticator app. Each signs you in once, in place of the six-digit code, if you lose your phone. See Recovery codes.
TOTP: Time-based one-time password — the six-digit code from an authenticator app, used as a second step at sign-in.
True match: A potential match a reviewer confirmed as the listed party. It sets a risk designation and opens a case. See Reviewing a potential match.
Typology: A recognised pattern of laundering or fraud, such as structuring or mule networks. Rules are grouped by typology.
UEMOA: The West African Economic and Monetary Union (Benin, Burkina Faso, Côte d’Ivoire, Guinea-Bissau, Mali, Niger, Senegal, Togo), which shares the franc CFA and the BCEAO’s AML rules.
Velocity: How fast or how often something happens — transactions per hour, amount per day. Sudden changes are a warning sign.
Workspace: One institution’s private area in SpeculaPro, with its own users, rules, data and settings. See Workspaces and tenancy.
Workspace list: A watch list of your own, named import:<name>. Only your workspace sees it and screens against it; a workspace keeps at most 20. See Importing a list.