Glossary
Bank diligence & compliance terms, in plain English.
The vocabulary that shows up in bank DDQs, sponsor-bank reviews, and vendor security questionnaires — defined once, so every team answering them uses the same language. 23 terms.
- Bank DDQ (Due Diligence Questionnaire)
- A structured set of questions a bank or regulated partner sends to assess a fintech’s compliance, security, risk, and operational controls before approving a relationship.
- Sponsor bank diligence
- The review a chartered bank performs before providing a fintech or PayFac access to payment rails, covering information security, AML, vendor risk, and regulatory controls.
- Security questionnaire
- A recurring questionnaire covering SOC 2, PCI, encryption, access control, BCP/DR, and incident response that a buyer or partner sends before onboarding a vendor.
- RFP / RFI response
- A formal request for proposal or information, often including security and compliance sections that require evidence-backed answers.
- Approved Answer Memory
- A reusable library of previously approved answers, citations, source documents, approval history, and freshness status — so similar questions are answered faster next time.
- SOC 2
- An independent audit report assessing a service organization’s controls over security, availability, and confidentiality.
- PCI DSS
- The Payment Card Industry Data Security Standard governing how organizations that handle cardholder data protect it.
- AML/KYC
- Anti-money-laundering and know-your-customer controls used to verify identity and detect illicit activity.
- FFIEC-aligned risk review
- A review of IT and information-security controls aligned to the risk areas in the FFIEC IT Examination Handbook that bank examiners commonly assess.
- SOC 2 Type I vs Type II
- A Type I report assesses whether controls are suitably designed at a single point in time. A Type II report additionally tests whether those controls operated effectively across a review period, commonly three to twelve months. Banks typically ask for Type II.
- ISO/IEC 27001
- An international standard for establishing and maintaining an information security management system (ISMS). Certification is issued by an accredited body following an external audit.
- DORA (Digital Operational Resilience Act)
- Regulation (EU) 2022/2554, which applies to EU financial entities from 17 January 2025. It sets requirements for ICT risk management, ICT-related incident reporting, digital operational resilience testing, and oversight of third-party ICT service providers.
- PSD2
- The second EU Payment Services Directive (Directive (EU) 2015/2366), which governs payment services across the EEA and introduced strong customer authentication and regulated third-party access to payment accounts.
- GDPR Article 33
- The GDPR provision requiring a controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
- Data Processing Agreement (DPA)
- The contract required under GDPR Article 28 between a controller and a processor, setting out the subject matter, duration, nature, and purpose of processing, and the processor’s obligations including subprocessor use and security measures.
- TPRM (Third-Party Risk Management)
- The program by which an organization identifies, assesses, monitors, and remediates risks introduced by vendors, service providers, and other third parties across the relationship lifecycle.
- NIST Cybersecurity Framework (CSF)
- A voluntary framework published by the US National Institute of Standards and Technology, organized around core functions — Identify, Protect, Detect, Respond, and Recover, with Govern added in CSF 2.0 — used to structure and communicate cybersecurity risk.
- SIG (Standardized Information Gathering) questionnaire
- A standardized third-party risk assessment questionnaire maintained by Shared Assessments, used by many financial institutions in place of a bespoke security questionnaire.
- CAIQ
- The Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire, a standardized set of questions mapped to the Cloud Controls Matrix for assessing cloud service providers.
- BCP / DR
- Business continuity planning and disaster recovery — the documented plans and tested procedures for maintaining or restoring operations during and after a disruptive event, commonly evidenced by recovery time and recovery point objectives.
- Penetration test
- An authorized, simulated attack against systems or applications, performed to identify exploitable vulnerabilities. Banks commonly ask for a report dated within the last twelve months.
- Stale evidence
- Compliance evidence that is still on file but no longer current — an expired policy, a lapsed certification, or a penetration test older than the reviewing party accepts. Submitting it is a common cause of diligence rework.
- Subprocessor
- A third party engaged by a processor to carry out part of the processing on a controller’s behalf. Under GDPR Article 28 their use requires the controller’s authorization and equivalent contractual protections.
Have a live DDQ or security questionnaire?
See which of your existing evidence already answers it — and what a reviewer would flag before it ships.
Check DDQ readiness