Glossary

46 terms, defined plainly.

10-K: The annual report an SEC registrant files, with audited financial statements, risk factors, legal proceedings and exhibits including a subsidiaries list.
8-K: The current report an SEC registrant files within four business days of specified events, such as material agreements, officer departures, bankruptcy or a material cybersecurity incident.
Accredited certification body: A firm authorised by a national accreditation body (for example UKAS, ANAB, JAB, SAC, JAS-ANZ) to certify organisations against a management-system standard. Certificates can be checked with the body or through IAF CertSearch.
Attestation vs certification: An attestation (such as SOC 2) is an auditor's report on controls, issued by a CPA firm for restricted use. A certification (such as ISO 27001) is a certificate issued by an accredited certification body after audit, with a public scope statement.
CAIQ: The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire, a free questionnaire mapped to the Cloud Controls Matrix; a completed CAIQ can be published on the CSA STAR registry.
Charge (security): A security interest granted by a company over its assets to a lender, registered at the company registry or a personal-property securities register. A new charge signals secured borrowing and lender priority.
CIK (Central Index Key): The SEC's identifier for an EDGAR filer, up to ten digits. It identifies filers, including private companies that file Form D, not every US company.
Data room: A controlled repository of confidential documents shared with named individuals under confidentiality terms, with access logging and versioning; used in procurement and transactions.
Director disqualification: A court or regulatory order barring a person from acting as a company director for a period. The UK, Australia, Singapore and others keep searchable registers of disqualified persons.
EDINET: Japan's Electronic Disclosure for Investors' NETwork, the Financial Services Agency's system for securities reports and other disclosure documents by listed and reporting companies.
Entity resolution: The process of deciding whether a record refers to the company being checked rather than a same-name or related company, using identifiers, addresses, officers and dates.
EU AI Act: Regulation (EU) 2024/1689, which classifies AI systems by risk and imposes obligations on providers and deployers in stages; the 2026 AI Omnibus moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028.
Evidence chain: The set of fields attached to every claim in a dossier: source, original location, document date, retrieval date, entity match, verification status and contradictions.
False positive (screening): A screening hit that, on checking secondary identifiers such as date of birth, nationality or registration number, does not refer to the person or entity being screened. Cleared hits are recorded, not deleted.
Form D: The notice an issuer files with the SEC after selling securities in an exempt offering under Regulation D. It names officers and directors and states amounts offered and sold; it carries no financial statements or valuation.
Form D amount sold: Item 13 of Form D: the total value of securities sold as at the filing date, distinct from the total offering amount. It is the only money figure on the form that describes what has actually happened.
Gazette notice: An entry in an official gazette (for example the London, Edinburgh and Belfast Gazettes, Singapore's Government Gazette or Japan's 官報) giving legal notice of events such as insolvency, capital changes, dissolution or statutory demands.
GEO (generative engine optimisation): The practice of making a company's facts accurate, consistent and machine-readable so that AI assistants describe it correctly and cite authoritative sources. Done honestly, it is record-keeping, not promotion.
HKEXnews: The Hong Kong Exchanges and Clearing disclosure site for announcements, circulars, results and shareholding disclosures of companies listed in Hong Kong.
Insolvency notice: A public notice that a company is subject to a winding-up petition, administration, liquidation, bankruptcy or similar process, published in an official gazette, a regulator's notice site or a court docket.
ISO/IEC 27001: The international standard for an information security management system, currently the 2022 edition with 93 Annex A controls. Certification is issued by accredited certification bodies on a three-year cycle.
ISO/IEC 27701: The international standard for a privacy information management system. The 2025 second edition is a standalone management-system standard; the 2019 edition was an extension to ISO 27001.
ISO/IEC 42001: The 2023 international standard for an AI management system, covering AI policy, impact assessment, lifecycle controls, data and third-party relationships. Certifiable by accredited bodies.
KYB (know your business): The verification of a business counterparty: legal existence, identifiers, ownership, control and sanctions status, usually as part of onboarding.
KYC (know your customer): The verification of an individual customer's identity and risk profile under anti-money-laundering rules; KYB is the business-entity counterpart.
LEI (Legal Entity Identifier): A twenty-character ISO 17442 code for legal entities, issued by accredited operators under GLEIF and renewed annually. Voluntary, and held mainly by financial-market participants.
llms.txt: A proposed convention for a Markdown file at /llms.txt that points AI systems to canonical versions of a site's key pages. Adoption by major assistants is not confirmed; it is a low-cost supplement to ordinary pages.
MCP (Model Context Protocol): An open protocol through which AI assistants and agents call external tools and data sources, such as a server that returns a company's verified profile.
MOPS: Taiwan's Market Observation Post System, operated by the Taiwan Stock Exchange, carrying financial reports, material information and shareholder data for listed and OTC companies.
NIST AI RMF: The US National Institute of Standards and Technology's voluntary AI Risk Management Framework (version 1.0, 2023), organised into Govern, Map, Measure and Manage, with a Generative AI Profile (NIST AI 600-1, 2024).
NSM (FCA National Storage Mechanism): The UK Financial Conduct Authority's repository of regulated information published by issuers, including annual reports and regulatory announcements.
PSC register: The UK register of people with significant control, public on Companies House, listing individuals and entities holding more than 25% of shares or votes or otherwise controlling a company.
Retrieval date: The date on which a source was last read for a claim. It is the freshness anchor of a dossier and is distinct from the date of the document itself.
Right of reply: The ability of a company to respond to a record in its dossier through its claimed profile. The reply is dated, attributed and shown alongside the record; it does not remove the record.
Romanisation: Writing a Chinese, Japanese or Korean name in Latin letters. Different systems (Hanyu Pinyin, Wade-Giles, Tongyong, Hepburn, Kunrei) produce different spellings for the same name, so romanised forms are treated as aliases.
Sanctions 50% rule: OFAC's guidance that an entity owned 50% or more, in aggregate, by one or more blocked persons is itself blocked even if not listed. The EU and UK apply similar ownership-and-control concepts with their own thresholds.
schema.org: A shared vocabulary for structured data embedded in web pages. The Organization type lets a company publish its legal name, address, identifiers (such as LEI) and sameAs links in machine-readable form.
SEDAR+: The Canadian Securities Administrators' system for continuous disclosure filings by Canadian reporting issuers, which replaced SEDAR in 2023.
Share of voice (AI): A monitoring metric: how often a company appears in AI assistants' answers to category questions compared with named competitors. Secondary to answer accuracy.
SIG (Standardized Information Gathering): A licensed third-party risk questionnaire maintained by Shared Assessments and updated annually, issued in Core and Lite forms and scoped to the services bought.
SOC 2 Type I / Type II: AICPA attestation reports on a service organisation's controls against the Trust Services Criteria, issued by CPA firms. Type I covers control design at a point in time; Type II covers design and operating effectiveness over a period.
UBO (ultimate beneficial owner): The natural person who ultimately owns or controls a company, looking through intermediate entities, trusts and nominees. Most regimes use a 25% threshold of shares or votes plus a control test.
UEN (Unique Entity Number): Singapore's standard identifier for entities registered with ACRA and other issuing agencies; nine or ten characters.
XBRL: A structured tagging format for financial statements. SEC registrants file Inline XBRL, which feeds the SEC's companyfacts and frames APIs for machine-readable financial data.
法人番号 (Corporate Number): Japan's thirteen-digit identifier for corporations, assigned by the National Tax Agency and searchable free with name and head-office address.
統一編號 (Unified Business Number): Taiwan's eight-digit identifier for companies and businesses, used on invoices, tax filings and the MOEA business registry.