Glossary
Browse Glossary
Account Fraud
Account fraud is the unauthorized or fraudulent use of a bank account or account information to obtain a financial benefit for oneself or another person.
Typical examples are unauthorized transfers, the misuse of another person’s account details, and accounts opened under a false or stolen identity. Identity and account verification help detect and prevent account fraud at an early stage.
Account Information Service (AIS)
An Account Information Service (AIS) is a regulated payment service that, with the explicit consent of the payment service user, retrieves information from one or more of the user’s payment accounts.
This information includes account balances and transaction data. It is used, for example, for financial analyses, creditworthiness assessments and other digital financial services. AIS is defined in the EU Payment Services Directive (PSD2) and, in Austria, in the Payment Services Act (ZaDiG 2018).
Account Information Service Provider (AISP)
An Account Information Service Provider (AISP) is a regulated payment service provider that, with the explicit consent of the payment service user, accesses information from payment accounts held with banks or other account servicing payment service providers (ASPSPs).
An AISP connects to the account via secure interfaces (APIs) and retrieves data such as account balances and transactions. This data can then be used for creditworthiness checks or financial analyses, which eliminates the need to submit bank statements manually. In Austria, AISPs are registered with and supervised by the Financial Market Authority (FMA).
Account Servicing Payment Service Provider (ASPSP)
An Account Servicing Payment Service Provider (ASPSP) is a bank or other payment service provider that provides and maintains a payment account for a customer.
Under PSD2, ASPSPs must give authorized third-party providers (TPPs) secure access to their customers’ payment accounts, provided the customer has given consent. Access takes place through a dedicated interface, usually an API. ASPSPs authenticate their customers using Strong Customer Authentication (SCA).
Account Transaction Analysis
Account transaction analysis, also known as bank statement analysis, is the structured evaluation of account transactions to understand the financial situation and payment behavior of a person or company.
The analysis identifies and categorizes recurring income and expenses, existing financial obligations and regular payments. It is used primarily for creditworthiness and risk assessments, where it provides a more current picture than historical data alone.
Anti-Money Laundering (AML)
Anti-money laundering (AML) covers the legal, organizational and technical measures that prevent illegally obtained funds from entering the legitimate financial system or having their origin concealed.
AML measures include identifying and verifying customers (KYC), identifying the ultimate beneficial owner, risk assessments and the monitoring of business relationships and transactions. In Austria, the central legal basis for banks and financial institutions is the Financial Markets Anti-Money Laundering Act (FM-GwG). At EU level, the Anti-Money Laundering Regulation (AMLR) will apply from July 10, 2027.
Anti-Money Laundering Authority (AMLA)
The Anti-Money Laundering Authority (AMLA) is the EU authority for combating money laundering and terrorist financing, based in Frankfurt am Main.
AMLA was established by Regulation (EU) 2024/1620. It coordinates national supervisory authorities, issues technical standards and guidelines and will directly supervise a number of selected high-risk financial institutions. Together with the AMLR and the 6th Anti-Money Laundering Directive, it forms the EU’s new AML package.
Application Programming Interface (API)
An application programming interface (API) is a defined interface through which software systems exchange data and functions automatically, without manual intervention.
An API specifies which requests one system can send to another and in what format the response is returned. This allows companies to integrate external services, such as identity verification or account data retrieval, directly into their own applications. In the financial sector, APIs are the technical foundation of Open Banking.
Austrian Banking Act (BWG)
The Austrian Banking Act (Bankwesengesetz, BWG) is the central law governing the licensing, organization and supervision of credit institutions in Austria.
Among other things, it sets out the requirements for a banking license, governance and management, and the ongoing obligations of credit institutions. Its purpose is to ensure that banks operate soundly and to safeguard the stability of the financial system. Supervision is carried out by the Financial Market Authority (FMA).
Austrian Beneficial Owners Register Act (WiEReG)
The Austrian Beneficial Owners Register Act (Wirtschaftliche Eigentümer Registergesetz, WiEReG) requires companies and other legal entities in Austria to report their ultimate beneficial owners to a central register.
The register is maintained by the Austrian Federal Ministry of Finance. Obliged entities such as banks and financial institutions use it as part of their customer due diligence to identify and verify the ultimate beneficial owner of a business customer.
Austrian Consumer Credit Act (VKrG 2026)
The Austrian Consumer Credit Act 2026 (Verbraucherkreditgesetz 2026, VKrG 2026) governs credit agreements between businesses and consumers in Austria and protects borrowers.
The VKrG 2026 replaces the previous Consumer Credit Act from November 20, 2026 and transposes the EU Consumer Credit Directive (EU) 2023/2225. Its scope is significantly broader: it also covers interest-free and fee-free credit and payment deferrals, including Buy Now, Pay Later and invoice purchase with deferred payment.
The act sets out rules on pre-contractual information, advertising, creditworthiness assessments, contract terms and the right of withdrawal. Consumers should be able to understand the key costs and terms of a loan and compare offers.
Austrian Financial Market Authority (FMA)
The Austrian Financial Market Authority (Finanzmarktaufsicht, FMA) is Austria’s integrated supervisory authority for the financial market.
The FMA supervises, among others, banks, insurance companies, pension funds, investment firms, payment and e-money institutions, crypto-asset service providers and stock exchanges. It is also Austria’s national resolution authority for banks.
As a public authority, the FMA can issue regulations and administrative decisions and take enforcement measures, such as imposing penalties or withdrawing licenses. Its goal is a stable financial market and the protection of investors, creditors and consumers.
Austrian Financial Markets Anti-Money Laundering Act (FM-GwG)
The Austrian Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) sets out the anti-money laundering and counter-terrorist financing obligations of banks and financial institutions in Austria.
It defines the due diligence obligations toward customers: identifying and verifying the customer, identifying the ultimate beneficial owner, enhanced due diligence for politically exposed persons and ongoing monitoring of the business relationship. It also governs the obligation to report suspicious transactions to the Austrian Financial Intelligence Unit (A-FIU). Compliance is supervised by the FMA.
Austrian Insurance Contract Act (VersVG)
The Austrian Insurance Contract Act (Versicherungsvertragsgesetz, VersVG) is the central legal basis for insurance contracts in Austria.
It governs the rights and obligations of insurers and policyholders, including the conclusion and termination of contracts, disclosure and notification obligations and the insurer’s obligation to pay in the event of a claim.
Austrian Payment Services Act (ZaDiG 2018)
The Austrian Payment Services Act 2018 (Zahlungsdienstegesetz 2018, ZaDiG 2018) governs the provision of payment services in Austria and transposes the EU Payment Services Directive (PSD2) into Austrian law.
It regulates the licensing of payment institutions, the rights and obligations of payment service providers and their customers and the security requirements for electronic payments, including Strong Customer Authentication. It also covers account information and payment initiation services, execution times for transfers and liability for unauthorized payments.
Austrian Trade Regulation Act (GewO)
The Austrian Trade Regulation Act (Gewerbeordnung, GewO) governs commercial activities in Austria that are carried out independently, regularly and with the intention of generating a profit.
It sets out the requirements for registering and practicing a trade and distinguishes between free trades and regulated trades, which require proof of professional qualifications. Trade licenses are recorded in the Austrian trade register (GISA).
Automated Scoring
Automated scoring is a process in which data is evaluated automatically using predefined rules and statistical models, with the result expressed as a score.
In credit checks, automated scoring assesses the creditworthiness or default risk of a person or company quickly and consistently. Under Art. 22 GDPR, decisions based solely on automated processing that significantly affect an individual are subject to specific requirements. In its SCHUFA ruling of December 7, 2023 (C-634/21), the Court of Justice of the EU held that the calculation of a score can itself fall under Art. 22 GDPR if a lender relies on it decisively.
Bank Identification
Bank identification is a digital identity verification method that uses a person’s existing bank account and online banking access to confirm their identity.
The person logs in to their online banking and, with their explicit consent, the identity data held by the bank is securely transmitted and compared with the details they provided. No identity document needs to be uploaded.
Beneficial Owner (BO)
A beneficial owner is the natural person who ultimately owns or controls a company. The term is used synonymously with ultimate beneficial owner (UBO).
Business Register
A business register is an official directory that records key information about companies and other organizations.
Depending on the register, this includes the company name, legal form, registered office, authorized representatives and registration number. In Austria, the main business register is the company register (Firmenbuch), which is kept by the courts and assigns each entry a company register number (FN). Trade licenses are recorded separately in the trade register (GISA). Business registers are a key data source for verifying business customers in KYC processes.
Contract Recognition
Contract recognition is the automated identification and analysis of contracts and contract data in documents or digital data streams.
It extracts details such as contracting parties, contract type, term and amounts and structures them for further processing. This reduces manual work and allows follow-up processes to be automated.
Credit Approval Process
The credit approval process covers all steps from the credit application to the credit decision and, if approved, the signing of the agreement and disbursement of funds.
It typically includes collecting and verifying customer data, identity verification, creditworthiness and credit risk assessment, the credit decision and the conclusion of the credit agreement. The exact steps depend on the lender, the type of credit and the applicable regulations, such as the Austrian Consumer Credit Act (VKrG 2026).
Credit Bureau (Credit Reporting Agency)
A credit bureau, or credit reporting agency, collects and processes information on the payment behavior of consumers and companies and provides it to businesses in the form of credit reports and scores.
Lenders and other businesses use this information to assess default risk before entering into a contract. In Austria, KSV1870 is one of the leading providers of credit information; in Germany, SCHUFA is the best-known credit bureau for consumers. Credit bureaus operate within the limits of the GDPR.
Credit Risk Modeling
Credit risk modeling is the systematic assessment and quantification of the risk that a borrower or business partner will fail to meet their financial obligations.
It combines relevant data with statistical methods and analytical models to estimate the probability of default. This allows businesses to identify early warning signs and make credit decisions on a consistent, transparent basis.
Creditworthiness Assessment (Credit Check)
A creditworthiness assessment evaluates whether a person or company is able to meet its financial obligations and repay a loan on the agreed terms.
It takes into account information such as income, existing financial obligations and payment behavior. Lenders in Austria are legally required to assess a consumer’s creditworthiness before granting a loan; this obligation is set out in the Consumer Credit Act (VKrG 2026). The result determines whether credit is granted and on what terms.
Customer Due Diligence (CDD)
Customer due diligence (CDD) refers to the measures businesses take to identify and verify their customers and assess the risk of the business relationship.
CDD includes verifying the customer’s identity, identifying the ultimate beneficial owner and obtaining information on the purpose and intended nature of the business relationship. The relationship is then monitored on an ongoing basis. The scope of CDD follows a risk-based approach: higher risks require enhanced due diligence. CDD is a core element of anti-money laundering measures and also supports fraud prevention.
Data Minimization
Data minimization is a fundamental data protection principle: only personal data that is necessary for a specific purpose may be collected and processed.
The principle is set out in Art. 5(1)(c) GDPR. It reduces data protection risks and requires organizations to define clearly in advance which data a process actually needs.
Digital Account Opening
Digital account opening allows customers to open a bank or payment account entirely online, without visiting a branch.
All steps, from data collection and identity verification to KYC checks and signing the contract, take place digitally. Common identification methods include video identification, bank identification and ID Austria; contracts are signed with an electronic signature.
Digital Identity
A digital identity is the set of data and attributes that uniquely identifies a person or organization in digital processes.
It can include a name, date of birth, identification data and digital credentials. A verified digital identity allows online processes, such as opening an account or signing a contract, to be reliably linked to a specific person. In Austria, the government-issued digital identity is ID Austria; at EU level, the European Digital Identity Wallet is being introduced.
Digital Onboarding
Digital onboarding is the process of accepting new customers online, with all steps required to establish a business relationship carried out digitally.
Depending on the use case, this includes collecting customer data, identity verification, KYC and compliance checks, a creditworthiness assessment and signing the contract electronically. Digital onboarding shortens the time to a signed contract and reduces manual processing.
Digital Signature
A digital signature is a cryptographic method used to sign electronic documents or data and to verify their origin and integrity.
It makes it possible to check who signed a document and whether it was altered after signing. Digital signatures are the technical basis of advanced and qualified electronic signatures under the eIDAS Regulation.
Difference between a Digital Signature and an Electronic Signature
An electronic signature is the broader, technology-neutral legal term for any electronic indication of intent to sign, from a typed name to a qualified electronic signature. A digital signature refers specifically to the cryptographic technology used to secure a signature.
eIDAS Regulation (Electronic Identification, Authentication and Trust Services)
The eIDAS Regulation (Regulation (EU) No 910/2014) is the EU legal framework for electronic identification and trust services in the European single market.
It sets out requirements for electronic identification and for trust services such as electronic signatures, electronic seals and electronic time stamps, and ensures that they are recognized across borders within the EU.
The regulation was amended by Regulation (EU) 2024/1183 (eIDAS 2.0), which introduces the European Digital Identity Wallet.
Electronic Know Your Customer (eKYC)
Electronic Know Your Customer (eKYC) is the digital identification and verification of customers as part of the KYC process.
Depending on the method, eKYC verifies identity documents, bank data or other reliable data sources electronically. It allows businesses to identify customers remotely while meeting regulatory requirements.
Electronic Signature
An electronic signature allows a person to sign documents digitally. The eIDAS Regulation recognizes three types with increasing requirements for security and identity verification.
A simple electronic signature (SES) can be, for example, a typed name or a scanned signature. An advanced electronic signature (AES) is uniquely linked to the signatory and detects subsequent changes. A qualified electronic signature (QES) is based on a qualified certificate and has the same legal effect as a handwritten signature throughout the EU (Art. 25(2) eIDAS).
With a remote signature, the qualified signature creation device is managed by a qualified trust service provider on behalf of the signatory. Documents can be signed from anywhere without the signatory needing their own hardware.
Difference between an Electronic Signature and a Digital Signature
The electronic signature is the legal, technology-neutral term. The digital signature is the cryptographic technology used for advanced and qualified electronic signatures.
End-to-End Onboarding
End-to-end onboarding is a fully digital customer onboarding process in which all steps, from initial data collection to the signed contract, run in a single integrated workflow.
This can include identity verification, data collection, compliance checks, creditworthiness assessment and electronic signature. Because there are no handovers between systems or media, processing times and drop-off rates decrease.
EU Anti-Money Laundering Regulation (AMLR)
The EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) establishes uniform, directly applicable anti-money laundering rules for obliged entities throughout the EU.
It will apply from July 10, 2027 and will largely replace the national rules previously based on EU directives, including customer due diligence, identification of beneficial owners and the treatment of politically exposed persons. In Austria, this mainly affects the obligations currently set out in the FM-GwG.
European Digital Identity Wallet (EUDI Wallet)
The European Digital Identity Wallet (EUDI Wallet) is an app-based digital wallet that allows EU citizens to identify themselves online and store and share verified credentials.
It is based on Regulation (EU) 2024/1183 (eIDAS 2.0), which requires each EU member state to provide at least one EUDI Wallet. Users can, for example, prove their identity, present documents such as a driver’s license and create qualified electronic signatures. Regulated businesses such as banks will be required to accept the wallet for identification.
Fraud Prevention
Fraud prevention comprises the measures and technologies that detect and stop fraudulent activity before damage occurs.
These include verifying identity, account and transaction data, plausibility checks and automated analyses that reveal anomalies and inconsistencies. They protect against identity fraud, account fraud and payment fraud, among others, and reduce financial losses and reputational damage. Many fraud prevention measures also help identify money laundering and terrorist financing risks.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is the EU’s central legal framework for the protection of personal data. It has applied since May 25, 2018.
Art. 5 GDPR sets out the core principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. The GDPR also strengthens the rights of individuals, such as the rights of access, rectification and erasure.
IBAN NameCheck
IBAN NameCheck is a verification process that checks whether the name of the intended payee matches the account holder of the IBAN provided.
By detecting discrepancies between name and IBAN before a payment is made, IBAN NameCheck reduces misdirected payments and certain types of payment fraud, adding a layer of security to digital payment and verification processes.
ID Austria
ID Austria is Austria’s government-issued digital identity. It allows individuals to identify themselves securely online for public and private services.
With ID Austria, users can prove their identity digitally and sign documents with a qualified electronic signature. ID Austria is the successor to the mobile phone signature (Handy-Signatur) and the citizen card (Bürgerkarte).
ID Verification (Document Verification)
ID verification, also called document verification, is a digital process that verifies a person’s identity using an official identity document such as a passport or national ID card.
The data on the document is captured digitally and compared with the details provided. Depending on the method, the document’s security features are also checked to confirm its authenticity. ID verification is often combined with a liveness check.
Identity Theft
Identity theft is the unauthorized use of another person’s personal data to act under their identity for fraudulent purposes.
Criminals misuse data such as name, date of birth, ID document details, login credentials or bank details to conclude contracts, open accounts or make purchases. Digital identity verification and strong authentication help detect such attempts early.
Identity Verification
Identity verification is the process of confirming that a person is who they claim to be.
The identity data provided is checked against reliable evidence or trusted data sources, such as an identity document, an existing banking relationship or a government-issued digital identity like ID Austria. Identity verification is a key element of secure digital processes, KYC and anti-money laundering measures.
Instant Payments
Instant payments are electronic credit transfers in which the funds are available in the payee’s account within a maximum of ten seconds.
Unlike standard transfers, instant payments are processed 24 hours a day, 7 days a week, including weekends and public holidays. Under the EU Instant Payments Regulation (Regulation (EU) 2024/886), payment service providers in the euro area must be able to receive instant euro payments since January 9, 2025 and send them since October 9, 2025, at no higher price than standard transfers.
International Bank Account Number (IBAN)
The International Bank Account Number (IBAN) is an internationally standardized identifier for bank accounts.
An IBAN consists of a country code, two check digits and an account-specific part. In Austria, an IBAN starts with the country code AT and has 20 characters. The IBAN enables standardized, automated processing of transfers and direct debits, particularly within SEPA.
Know Your Customer (KYC)
Know Your Customer (KYC) is the process by which businesses identify and verify their customers in accordance with anti-money laundering and regulatory requirements.
KYC establishes who a business is entering into a relationship with. Depending on the legal requirements and risk level, it includes collecting and verifying identity data, checking identity documents and identifying the ultimate beneficial owner of business customers. In Austria, KYC obligations for the financial sector are set out primarily in the FM-GwG. KYC is a core element of anti-money laundering and supports fraud prevention.
Legitimation Check (German: Legitimationsprüfung)
A legitimation check is the verification of a person’s identity using suitable and reliable evidence, such as an official photo ID or a recognized digital identification method. The term is common in German-speaking countries and corresponds to identity verification as part of KYC and anti-money laundering processes.
Liveness Check
A liveness check is a digital verification step that confirms a real, physically present person is in front of the camera during online identity verification.
Depending on the method, facial features, movements or other characteristics are analyzed. This prevents attempts to bypass identity verification with photos, videos, masks or deepfakes.
Mandate Reference
The mandate reference is a unique identifier assigned by the creditor to a SEPA direct debit mandate. It can be up to 35 characters long.
Together with the creditor identifier, the mandate reference, also known as the Unique Mandate Reference (UMR), uniquely identifies a SEPA direct debit mandate. This allows each direct debit to be clearly linked to its mandate. It is a mandatory element of every SEPA direct debit, and account holders can find it in the transaction details on their bank statement.
Misuse Prevention (German: Missbrauchsprävention)
Misuse prevention covers measures that detect and prevent the unauthorized or improper use of data, identities, accounts or digital services.
These include identity and data verification, plausibility checks and automated detection of unusual activity. The term overlaps largely with fraud prevention but also covers misuse without direct financial intent.
Money Mule (German: Finanzagent)
A money mule is a person who receives funds into their bank account and transfers them on behalf of third parties, often in exchange for a commission. The funds typically originate from fraud or other criminal activity and are moved as part of money laundering.
Some money mules act knowingly; others are recruited through fake job offers or online scams and are initially unaware of the criminal background. Acting as a money mule can have criminal consequences and lead to the account being blocked, even if the person was unaware.
Multi-Factor Authentication (MFA)
Multi-factor authentication (MFA) is a security method that requires a person to verify their identity using at least two independent factors from different categories.
These categories are knowledge (something the person knows, such as a password or PIN), possession (something they have, such as a smartphone or security key) and inherence (something they are, such as a fingerprint or face). MFA offers significantly better protection than password-only authentication.
Natural Person
A natural person is a human being who, in legal terms, can hold rights and obligations, for example enter into contracts, own property or have claims and liabilities.
The term distinguishes an individual from a legal person, such as a limited liability company (GmbH), a stock corporation (AG) or an association.
Obligation to Provide Evidence (German: Nachweispflicht)
An obligation to provide evidence is the requirement to be able to demonstrate, through records or documents, that certain information, actions or legal requirements have been fulfilled.
In the financial sector, this means, for example, that businesses must be able to document how identity verification, consents or legally required checks were carried out. Under data protection law, the corresponding principle is accountability (Art. 5(2) GDPR).
Difference between a Reporting Obligation and an Obligation to Provide Evidence
A reporting obligation requires information to be actively sent to an authority. An obligation to provide evidence requires a business to be able to prove, when asked, that it has met certain requirements.
Open Banking
Open Banking is the secure, standardized sharing of payment account data between banks and authorized third-party providers through APIs.
With the customer’s explicit consent, authorized providers can retrieve account information or initiate payments. This enables new digital financial services, such as faster credit checks or account-to-account payments. Open Banking does not mean that banking data is publicly accessible: access is limited to the specific service and requires the customer’s consent. The legal basis in the EU is PSD2.
Open Data
Open data is structured data that anyone can access, use and, depending on the license, redistribute.
Open data is often published by public bodies, for example data on the economy, transport, population, the environment or research. Personal data and confidential information are not open data; where datasets relate to individuals, data protection law applies.
Open Finance
Open Finance extends the Open Banking principle beyond payment accounts to other financial data.
With the customer’s consent and within the applicable legal framework, data on loans, insurance, mortgages, pensions or investments can also be shared securely and used by authorized providers. This enables more integrated and personalized financial services.
Payment Initiation Service Provider (PISP)
A Payment Initiation Service Provider (PISP) is a regulated payment service provider that, with the user’s consent, initiates a payment directly from the user’s payment account.
The PISP connects the payer, their bank and the payee. This makes account-to-account payments possible, for example in online shopping, without a credit card.
Payment Services Directive (PSD1)
The first Payment Services Directive (PSD1, Directive 2007/64/EC) created a common EU legal framework for payment services and payment service providers.
It introduced uniform rules for payment transactions and for the rights and obligations of payment service users and providers. It increased competition and made payments within the EU more efficient and transparent. PSD1 was replaced by PSD2.
Payment Services Directive 2 (PSD2)
The Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366) is the EU legal framework for payment services. It aims to make electronic payments more secure, increase competition and give customers more control over their financial data.
PSD2 requires banks to give regulated third-party providers access to payment accounts, provided the customer has given consent. It also introduced Strong Customer Authentication (SCA): customers must authenticate with at least two independent factors.
PSD2 is the legal basis of Open Banking in the EU. It defines two key types of third-party providers: account information service providers (AISPs) and payment initiation service providers (PISPs). In Austria, PSD2 was transposed by the Payment Services Act (ZaDiG 2018).
Payment Services Directive 3 (PSD3)
PSD3 (Payment Services Directive 3) and the accompanying Payment Services Regulation (PSR) form the successor framework to PSD2 and modernize EU payments law.
The goals are stronger fraud prevention and consumer protection, better conditions for Open Banking, more competition between banks and other payment service providers and more harmonized supervision across the EU. PSD3 covers the licensing and supervision of payment institutions, while the PSR sets out directly applicable rules, for example on Strong Customer Authentication, payee verification and liability for fraud.
Status as of October 2026: the EU Parliament and Council reached a provisional agreement on November 27, 2025, and the final compromise texts were published in April 2026. Formal adoption and publication in the Official Journal of the EU are still pending. Until the new rules apply, expected in 2028, PSD2 remains in force.
Politically Exposed Person (PEP)
A politically exposed person (PEP) is an individual who holds or has held a prominent public function, such as a head of government, minister, member of parliament or senior judge.
Family members and close associates of a PEP are also covered. Because of their position, PEPs are considered to pose a higher risk of corruption and money laundering, so enhanced due diligence applies to them in the financial sector. In Austria, this is set out in the FM-GwG.
Reference Account
A reference account is a designated, verified bank account used for specific transactions or financial processes, such as the repayment of a loan.
Payments can be made to and from a reference account. It ensures that funds are transferred only to a previously registered account and can be clearly attributed to an account holder. Reference accounts are also used to verify account holders.
Reporting Obligation
A reporting obligation is a legal or regulatory requirement to report certain information, events or suspicious activities to a competent authority.
In the financial sector, this applies in particular to suspected money laundering or terrorist financing. In Austria, such suspicious activity reports are submitted to the Financial Intelligence Unit (Geldwäschemeldestelle, A-FIU), which is part of the Federal Criminal Police Office.
Difference between a Reporting Obligation and an Obligation to Provide Evidence
A reporting obligation requires information to be actively sent to an authority. An obligation to provide evidence requires a business to be able to prove, when asked, that it has met certain requirements.
REST API (Representational State Transfer API)
A REST API (Representational State Transfer API) is a widely used type of API in which systems exchange data over standard web protocols (HTTP).
Data is retrieved, created, updated or deleted using standard methods such as GET, POST, PUT and DELETE. REST APIs are easy to integrate into existing systems, which is why most Open Banking and identification services use them.
Risk-Based Approach (AML)
The risk-based approach is a fundamental principle of anti-money laundering: customers, business relationships and transactions are assessed according to their risk of money laundering or terrorist financing.
The higher the risk, the more extensive the due diligence measures. Risk factors include the customer type, business model, source of funds, geographic risks and type of transaction.
SEPA Direct Debit Mandate (SEPA eMandate)
A SEPA direct debit mandate is a written or electronic authorization that allows a company to debit funds from the payer’s bank account. At the same time, it instructs the payer’s bank to honor these direct debits.
It is used for recurring payments such as rent, utilities or insurance premiums. The payer can revoke the mandate at any time. Under the SEPA Core scheme, the payer can request a refund of an authorized direct debit within eight weeks without giving a reason, and of an unauthorized direct debit within 13 months.
A SEPA eMandate is a mandate that is issued and confirmed electronically, so it can be integrated fully into a digital process. Each mandate is uniquely identified by the mandate reference and the creditor identifier.
Signature Verification
Signature verification is a process that checks whether a signature is genuine and belongs to the person in question.
The signature is compared with a reference signature or other stored characteristics, either manually or automatically. Signature verification helps detect forgeries and identity theft.
Social Engineering
Social engineering is a fraud method in which people are deliberately manipulated into disclosing confidential information, making payments or performing certain actions.
Scammers pose as a bank, a company, an authority or someone the victim knows and exploit trust, time pressure or fear. Common forms include phishing emails, fake phone calls (vishing) and fraudulent text messages (smishing).
Strong Customer Authentication (SCA)
Strong Customer Authentication (SCA) is a requirement under PSD2 that customers authenticate themselves with at least two independent factors from the categories of knowledge, possession and inherence.
SCA is required, for example, when a customer accesses their payment account online or initiates an electronic payment. For payments, the authentication must also be dynamically linked to the amount and payee. The detailed rules are set out in Delegated Regulation (EU) 2018/389, and SCA has applied since September 14, 2019.
Third-Party Provider (TPP)
A third-party provider (TPP) is a regulated payment service provider that, with the customer’s consent, accesses payment accounts held at another bank (ASPSP).
Under PSD2, the main types of TPP are account information service providers (AISPs) and payment initiation service providers (PISPs). TPPs must be licensed or registered by a national supervisory authority, in Austria the FMA.
Transaction Monitoring
Transaction monitoring is the ongoing, usually automated, monitoring of financial transactions to detect unusual or suspicious activity.
Transactions are analyzed against rules, risk indicators and behavioral patterns; anomalies are then examined in more detail. Transaction monitoring is a core element of anti-money laundering and fraud prevention.
Trust Service
A trust service is an electronic service regulated under the eIDAS Regulation that ensures the security and reliability of digital transactions.
Trust services include the creation and validation of electronic signatures, electronic seals and electronic time stamps. They confirm the origin, authenticity and integrity of electronic data and documents. Qualified trust service providers are listed in the EU’s official trusted lists.
Two-Factor Authentication (2FA)
Two-factor authentication (2FA) is a form of multi-factor authentication in which a person’s identity is verified using exactly two independent factors.
For example, a password or PIN is combined with a code on a smartphone, an authenticator app or a biometric feature. Even if a password is stolen, the second factor protects the account.
Ultimate Beneficial Owner (UBO)
The ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a company.
As a rule, this is anyone who directly or indirectly holds more than 25% of the shares or voting rights or otherwise exercises control. If no such person can be identified, senior management is considered the beneficial owner. Identifying the UBO is a mandatory part of KYC and anti-money laundering checks for business customers. In Austria, UBOs are recorded in the register under the WiEReG.
Verification of Payee (VoP)
Verification of Payee (VoP) is a mandatory check in which, before a transfer is authorized, the payer’s bank verifies whether the payee name entered matches the account holder of the IBAN.
Since October 9, 2025, payment service providers in the euro area have been required to offer VoP under the EU Instant Payments Regulation. The payer sees one of four results: match, close match, no match or verification not possible. VoP prevents misdirected transfers caused by typos and makes certain types of fraud more difficult.
Video Identification (Video-Ident)
Video identification (video-ident) is a method of verifying a person’s identity online via a live video connection using a valid identity document such as a passport or national ID card.
The person and the document are checked during the video session, either by trained staff or by automated technology. In Austria, video identification for financial institutions is governed by the FMA’s Online Identification Regulation (Online-IDV). Video-ident is widely used in digital onboarding.
Web App (Web Application)
A web app is software that runs directly in a web browser and does not require installation on the device.
As a management platform, a web app allows companies to centrally manage, configure and monitor digital processes, data and users via the browser. Depending on the application, users can start processes, view results and manage settings.