Rule Cookbook

rule HighValueTransactionCheck {
    description "Monitors for unusually large transactions requiring review."

    when amount > 10000

    then review
         score   0.5
         reason  "Transaction amount exceeds 10,000 in any currency."
}

rule RapidSmallBurst {
    description "Multiple small transactions in quick succession."

    when amount < 500
     and count(when source == $current.source, "PT30M") >= 5

    then review
         score   0.65
         reason  "Rapid succession of small transactions"
}

rule CrossBorderTransactionCheck {
    description "High-value transaction crossing international borders."

    when metadata.source_country != metadata.destination_country
     and amount > 1000

    then review
         score   0.5
         reason  "Large cross-border transaction requires review"
}

rule HighFrequencyDestination {
    description "Unusually frequent payments to the same destination may require scrutiny."

    when count(when destination == $current.destination, "PT24H") > 10
     and amount > 100

    then review
         score   0.5
         reason  "High frequency of transactions to same destination in 24 hours"
}

rule SourceHighOutflow {
    description "Source account has high outflow volume in 24h."

    when sum(amount when source == $current.source, "PT24H") > 5000

    then review
         score   0.5
         reason  "High cumulative outflow from source in 24 hours"
}

rule HighAmountVelocitySource {
    description "Monitors for rapid high-value spending from a single source in the last hour."

    when sum(amount when source == $current.source, "PT1H") > 3000

    then review
         score   0.7
         reason  "Source account shows high-velocity spending pattern"
}

rule RepeatedIdenticalAmount {
    description "Multiple transactions with identical amounts may indicate structuring."

    when count(when amount == $current.amount, "PT1H") > 2

    then review
         score   0.6
         reason  "Multiple identical amount transactions in a short time period"
}

rule DormantAccountActivity {
    description "Unusual activity after long period of account dormancy."

    when metadata.days_since_last_transaction > 90
     and amount > 1000

    then review
         score   0.7
         reason  "High-value transaction after extended account inactivity"
}

rule NewAccountFirstDay {
    description "High-volume activity on first day of account creation."

    when metadata.account_age_days < 1
     and amount > 1000

    then review
         score   0.6
         reason  "Large transaction from newly created account"
}

rule UnusualTransactionTime {
    description "Large transactions during unusual hours receive extra scrutiny."

    when hour_of_day(timestamp) >= 1
     and hour_of_day(timestamp) < 5
     and amount > 1000

    then review
         score   0.6
         reason  "Large transaction during unusual hours (1 AM - 5 AM)"
}

rule LateNightTransactions {
    description "Detects transactions made late at night."

    when hour_of_day(timestamp) >= 23
      or hour_of_day(timestamp) <= 3

    then review
         score   0.4
         reason  "Transaction occurred during late night hours"
}

rule WeekendTransactionCheck {
    description "Flags high-value transactions on weekends for business accounts."

    when day_of_week(timestamp) == 0
      or day_of_week(timestamp) == 6

    then review
         score   0.4
         reason  "Transaction on a weekend"
}

rule LowKycDailyTotal {
    description "Low-tier KYC total spend in 24h above threshold."

    when metadata.kyc_tier == 1
     and sum(amount when source == $current.source, "PT24H") > 5000

    then review
         score   0.5
         reason  "Total transacted amount exceeds tier-1 limit"
}

rule LowKycHighRisk {
    description "Low-tier KYC customer engaging in high-risk activity."

    when metadata.kyc_tier == 1
     and metadata.merchant_category in ("gambling", "cryptocurrency", "adult", "high_value_goods")
     and amount > 500

    then review
         score   0.8
         reason  "Low-KYC account engaging in high-risk category transaction"
}

rule SelfTransferCheck {
    description "Detects when the source and destination of a transaction are the same."

    when source == $current.destination

    then review
         score   0.5
         reason  "Self-transfer detected — source and destination are identical"
}

rule SanctionedCountryCheck {
    description "Blocks transactions to sanctioned countries per OFAC/international sanctions."

    when metadata.destination_country in $sanctioned_countries

    then block
         score   1.0
         reason  "Destination country is on global sanctions list"
}

rule HighRiskDestinationCountry {
    description "Destination country on high-risk list."

    when metadata.destination_country in $high_risk_countries

    then block
         score   0.5
         reason  "Destination country classified as high risk"
}

rule SuspiciousDescriptionCheck {
    description "Detects suspicious keywords or patterns in transaction descriptions."

    when description regex "(?i)(btc|bitcoin|crypto|wallet|transfer|gift.?card|western.?union)"
     and amount > 1000

    then review
         score   0.2
         reason  "Suspicious description pattern."
}

rule KnownFraudEntityCheck {
    description "Automatically blocks transactions with entities on fraud list."

    when destination in $known_fraud_entities

    then block
         score   1.0
         reason  "Destination is on known fraud entities list"
}

rule CategoryBTCCheck {
    description "Cryptocurrency transaction requires manual verification."

    when metadata.category == "cryptocurrency"

    then review
         score   0.6
         reason  "Cryptocurrency transaction requires verification"
}

rule ForeignCurrencyTx {
    description "Transaction occurs in currency different from account's base currency."

    when currency != metadata.account_base_currency
     and amount > 1000

    then review
         score   0.4
         reason  "Large transaction in foreign currency"
}

rule BlockIfPreviousFailed {
    description "Block when previous transaction failed for same source."

    when previous_transaction(
        within: "PT1H",
        match: {
            status: "failed",
            source: "$current.source"
        }
    )
    and amount > 700000

    then block
         score   1.0
         reason  "High-value transaction after recent failure from same source"
}

rule MerchantIssuerMismatch {
    description "Card issuer country does not match merchant country."

    when metadata.merchant_country != metadata.card_issuer_country

    then review
         score   0.4
         reason  "Card issuer country does not match merchant country"
}