AML Rules Catalog
Complete reference of all 43 AML detection rules deployed in the Keshless platform. Rules are organized by detection category and sourced directly from the aml_rules database table.
Each rule has a conditions JSON field containing its parameters, a severity level, and an isActive toggle.
Threshold Rules
Transaction amount-based detection.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-TH-001 | Large Cash Transaction - Reporting Threshold | HIGH | thresholdAmount: 3000 |
| AML-TH-002 | Very Large Transaction - Enhanced Scrutiny | CRITICAL | thresholdAmount: 4500 |
| AML-TH-003 | Medium-High Transaction Alert | MEDIUM | thresholdAmount: 2000 |
AML-TH-001 — Large Cash Transaction - Reporting Threshold
Mandatory reporting threshold as per Eswatini FIU regulations.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 3000 | SZL amount triggering mandatory report |
AML-TH-002 — Very Large Transaction - Enhanced Scrutiny
Enhanced scrutiny for large transactions. Also used as the daily cumulative threshold by the DB-enforcement layer.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 4500 | SZL amount triggering enhanced scrutiny |
AML-TH-003 — Medium-High Transaction Alert
Monitor transactions approaching the reporting threshold.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 2000 | SZL amount triggering monitoring alert |
Structuring Rules
Detecting transaction splitting to avoid thresholds.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-ST-001 | Structuring - Multiple Transactions Below Threshold | CRITICAL | thresholdAmount: 3000, thresholdCount: 5, timeWindowHours: 24 |
| AML-ST-002 | Rapid Small Transactions - Smurfing Pattern | HIGH | thresholdAmount: 1000, thresholdCount: 10, timeWindowHours: 48 |
AML-ST-001 — Structuring - Multiple Transactions Below Threshold
Classic structuring to avoid CTR reporting.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 3000 | Amount being structured around |
thresholdCount | 5 | Minimum transactions to trigger |
timeWindowHours | 24 | Detection window |
AML-ST-002 — Rapid Small Transactions - Smurfing Pattern
Potential smurfing activity with many small transactions.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 1000 | Maximum individual amount |
thresholdCount | 10 | Minimum transaction count |
timeWindowHours | 48 | Detection window |
Velocity Rules
Detecting abnormal transaction frequency spikes.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-VEL-001 | Transaction Volume Spike - 300% Increase | HIGH | percentageChange: 300, timeWindowHours: 24 |
| AML-VEL-002 | Extreme Velocity - 500% Spike | CRITICAL | percentageChange: 500, timeWindowHours: 12 |
AML-VEL-001 — Transaction Volume Spike - 300% Increase
Sudden unexplained increase in transaction activity.
| Parameter | Value | Description |
|---|---|---|
percentageChange | 300 | Percentage increase vs daily average |
timeWindowHours | 24 | Detection window |
AML-VEL-002 — Extreme Velocity - 500% Spike
Critical velocity anomaly.
| Parameter | Value | Description |
|---|---|---|
percentageChange | 500 | Percentage increase vs daily average |
timeWindowHours | 12 | Detection window |
Behavioral Rules
User behavior analysis for inconsistencies.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-BEH-001 | Transaction Exceeds Customer Limit | HIGH | — |
| AML-BEH-002 | Unusual Pattern for Occupation | MEDIUM | thresholdAmount: 2000, occupations list |
| AML-BEH-003 | Massive Anomalous Withdrawal | HIGH | maxMultiplier: 1.5, averageMultiplier: 3 |
| AML-BEH-004 | Repeated Limit-Breach Attempts | HIGH | maxAttemptsPerDay: 3, timeWindowHours: 24 |
AML-BEH-001 — Transaction Exceeds Customer Limit
Transaction inconsistent with customer risk profile. No additional parameters — checked against user's assigned limits.
AML-BEH-002 — Unusual Pattern for Occupation
High-value transactions inconsistent with stated income source.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 2000 | Amount considered unusual for listed occupations |
occupations | student, unemployed, retired, homemaker | Occupations with lower expected volumes |
AML-BEH-003 — Massive Anomalous Withdrawal
Sudden large withdrawals indicating potential account compromise, money laundering exit, or insider theft.
| Parameter | Value | Description |
|---|---|---|
maxMultiplier | 1.5 | Max single withdrawal vs account balance ratio |
averageMultiplier | 3 | Withdrawal must be 3x above user's average |
minBaselineTransactions | 5 | Minimum history needed for baseline |
AML-BEH-004 — Repeated Limit-Breach Attempts
Repeated attempts to breach transaction limits — potential system probing.
| Parameter | Value | Description |
|---|---|---|
maxAttemptsPerDay | 3 | Maximum failed limit-breach attempts |
timeWindowHours | 24 | Detection window |
PEP Related Rules
Enhanced monitoring for Politically Exposed Persons (FATF Recommendation 12).
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-PEP-001 | PEP High-Value Transaction | HIGH | thresholdAmount: 2500 |
| AML-PEP-002 | PEP Cumulative Daily Threshold | HIGH | dailyCumulativeThreshold: 10000 |
| AML-PEP-003 | PEP Receiving From Multiple Sources | CRITICAL | minSources: 3, minTotalAmount: 5000 |
AML-PEP-001 — PEP High-Value Transaction
Enhanced monitoring for PEPs as per FATF recommendations.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 2500 | Lower threshold than standard users |
AML-PEP-002 — PEP Cumulative Daily Threshold
Monitors total daily transaction volume for PEPs. Lower cumulative thresholds because their position creates opportunities for corruption.
| Parameter | Value | Description |
|---|---|---|
dailyCumulativeThreshold | 10000 | Daily cumulative limit for PEPs |
AML-PEP-003 — PEP Receiving From Multiple Sources
PEP receiving payments from 3+ different senders within 24 hours — potential bribery/corruption.
| Parameter | Value | Description |
|---|---|---|
minSources | 3 | Minimum distinct senders |
minTotalAmount | 5000 | Minimum aggregate amount |
timeWindowHours | 24 | Detection window |
Network Analysis Rules
Graph-based detection of fund flows between entities.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-NET-001 | Funnel Account (Many-to-One) | CRITICAL | minSenders: 5, minTotalAmount: 10000 |
| AML-NET-002 | Fan-Out Pattern (One-to-Many) | HIGH | minRecipients: 5, minTotalAmount: 10000 |
| AML-NET-003 | High-Risk Counterparty Transaction | HIGH | riskScoreThreshold: 700 |
AML-NET-001 — Funnel Account (Many-to-One)
Multiple senders to single recipient — fund consolidation/collection pattern.
| Parameter | Value | Description |
|---|---|---|
minSenders | 5 | Minimum distinct senders |
minTotalAmount | 10000 | Minimum aggregate amount |
timeWindowHours | 24 | Detection window |
AML-NET-002 — Fan-Out Pattern (One-to-Many)
Single sender distributing to many recipients — fund dispersal pattern.
| Parameter | Value | Description |
|---|---|---|
minRecipients | 5 | Minimum distinct recipients |
minTotalAmount | 10000 | Minimum aggregate amount |
timeWindowHours | 24 | Detection window |
AML-NET-003 — High-Risk Counterparty Transaction
Transaction with high-risk, PEP, or sanctioned counterparty.
| Parameter | Value | Description |
|---|---|---|
riskScoreThreshold | 700 | Counterparty risk score threshold (0-1000) |
High Risk Transaction Rules
Patterns strongly associated with money laundering techniques.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-HR-001 | Round Number Transactions | MEDIUM | — |
| AML-HR-002 | Rapid Back-and-Forth Transactions | CRITICAL | — |
| AML-HR-003 | Nighttime Large Transactions | MEDIUM | thresholdAmount: 3000 |
| AML-HR-004 | Circular Transaction Pattern - Round Trip | CRITICAL | thresholdAmount: 1000, timeWindowHours: 48 |
| AML-HR-005 | Pass-Through Account Pattern | HIGH | minAmount: 1500, thresholdCount: 3 |
AML-HR-001 — Round Number Transactions
Round numbers often indicate illicit funds. Checked via pattern detection.
AML-HR-002 — Rapid Back-and-Forth Transactions
Potential money laundering layering technique — circular and back-and-forth patterns.
AML-HR-003 — Nighttime Large Transactions
Large transactions during unusual hours.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 3000 | Amount triggering nighttime alert |
AML-HR-004 — Circular Transaction Pattern - Round Trip
Round-trip money movement — strong indicator of money laundering.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 1000 | Minimum amount for detection |
timeWindowHours | 48 | Window to detect round-trip |
similarityPercentage | 80 | How similar amounts must be (%) |
AML-HR-005 — Pass-Through Account Pattern
Pass-through accounts used to obscure money trails in the layering stage.
| Parameter | Value | Description |
|---|---|---|
minAmount | 1500 | Minimum transaction amount |
thresholdCount | 3 | Minimum pass-through transactions |
timeWindowHours | 3 | Rapid movement detection window |
similarityPercentage | 75 | Amount similarity threshold (%) |
Pattern Detection Rules
Automated detection of suspicious transaction patterns.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-PAT-001 | Repeated Identical Amounts | MEDIUM | minAmount: 500, thresholdCount: 5 |
| AML-PAT-002 | Just-After-Midnight Transactions | MEDIUM | windowMinutes: 30, consecutiveDays: 2 |
| AML-PAT-003 | Rapid Sequential Withdrawals | HIGH | minCount: 3, minTotalAmount: 5000 |
| AML-PAT-004 | Deposit-Immediate-Withdrawal (Cash-Out) | CRITICAL | minAmount: 3000, timeWindowMinutes: 60 |
AML-PAT-001 — Repeated Identical Amounts
Multiple identical-amount transactions indicating structuring or smurfing.
| Parameter | Value | Description |
|---|---|---|
minAmount | 500 | Minimum individual amount |
thresholdCount | 5 | Minimum identical transactions |
timeWindowHours | 48 | Detection window |
AML-PAT-002 — Just-After-Midnight Transactions
Transactions timed to exploit daily limit resets.
| Parameter | Value | Description |
|---|---|---|
windowMinutes | 30 | Minutes after midnight |
consecutiveDays | 2 | Minimum consecutive days |
thresholdAmount | 2000 | Minimum amount |
AML-PAT-003 — Rapid Sequential Withdrawals
Rapid back-to-back withdrawals indicating account drain or cash-out.
| Parameter | Value | Description |
|---|---|---|
minCount | 3 | Minimum sequential withdrawals |
minTotalAmount | 5000 | Minimum aggregate amount |
maxIntervalMinutes | 15 | Maximum time between withdrawals |
AML-PAT-004 — Deposit-Immediate-Withdrawal (Cash-Out)
Immediate deposit-withdrawal cycle — classic money laundering cash-out pattern.
| Parameter | Value | Description |
|---|---|---|
minAmount | 3000 | Minimum transaction amount |
timeWindowMinutes | 60 | Maximum time between deposit and withdrawal |
similarityPercentage | 70 | Amount similarity threshold (%) |
Account Lifecycle Rules
New and dormant account monitoring.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-ACC-001 | Dormant Account Reactivation | HIGH | inactiveDays: 30, thresholdAmount: 5000 |
| AML-ACC-002 | New Account Rapid Activity | HIGH | accountAgeDays: 7, maxDailyAmount: 10000 |
| AML-ACC-003 | Incomplete KYC High-Value Transaction | CRITICAL | thresholdAmount: 1000 |
AML-ACC-001 — Dormant Account Reactivation
Dormant account reactivation with high-value activity.
| Parameter | Value | Description |
|---|---|---|
inactiveDays | 30 | Days of inactivity before considered dormant |
thresholdAmount | 5000 | Amount triggering alert on reactivation |
AML-ACC-002 — New Account Rapid Activity
New account with abnormally high transaction activity.
| Parameter | Value | Description |
|---|---|---|
accountAgeDays | 7 | Account age threshold (days) |
maxDailyAmount | 10000 | Maximum expected daily amount |
maxTransactionsPerDay | 5 | Maximum expected daily transactions |
AML-ACC-003 — Incomplete KYC High-Value Transaction
High-value transaction from unverified account — compliance violation.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 1000 | Amount triggering KYC compliance alert |
Digital Wallet Rules
Wallet-specific patterns including NFC and top-up behavior.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-DIG-001 | Top-Up Then Immediate Transfer | HIGH | minAmount: 3000, timeWindowMinutes: 30 |
| AML-DIG-002 | NFC Tap Burst | MEDIUM | minConsecutiveTaps: 4, maxIntervalSeconds: 120 |
| AML-DIG-003 | Geographic Anomaly | MEDIUM | distanceThresholdKm: 100 |
AML-DIG-001 — Top-Up Then Immediate Transfer
Immediate top-up-to-transfer cycle — wallet used as pass-through conduit.
| Parameter | Value | Description |
|---|---|---|
minAmount | 3000 | Minimum top-up amount |
timeWindowMinutes | 30 | Maximum time between top-up and transfer |
topupPercentageTransferred | 80 | Percentage of top-up transferred out |
AML-DIG-002 — NFC Tap Burst
Rapid NFC tap burst — potential card fraud or vendor collusion.
| Parameter | Value | Description |
|---|---|---|
minConsecutiveTaps | 4 | Minimum consecutive NFC taps |
maxIntervalSeconds | 120 | Maximum seconds between taps |
AML-DIG-003 — Geographic Anomaly
Sudden geographic shift in transaction location — potential account takeover.
| Parameter | Value | Description |
|---|---|---|
distanceThresholdKm | 100 | Distance threshold in kilometers |
Mobile Money Rules
Mobile money specific monitoring.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-MM-001 | Large Mobile Money Transaction | MEDIUM | thresholdAmount: 2000 |
| AML-MM-002 | Excessive Mobile Money Activity | HIGH | thresholdCount: 50, thresholdAmount: 500 |
AML-MM-001 — Large Mobile Money Transaction
Monitor large mobile money movements.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 2000 | Amount triggering monitoring |
AML-MM-002 — Excessive Mobile Money Activity
Unusual mobile money velocity.
| Parameter | Value | Description |
|---|---|---|
thresholdCount | 50 | Maximum transactions in window |
thresholdAmount | 500 | Per-transaction threshold |
timeWindowHours | 24 | Detection window |
Vendor Specific Rules
Monitoring vendor transaction patterns.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-VND-001 | Vendor Disproportionate Volume | HIGH | Monthly thresholds by business size |
| AML-VND-002 | Vendor Immediate Cash-Out | HIGH | minAmount: 2000, timeWindowMinutes: 30 |
| AML-VND-003 | Vendor-to-Vendor Transfer | MEDIUM | minAmount: 1000, thresholdCount: 2 |
AML-VND-001 — Vendor Disproportionate Volume
Vendor transaction volume inconsistent with business type/size.
| Parameter | Value | Description |
|---|---|---|
monthlyThresholdSmallBusiness | 100000 | Monthly limit for small businesses |
monthlyThresholdMedium | 500000 | Monthly limit for medium businesses |
AML-VND-002 — Vendor Immediate Cash-Out
Vendor immediate cash-out after receiving payment — pass-through indicator.
| Parameter | Value | Description |
|---|---|---|
minAmount | 2000 | Minimum payment amount |
timeWindowMinutes | 30 | Maximum time between receive and cash-out |
similarityPercentage | 70 | Amount similarity threshold (%) |
AML-VND-003 — Vendor-to-Vendor Transfer
Inter-vendor transfers — unusual for retail, potential layering between shell businesses.
| Parameter | Value | Description |
|---|---|---|
minAmount | 1000 | Minimum transfer amount |
thresholdCount | 2 | Minimum transfers to trigger |
timeWindowHours | 48 | Detection window |
CFT Related Rules
Counter-Financing of Terrorism detection.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-CFT-001 | Regular Small Payments Pattern | MEDIUM | maxAmount: 1000, minOccurrences: 4 |
| AML-CFT-002 | Multiple Small Donors to One Recipient | HIGH | minDonors: 8, minAggregateAmount: 3000 |
AML-CFT-001 — Regular Small Payments Pattern
Regular scheduled small payments to same recipient — potential terrorism financing.
| Parameter | Value | Description |
|---|---|---|
maxAmount | 1000 | Maximum individual amount |
minOccurrences | 4 | Minimum recurring payments |
lookbackDays | 30 | Detection window (days) |
maxVariancePercentage | 20 | Maximum amount variance between payments (%) |
AML-CFT-002 — Multiple Small Donors to One Recipient
Multiple small contributions aggregating to significant sum — crowdfunding terrorism financing typology.
| Parameter | Value | Description |
|---|---|---|
minDonors | 8 | Minimum distinct donors |
maxIndividualAmount | 500 | Maximum per-donor amount |
minAggregateAmount | 3000 | Minimum total amount |
timeWindowDays | 7 | Detection window (days) |
Regional Risk Rules
Geographic risk assessment for Eswatini regions.
| Rule ID | Name | Severity | Key Parameters |
|---|---|---|---|
| AML-GEO-001 | Border Region High-Risk Transactions | MEDIUM | Border region list |
| AML-GEO-002 | High-Crime Urban Areas | LOW | Urban center list |
AML-GEO-001 — Border Region High-Risk Transactions
Border regions with higher cross-border crime risk.
| Parameter | Value |
|---|---|
regions | Hhohho, Lubombo, Matsapha, Ngwenya, Lomahasha, Lavumisa |
AML-GEO-002 — High-Crime Urban Areas
Urban centers requiring enhanced monitoring.
| Parameter | Value |
|---|---|
regions | Manzini, Mbabane, Big Bend |
Regulatory Reporting Rules
Mandatory reporting obligations.
AML-REP-001 — Mandatory CTR Threshold
Severity: CRITICAL
Mandatory FIU reporting for transactions >= SZL 50,000 (MLTFP Act Section 13).
| Parameter | Value | Description |
|---|---|---|
reportingThreshold | 50000 | Mandatory CTR amount (SZL) |
Business Sector Rules
Industry-specific risk assessment.
AML-BUS-001 — High-Risk Business Sector Transaction
Severity: MEDIUM
Cash-intensive businesses require enhanced scrutiny.
| Parameter | Value | Description |
|---|---|---|
thresholdAmount | 2000 | Amount triggering sector-based alert |
occupations | money_changer, casino, real_estate, car_dealer, jewelry, art_dealer, precious_metals | High-risk business types |
DB Schema Reference
Rules are stored in the aml_rules table:
| Column | Type | Description |
|---|---|---|
id | string | Primary key |
ruleId | string | Unique rule code (e.g., AML-TH-002) |
name | string | Human-readable name |
description | string | What the rule detects |
category | string | Rule category |
conditions | JSON | Parameters and thresholds |
actions | JSON | Actions when triggered |
severity | enum | LOW, MEDIUM, HIGH, CRITICAL |
isActive | boolean | Whether rule is enabled |
priority | number | Evaluation priority |
createdAt | timestamp | Creation date |
updatedAt | timestamp | Last update |
Related Documentation
- Rules Engine API — CRUD endpoints for managing rules
- Rules Engine Dashboard — Admin UI for rule management
- Risk Scoring — How risk scores are calculated
- AML Monitoring — Alert management