AML Rule Catalog

Kora Compliance ships a typed rule engine: you pick a rule_type and supply its parameters, rather than hand-composing generic field/operator/value logic. This page is the complete library — every rule type, the AML/CFT typologies it covers, and the configuration for each. Everything here is configurable from the dashboard (Monitoring → Rules → Create) or the Rules API.

Rules are per-tenant and start disabled — you enable each when ready. Thresholds below are sensible starting points; tune them to your risk appetite.

Rule types at a glance

rule_type	Detects	Key parameters
THRESHOLD	Single transaction over an amount limit	amount_threshold, amount_operator, max_account_age_days
VELOCITY	Count or cumulative value in a time window	count_threshold / sum_threshold, time_window_minutes|time_window_days, group_by
PATTERN	Structuring, round amounts, rapid movement	pattern_type, just_below_amount, tolerance_percent
GEOGRAPHIC	High-risk / sanctioned jurisdictions	high_risk_countries, sanctioned_countries
BEHAVIORAL	Deviation from the customer's own baseline	deviation_metric, deviation_threshold
NETWORK	Fan-in/out, mesh, closed groups, shared identifiers	pattern_type, count_threshold, identifier_field …
SCREENING	Real-time sanctions / PEP / adverse-media on payment parties	screening_lists, match_score_threshold, block_score_threshold
BLACKLIST	Tenant-maintained deny lists	blacklist_kinds
CHARGEBACK_RATIO	Merchant chargeback tier crossings	tier_thresholds, ratio_basis, cb_period_days
DORMANT_REACTIVATION	High-value activity after long inactivity	inactive_days, amount_threshold
NEW_DEVICE	Transaction from an unrecognised device	require_device_fingerprint, amount_threshold

No integrator-supplied context. Kora derives what it needs from data it already holds. Account age comes from our first-seen record of the customer; new-country, pass-through, and velocity from the transaction history we store — none of these require you to send an extra field.

Screening (sanctions / PEP / adverse-media)

Real-time, inline screening of the payment beneficiary against watchlists. Fail-closed: a screening outage holds the payment rather than releasing it. Configure which lists a rule checks; a sanctions match at or above block_score_threshold blocks, otherwise a hit holds.

{
  "code": "SANCTIONS_SCREEN",
  "rule_type": "SCREENING",
  "category": "SANCTIONS",
  "severity": "CRITICAL",
  "parameters": {
    "screening_lists": ["sanctions"],
    "block_score_threshold": 0.95
  }
}

Typology	Configuration
Sanctioned entity match (real-time)	screening_lists: ["sanctions"]
PEP transaction activity	screening_lists: ["pep"]
High-value PEP transaction	screening_lists: ["pep"], require_high_value: true, amount_threshold
Adverse-media / negative-news match	screening_lists: ["adverse_media"]

PEP and adverse-media dispositions follow your per-tenant screening policy (GET/PUT /monitoring/screening/policy). See Real-Time Payment Screening for the decision model.

Amount & threshold

Typology	Configuration
Single high-value transaction	THRESHOLD · amount_threshold, amount_operator: "GTE"
Large cash transaction (e.g. ≥ CAD 10,000, aggregated 24h)	VELOCITY · sum_threshold, time_window_minutes: 1440, currency-scoped, channels: ["cash"]
CTR threshold (≥ USD 10,000, cash)	THRESHOLD/VELOCITY · currency-scoped, cash channel
Individual vs corporate cash limits	duplicate the rule, scope by conditions.customer_types
Foreign / international transfer	THRESHOLD scoped by transaction_types; model per currency (a threshold is stated in the transaction's own currency — no FX auto-conversion)

Velocity

VELOCITY counts transactions (count_threshold) or sums value (sum_threshold) within a window. group_by selects the aggregation key (customer, card, device, wallet, beneficiary).

Typology	Configuration
Rapid transactions (≥5 in 10 min)	count_threshold: 5, time_window_minutes: 10
High daily volume (≥20 in 24h)	count_threshold: 20, time_window_minutes: 1440
High-velocity mobile money (≥10 in 1h)	count_threshold: 10, channels: ["mobile_money"], time_window_minutes: 60
Daily / weekly / monthly cumulative amount	sum_threshold with the matching window

Structuring / smurfing

Typology	Configuration
Below-threshold structuring	PATTERN · pattern_type: "STRUCTURING", just_below_amount, count_threshold, time_window_hours
CTR evasion / multi-day structuring	same, with a wider window
Round-amount transactions	PATTERN · pattern_type: "ROUND_AMOUNTS", tolerance_percent

Behavioural

BEHAVIORAL compares a transaction against the customer's own baseline (z-score).

Typology	Configuration
Unusual activity / profile deviation	deviation_metric: "AMOUNT", deviation_threshold: 3.0
Value spike (≥3× average)	deviation_metric: "AMOUNT", deviation_threshold: 3.0
Sudden volume / count increase	deviation_metric: "DAILY_VOLUME" | "DAILY_COUNT"

Geographic

Typology	Configuration
High-risk country (FATF list)	GEOGRAPHIC · high_risk_countries: ["…"]
Sanctioned jurisdiction	sanctioned_countries: ["…"]
New-country activity	derived from the customer's country history we store (behavioural/geo)

Network & relationship

NETWORK rules detect connected-party structures. pattern_type selects the shape.

pattern_type	Typology	Key parameters
FAN_OUT	One account → many recipients	count_threshold
FAN_IN	Many senders → one account	count_threshold
BENEFICIARY_FAN_IN	Many customers → one beneficiary	count_threshold
SHARED_IDENTIFIER	Accounts sharing a device / card / email	identifier_field, count_threshold
MANY_TO_MANY	Mesh of senders and beneficiaries	count_threshold, min_distinct_beneficiaries
CLOSED_NETWORK	Repeated activity within a small group	count_threshold, max_group_size
CIRCULAR	Round-tripping (A → B → … → A)	time_window_minutes

{
  "code": "COMMON_DEVICE",
  "rule_type": "NETWORK",
  "category": "FRAUD",
  "severity": "HIGH",
  "parameters": {
    "pattern_type": "SHARED_IDENTIFIER",
    "identifier_field": "device_fingerprint",
    "count_threshold": 2,
    "time_window_days": 7
  }
}

Account, device & AML typologies

Typology	Configuration
New-account risk (high value on a young account)	THRESHOLD · amount_threshold + max_account_age_days — account age is self-derived from our first-seen record; no field required from you
Dormant reactivation	DORMANT_REACTIVATION · inactive_days, amount_threshold
New device, high value	NEW_DEVICE · require_device_fingerprint: true, amount_threshold
Layering / rapid movement	PATTERN · pattern_type: "RAPID_MOVEMENT"
Pass-through / mule account	PATTERN · pattern_type: "RAPID_MOVEMENT" (inflow → outflow, derived from history)
Placement — large unexplained inbound	THRESHOLD scoped by conditions.directions: ["CREDIT"]

Configure it yourself

• Dashboard: sandbox.korastratum.com → Monitoring → Rules → Create Rule. Pick the type, fill the fields, enable. Scoring-layer weights auto-balance to 100%.
• API: POST /monitoring/rules then PUT /monitoring/rules/{id}/enable. See the Transaction Monitoring guide.
• Bulk: provision a full rule set per tenant with the deal-desk seed catalog.

Every rule here runs today in the sandbox — create it, send a test transaction to POST /monitoring/evaluate, and watch it fire before you commit to anything.