Recommended General Rules

Unit21 recommends creating the following rules:

1. Dormant Activity Embedded Filters

Identifies accounts that have been dormant for greater than 100 days that show sudden activity in their account of more than $5000.

2. Historical Deviations A Embedded Filters

Generate alerts for Accounts that have last 3 months transaction volumes >65% different from last year
Window = 1 month

3. Historical Deviations B Embedded Filters

Historical deviation greater than 100% in the last 3 days compared to the last 31 days.

4. Layering Embedded Filters

Velocity of funds - Different Beneficiary - Individual - US/RoW - Find someone with at least 10K in deposits then has 90% of that sum withdrawn.
Window = 3 days

5. Newly Seen

Entities with 1 newly seen sender instruments in the past 3 months.

6. Simple Count Embedded Filters

Flag receivers named Smith who receive > 10 txns over 1000 dollars in 31 days.
Window = 1 week

7. Simple Filters

ACH Pulls unto Debit where Liability Model score is empty, at cancel bucket, or high for same day hold:
txn_event.amount >= 600 &&
txn_event.custom_data->Fraud Score >= 0.0069 &&
txn_event.custom_data->Fraud Score <= 0.0178 &&
txn_event.receiver_instrument_external_id Like \"debit%\" &&
txn_event.custom_data->Fraud Score Type == \"unauthModelScore_v4\" &&
txn_event.sender_instrument_external_id Like \"externalBank%\"

8. Simple Object Count Transactions Embedded Filters

Flags the first payroll a company has run.
Window = 10 min

9. Simple Statistics With Count Embedded Filters

Check Deposit Velocity (Weekly)
Window = 1 week

10. Structuring Embedded Filters

Triggers Alerts on Structuring Transaction within a one day period.
Window = 2 hours

11. Transaction Statistics A Embedded Filters

Creates an alert if a certain number of transactions that lie within a range that's close to regulation thresholds.
Window = 5 days