Skip to main content
Blnk Watch is currently in beta. Send us a message
These examples look at patterns over a rolling window instead of only the current transaction. They are useful for detecting bursts, velocity spikes, repeated amounts, or cumulative exposure that a single transaction would not reveal.

​
Destination high inflow

This rule reviews a destination that has received more than a threshold amount in the last 24 hours. It is a straightforward inflow monitoring pattern for merchants, wallets, or payout endpoints.
DestinationHighInflow.ws
rule DestinationHighInflow {
  description "Flags destinations with high inflow over the last 24 hours."

  when sum(amount where destination == $current.destination, "PT24H") > 100

  then review
       score   0.5
       reason  "High inflow to the same destination in 24 hours"
}

​
High amount velocity source

This rule reviews a source account when its total sent amount in the last hour crosses a threshold. It is useful for spotting rapid-value movement even if each individual transaction looks normal on its own.
HighAmountVelocitySource.ws
rule HighAmountVelocitySource {
  description "Flags high-velocity spending from a single source over one hour."

  when sum(amount where source == $current.source, "PT1H") > 3000

  then review
       score   0.7
       reason  "Source account shows a high-velocity spending pattern"
}

​
High frequency destination

This rule reviews repeat traffic to the same destination when the count becomes unusually high. It is helpful for detecting burst payment behavior to one merchant, beneficiary, or wallet.
HighFrequencyDestination.ws
rule HighFrequencyDestination {
  description "Flags unusually frequent payments to the same destination."

  when count(destination == $current.destination, "PT24H") > 10
   and amount > 100

  then review
       score   0.5
       reason  "High transaction frequency to the same destination in 24 hours"
}

​
Low KYC daily total

This rule reviews a tier-1 customer when their cumulative outbound amount in the last 24 hours crosses a threshold. It is a common companion rule to per-transaction limits because structuring often happens through many smaller transfers.
LowKycDailyTotal.ws
rule LowKycDailyTotal {
  description "Flags low-tier KYC customers that exceed a 24-hour total threshold."

  when metadata.kyc_tier == 1
   and sum(amount where source == $current.source, "PT24H") > 5000

  then review
       score   0.5
       reason  "Total transacted amount exceeds the tier-1 threshold"
}

​
Rapid small burst

This rule reviews a source when several small transactions happen in a short period. It is a useful anti-structuring pattern because bad actors often split activity into smaller amounts to avoid single-transaction thresholds.
RapidSmallBurst.ws
rule RapidSmallBurst {
  description "Flags bursts of small transactions from the same source."

  when amount < 500
   and count(source == $current.source, "PT30M") >= 5

  then review
       score   0.65
       reason  "Rapid succession of small transactions from the same source"
}

​
Repeated identical amount

This rule reviews transactions when the same amount repeats several times within an hour. It is a simple pattern for catching scripted behavior, installment abuse, or naïve structuring attempts.
RepeatedIdenticalAmount.ws
rule RepeatedIdenticalAmount {
  description "Flags repeated transactions with the same amount within one hour."

  when count(amount == $current.amount, "PT1H") > 2

  then review
       score   0.6
       reason  "Multiple identical-amount transactions in a short period"
}

​
Repeated identical amount 2

This rule reviews a source when both the transaction count and the repeated amount count stay elevated across a full week. It is a broader pattern for detecting repeated payment habits that may not look suspicious in a shorter window.
RepeatedIdenticalAmount2.ws
rule RepeatedIdenticalAmount2 {
  description "Flags repeated identical-amount activity from the same source over seven days."

  when count(source == $current.source, "P7D") >= 3
   and count(amount == $current.amount, "P7D") >= 3

  then review
       score   0.55
       reason  "Repeated identical-amount transactions detected from the same source"
}

​
Source high outflow

This rule reviews a source account once its total outflow in the last 24 hours becomes unusually high. It works well as a general-purpose velocity control for wallets, current accounts, or card programs.
SourceHighOutflow.ws
rule SourceHighOutflow {
  description "Flags sources with high cumulative outflow over 24 hours."

  when sum(amount where source == $current.source, "PT24H") > 5000

  then review
       score   0.5
       reason  "High cumulative outflow from the source in 24 hours"
}
See also Setting conditions (aggregate conditions) and Defining verdicts.

​
Need help?

We are very happy to help you make the most of Blnk, regardless of whether it is your first time or you are switching from another tool. To ask questions or discuss issues, please contact us or join our Discord community.