Watch scripts

Aggregate condition examples

Evaluate transaction patterns over a rolling time window.

These examples look at patterns over a rolling window instead of only the current transaction. They are useful for detecting bursts, velocity spikes, repeated amounts, or cumulative exposure that a single transaction would not reveal.

Use when inside aggregate filters (not where). See Setting conditions for the full syntax, including avg, max, and min.

Destination high inflow

This rule reviews a destination that has received more than a threshold amount in the last 24 hours. It is a straightforward inflow monitoring pattern for merchants, wallets, or payout endpoints.

rule DestinationHighInflow {
  description "Flags destinations with high inflow over the last 24 hours."

  when sum(amount when destination == $current.destination, "PT24H") > 100

  then review
       score   0.5
       reason  "High inflow to the same destination in 24 hours"
}

High amount velocity source

This rule reviews a source account when its total sent amount in the last hour crosses a threshold. It is useful for spotting rapid-value movement even if each individual transaction looks normal on its own.

rule HighAmountVelocitySource {
  description "Flags high-velocity spending from a single source over one hour."

  when sum(amount when source == $current.source, "PT1H") > 3000

  then review
       score   0.7
       reason  "Source account shows a high-velocity spending pattern"
}

High frequency destination

This rule reviews repeat traffic to the same destination when the count becomes unusually high. It is helpful for detecting burst payment behavior to one merchant, beneficiary, or wallet.

rule HighFrequencyDestination {
  description "Flags unusually frequent payments to the same destination."

  when count(when destination == $current.destination, "PT24H") > 10
   and amount > 100

  then review
       score   0.5
       reason  "High transaction frequency to the same destination in 24 hours"
}

Average amount source

This rule reviews a source when its average transaction amount over a short window is unusually high. Use avg when the mean value matters more than the total.

rule AverageAmountSource {
  description "Flags sources whose average amount spikes over 30 seconds."

  when avg(amount when source == $current.source, "PT30S") > 2000

  then review
       score   0.6
       reason  "Average amount from the source is unusually high"
}

Max amount source

This rule reviews a source when any single related amount in the window exceeds a ceiling. Use max for peak-value checks without summing everything.

rule MaxAmountSource {
  description "Flags sources that send a peak amount above the threshold in 10 minutes."

  when max(amount when source == $current.source, "PT10M") > 10000

  then review
       score   0.7
       reason  "Peak amount from the source exceeds the threshold"
}

Min amount destination

This rule reviews a destination when the smallest related amount in the window falls below a floor. Use min for unusually small transfers into an endpoint that normally sees larger values.

rule MinAmountDestination {
  description "Flags destinations whose minimum amount in one hour is below the floor."

  when min(amount when destination == $current.destination, "PT1H") < 2000

  then review
       score   0.4
       reason  "Minimum amount to the destination is below the expected floor"
}

Low KYC daily total

This rule reviews a tier-1 customer when their cumulative outbound amount in the last 24 hours crosses a threshold. It is a common companion rule to per-transaction limits because structuring often happens through many smaller transfers.

rule LowKycDailyTotal {
  description "Flags low-tier KYC customers that exceed a 24-hour total threshold."

  when metadata.kyc_tier == 1
   and sum(amount when source == $current.source, "PT24H") > 5000

  then review
       score   0.5
       reason  "Total transacted amount exceeds the tier-1 threshold"
}

Rapid small burst

This rule reviews a source when several small transactions happen in a short period. It is a useful anti-structuring pattern because bad actors often split activity into smaller amounts to avoid single-transaction thresholds.

rule RapidSmallBurst {
  description "Flags bursts of small transactions from the same source."

  when amount < 500
   and count(when source == $current.source, "PT30M") >= 5

  then review
       score   0.65
       reason  "Rapid succession of small transactions from the same source"
}

Repeated identical amount

This rule reviews transactions when the same amount repeats several times within an hour. It is a simple pattern for catching scripted behavior, installment abuse, or naïve structuring attempts.

rule RepeatedIdenticalAmount {
  description "Flags repeated transactions with the same amount within one hour."

  when count(when amount == $current.amount, "PT1H") > 2

  then review
       score   0.6
       reason  "Multiple identical-amount transactions in a short period"
}

Repeated identical amount 2

This rule reviews a source when both the transaction count and the repeated amount count stay elevated across a full week. It is a broader pattern for detecting repeated payment habits that may not look suspicious in a shorter window.

rule RepeatedIdenticalAmount2 {
  description "Flags repeated identical-amount activity from the same source over seven days."

  when count(when source == $current.source, "P7D") >= 3
   and count(when amount == $current.amount, "P7D") >= 3

  then review
       score   0.55
       reason  "Repeated identical-amount transactions detected from the same source"
}

Source high outflow

This rule reviews a source account once its total outflow in the last 24 hours becomes unusually high. It works well as a general-purpose velocity control for wallets, current accounts, or card programs.

rule SourceHighOutflow {
  description "Flags sources with high cumulative outflow over 24 hours."

  when sum(amount when source == $current.source, "PT24H") > 5000

  then review
       score   0.5
       reason  "High cumulative outflow from the source in 24 hours"
}

See also Setting conditions (aggregate conditions) and Defining verdicts.