Basic condition examples

rule BlockBlackListedAccounts {
  description "Blocks transactions from accounts on an internal blacklist."

  when source in $current.metadata.blacklisted_accounts

  then block
       score   1.0
       reason  "Source account is on the blacklist"
}

rule CategoryBTCCheck {
  description "Cryptocurrency transactions require manual verification."

  when metadata.category == "cryptocurrency"

  then review
       score   0.6
       reason  "Transaction category is cryptocurrency"
}

rule HighRiskDestinationCountry {
  description "Blocks transactions headed to a high-risk destination country."

  when metadata.destination_country in $current.metadata.high_risk_countries

  then block
       score   0.5
       reason  "Destination country is classified as high risk"
}

rule HighValueTransactionCheck {
  description "Monitors for unusually large transactions requiring review."

  when amount > 10000

  then review
       score   0.5
       reason  "Transaction amount exceeds 10,000"
}

rule KnownFraudEntityCheck {
  description "Blocks transactions sent to known fraud entities."

  when destination in $current.metadata.known_fraud_entities

  then block
       score   1.0
       reason  "Destination is on the known fraud entities list"
}

rule SanctionedCountryCheck {
  description "Blocks transactions sent to sanctioned countries."

  when metadata.destination_country in $current.metadata.sanctioned_countries

  then block
       score   1.0
       reason  "Destination country is on the sanctions list"
}

rule SuspiciousMCCCheck {
  description "Flags transactions with high-risk merchant category codes."

  when metadata.mcc in ("7995", "5912")

  then review
       score   0.5
       reason  "Transaction involves a high-risk merchant category code"
}