Configure rules

Isaac's rule engine provides consistent, explainable, and configurable transaction evaluation by applying predefined logic to detected activity. Rules help automatically classify risk, enrich alerts with standardized comments, reduce false positives, and prioritize cases that require deeper investigation.

To use the rules, you need to enable the rule engine during Isaac's configuration. Isaac uses two types of rules to support transaction monitoring:

• Prebuilt rules. Select the required prebuilt rules once you enable the rule engine. For more details, see Install and configure | Investigation.

  

• No-code rules. Set up no-code rules in the Transformation steps in the Transaction Monitoring Alert Investigation Business Process. For more details, see Transaction monitoring flow and Fraud investigation flow.

  

Prebuilt rules

The section lists prebuilt rules that come with Isaac out of the box. You can enable the prebuilt rules as you configure Isaac. If the rule engine is disabled, Isaac will not apply the prebuilt rules to the transaction data.

The prebuilt rules are as follows:

Rule	UI rule name	Description
CASH_CREDIT_PATTERN	Cash Credit Pattern (LR)	Detects predictable weekly cash deposit patterns that indicate routine, low-risk income activity.
CASH_DEBIT_PATTERN	Cash Debit Pattern (LR)	Detects consistent weekday cash withdrawal behavior that is likely routine and low risk.
INTERNAL_TRANSFER_PATTERN	Internal Transfer (LR)	Identifies system-initiated internal account transfers between the customer’s own accounts.
SOURCE_OF_FUNDS_ANALYSIS_PATTERN	Source of Funds Analysis (LR)	Identifies outgoing transactions that are supported by verified and trusted sources of incoming funds within a recent historical window.
TRIGGER_EVENT_IDENTIFICATION	Trigger Event Identification (LR)	Identifies large transactions linked to legitimate life events (for example, home sale, insurance, inheritance).
GEOGRAPHIC_CONSISTENCY	Geographic Consistency (LR)	Flags consistent ATM withdrawals in the customer's home state as low risk.
MULTIPLE_LOCATIONS_SAME_DAY	Multiple Locations Same Day (RFI)	Detects ATM withdrawals from multiple geographic locations on the same day.
ATM_CASH_FUNNEL_PATTERN	Atm Cash Funnel Pattern (RFI)	Identifies rapid ATM withdrawals following incoming electronic transfers.
HIGH_VELOCITY_WITHDRAWALS	High Velocity Withdrawals (RFI)	Detects unusually frequent or high-total ATM withdrawals in a single day.
INCOMING_OR_OUTGOING_BALANCE_ANALYSIS	Incoming/Outgoing Balance Analysis (RFI)	Identifies rapid in-and-out fund movement typical of money mule activity.
JUST_UNDER_THRESHOLD_WITHDRAWALS	Just-Under Threshold Withdrawals (RFI)	Detects repeated withdrawals just below regulatory reporting thresholds.
JUST_UNDER_THRESHOLD_DEPOSITS	Just-Under Threshold Deposits (RFI)	Detects repeated deposits just below regulatory reporting thresholds.
OUT_OF_STATE_WITHDRAWALS	Out-of-State Withdrawals (RFI)	Identifies multiple ATM withdrawals outside the customer's state of residence.
NON_US_INTERNATIONAL_TRANSFERS	Non US International Transfers (RFI)	Detects outgoing international transfers initiated by domestic customers.
RAPID_P2P_VELOCITY	Rapid P2P Velocity (RFI)	Identifies high-velocity peer-to-peer transaction activity.
ROUND_DOLLAR_WITHDRAWALS	Round Dollar Withdrawals (RFI)	Detects repeated transactions in exact round dollar amounts.
ROUND_DOLLAR_DEPOSITS	Round Dollar Deposits (RFI)	Detects suspicious patterns of deposits in exact round dollar amounts (multiples of 100 USD).
UNUSUAL_OUTGOING_PATTERNS	Unusual Outgoing Patterns (RFI)	Flags suspicious outgoing transaction volumes, types, or amounts.
UNEMPLOYMENT_CONCURRENT_PAYROLL	Unemployment Concurrent Payroll (RFI)	Detects concurrent unemployment and payroll deposits.
UNEMPLOYMENT_OFFSHORE_EXIT	Unemployment Offshore Exit (RFI)	Identifies unemployment funds transferred offshore shortly after deposit.
UNEMPLOYMENT_CUSTOMER_STATE_VALID	Unemployment Customer State Valid (LR)	Identifies legitimate unemployment benefits linked to the customer or close associates.
UNEMPLOYMENT_WRONG_STATE	Unemployment Wrong State (RFI)	Detects unemployment benefits originating from an invalid state for the customer.
KNOWN_TRANSACTION_METHOD_PATTERNS	Known Transaction Method Patterns (LR)	Flags low-risk transactions using known, standard processing methods.
CASH_FUNNEL_OFFSHORE_ACTIVITY	Cash Funnel Offshore Activity (RFI)	Detects cash or cash-like activity conducted outside the customer's jurisdiction.

CASH_CREDIT_PATTERN

The rule identifies a recurring cash deposit behavior that follows a predictable weekly pattern. Regular cash credits occurring on specific weekdays might indicate routine, low-risk income activity, such as business cash collections or scheduled deposits.

The trigger conditions are as follows:

• The transaction list contains cash deposit transactions.

  AND

• At least one cash deposit occurs on Monday or Tuesday.

  AND

• At least one cash deposit occurs on Friday.

  AND

• The entity is a business.

When the rule is triggered, all involved transactions are marked with the LOW_RISK transaction status, and the following transaction comment is added: Cash credit is Monday or Tuesday and Friday.

CASH_DEBIT_PATTERN

The rule identifies a consistent cash withdrawal pattern occurring on specific weekdays. Regular cash debits on predictable days might represent routine, low-risk cash usage behavior, such as scheduled withdrawals for recurring expenses.

The trigger conditions are as follows:

• The transaction list contains cash withdrawal transactions.

  AND

• At least one cash withdrawal occurs on Monday or Friday.

When the rule is triggered, all involved transactions are marked with the LOW_RISK transaction status, and the following transaction comment is added: Cash debit is Monday or Friday.

INTERNAL_TRANSFER_PATTERN

The rule identifies system-initiated internal account transfers between the customer’s own accounts. Such transfers are considered routine and low-risk as they represent movement of funds within the same financial ecosystem rather than external transactions.

The trigger conditions are as follows:

• The transaction list contains transactions.

  AND

• The transaction entry method is System.

  AND

• The transaction details contain the Transfer keyword.

  AND

• The transaction details contain at least one internal account identifier: Credit Karma, DDA, Savings, Checking, or Loan.

When the rule is triggered, all matching transactions are marked with the LOW_RISK transaction status, and the following transaction comment is added: Internal account transfer.

SOURCE_OF_FUNDS_ANALYSIS_PATTERN

The rule identifies outgoing transactions that are supported by verified and trusted sources of incoming funds within a recent historical window. The outgoing activity backed by legitimate income indicates routine, low-risk transaction behavior.

Trusted incoming transactions are defined as transactions where:

• The inter-account relationship is PRESUMED_SAME_PERSON.

  OR

• The transaction details contain verified income-related keywords, such as Payroll, Direct Deposit, Salary, Tax Refund, IRS, State Tax, Social Security, SSI, and SSDI.

The trigger conditions are as follows:

• There exists one or more incoming transactions within the previous seven days.

  AND

• The incoming transactions are from a trusted source.

  AND

• The total amount of trusted incoming funds is greater than or equal to the outgoing transaction amount.

When the rule is triggered, all qualifying outgoing transactions are marked with the LOW_RISK transaction status, and the following transaction comment is added: Outgoing activity supported by verified income source.

TRIGGER_EVENT_IDENTIFICATION

The rule identifies legitimate life events that explain unusually large transactions, helping reduce false-positive alerts by recognizing normal circumstances that result in large deposits or transfers.

The trigger conditions are as follows:

• A transaction amount exceeds five times the average transaction amount for the account.

  AND

• The transaction details contain the following keywords indicating a legitimate trigger event:

  • SALE

  • INSURANCE PROCEEDS

  • INHERITANCE

  • SETTLEMENT

If both conditions are met, the transaction status is identified as LOW_RISK, and the following transaction comment is added: Transaction exceeds typical account activity and is associated with a documented event such as a property sale, settlement, or insurance payout.

GEOGRAPHIC_CONSISTENCY

The rule identifies low-risk, routine ATM withdrawal behavior by detecting consistent withdrawal patterns in the customer's home state. Regular ATM withdrawals of similar amounts in familiar locations typically indicate normal, everyday banking activity rather than suspicious behavior.

The trigger conditions are as follows:

• At least two ATM withdrawals occur in the customer's states (based on registered addresses).

  AND

• All withdrawal amounts are consistent: every transaction amount falls within 5% of the average withdrawal amount across all these transactions.

If the conditions are met, the transactions are updated as LOW_RISK, and the following transaction comment is added: ATM withdrawals in customer's home state with consistent patterns.

info

The rule requires all transactions to be within the 5% tolerance range. If even one transaction falls outside the range, the entire group is not flagged as LOW_RISK.

MULTIPLE_LOCATIONS_SAME_DAY

The rule identifies ATM withdrawals made from multiple geographic locations on the same day.

The trigger conditions are as follows:

• Multiple ATM withdrawal transactions occur on the same calendar day.

  AND

• Withdrawals originate from more than three distinct transaction locations.

When triggered, all involved transactions are marked with the REQUIRES_FURTHER_INVESTIGATION transaction status, and the following transaction comment is added: Multiple ATM locations on same day - verify geographic plausibility.

ATM_CASH_FUNNEL_PATTERN

The rule detects cases where a customer receives money by electronic transfer and then withdraws almost the same amount in cash from ATMs within a short period.

The trigger conditions are as follows:

• The activity happens within a five-day period.

  AND

• At least 4,000 USD of incoming electronic transfers (EFT payments) occur.

  AND

• At least 4,000 USD of ATM cash withdrawals occur.

  AND

• The total number of transactions is eight or more.

  AND

• The amount withdrawn is roughly the same as the amount received, within about a 10% difference.

When the rule is triggered, all involved transactions are marked with the REQUIRES_FURTHER_INVESTIGATION transaction status, and the following transaction comment is added: Cash funnel activity: incoming funds rapidly withdrawn via ATM - potential human trafficking indicator.

HIGH_VELOCITY_WITHDRAWALS

The rule identifies situations where a customer withdraws cash from ATMs multiple times or in unusually large total amounts within a single day.

The trigger conditions are as follows:

• There are five or more ATM withdrawal transactions within the same day.

  AND

• The total cash withdrawn is at least 2,000 USD.

If both conditions are met, all involved ATM withdrawals transactions for that day are flagged with the REQUIRES_FURTHER_INVESTIGATION transaction status, and the following transaction comment is added: High velocity ATM activity - potential cash funnel or money mule.

INCOMING_OR_OUTGOING_BALANCE_ANALYSIS

The rule detects situations where money enters an account and is quickly sent back out again within a very short period of time. The fast in-and-out movement of funds is a common red flag for money mule activity, pass-through accounts, or other forms of financial misuse.

The trigger conditions are as follows:

• The account transactions below take place within any three-day period.

  AND

• The account receives at least 6,000 USD through incoming EFT deposits, wire transfers, and cash deposits.

  AND

• The account sends at least 6,000 USD out through P2P/ACH payments.

  AND

• The outgoing amount is almost the same as the incoming one, within about a 10% difference.

If the conditions are met, the transactions are updated with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Rapid movement: incoming funds immediately sent via P2P - potential money mule activity.

JUST_UNDER_THRESHOLD_WITHDRAWALS

The rule detects potential structuring behavior where customers make repeated withdrawals of specific dollar amounts that fall just below common regulatory reporting thresholds. Structuring (also known as smurfing) is an attempt to avoid triggering Currency Transaction Reports (CTRs) or other regulatory scrutiny by deliberately keeping transaction amounts under key thresholds.

The trigger conditions are as follows:

• Ten or more withdrawals fall within any one of the three suspicious amount ranges:

  • Range 1: three or more transactions from 9,000 to 9,999 USD (just below the 10,000 USD CTR reporting threshold)

    OR

  • Range 2: five or more transactions from 2,900 to 3,000 USD (just below or at the 3,000 USD threshold)

    OR

  • Range 3: five or more transactions from 4,900 to 5,000 USD (just below or at the 5,000 USD threshold)

If any single range contains ten or more transactions, the pattern is considered suspicious. All involved transactions within the flagged range are updated with the REQUIRES_FURTHER_INVESTIGATION transaction status, and the following transaction comment is added: Potential structuring - withdrawals just below reporting thresholds.

info

The rule evaluates the ranges in the following order: Range 1, Range 2, Range 3. It only flags the range that meets the threshold of ten transactions.

JUST_UNDER_THRESHOLD_DEPOSITS

The rule detects potential structuring behavior where customers receive specific dollar amounts that fall just below common regulatory reporting thresholds. Structuring, also known as smurfing, is an attempt to avoid triggering Currency Transaction Reports (CTRs) or other regulatory scrutiny by deliberately keeping transaction amounts under key thresholds.

The trigger conditions are as follows:

• Range 1: three or more transactions from 9,000 to 9,999 USD, which is just below the 10,000 USD CTR reporting threshold.

  OR

• Range 2: five or more transactions from 2,900 to 3,000 USD, which is just below or at the 3,000 USD threshold.

  OR

• Range 3: five or more transactions from 4,900 to 5,000 USD, which is just below or at the 5,000 USD threshold.

When the rule is triggered, all involved transactions within the flagged range are updated with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Potential structuring - cash deposits just below reporting thresholds.

info

The rule evaluates the ranges in the following order: Range 1, Range 2, Range 3. It only flags the range that meets the threshold of ten transactions.

OUT_OF_STATE_WITHDRAWALS

The rule detects potentially suspicious patterns of ATM withdrawals that occur outside the customer's registered states of residence. A pattern of multiple withdrawals in unfamiliar locations might indicate account compromise, card theft, or unauthorized account access.

The trigger conditions are as follows:

• Five or more ATM withdrawals occur in states other than the customer's registered state(s) of residence based on the addresses on file.

If the condition is met, all involved out-of-state ATM withdrawals are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: ATM withdrawals in out-of-state locations - verify geographic plausibility.

info

The threshold of five transactions helps distinguish between normal occasional travel and patterns that warrant closer examination.

NON_US_INTERNATIONAL_TRANSFERS

The rule identifies outgoing international transfers initiated by domestic customers.

The trigger conditions are as follows:

• The customer is US-based (domestic).

  AND

• The counterparty country is not the US (international recipient).

  AND

• Rule processing is not complete.

If the conditions are met, all involved transactions are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: International transfer by domestic customer - verify business justification.

RAPID_P2P_VELOCITY

The rule detects high-velocity peer-to-peer transaction activity that can indicate money mule operations or pass-through accounts used for money laundering. It identifies accounts with rapid inflows and outflows, suggesting they are being used to move money rather than for legitimate banking.

The trigger conditions are as follows:

• The rule uses a sliding three-day window analysis and is triggered when all of the following occur within any three-day period:

  • At least ten incoming P2P deposits totaling 6,000 USD or more.

  AND

  • At least ten outgoing P2P payments totaling 6,000 USD or more.

If the conditions are met, the transactions are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: High velocity P2P activity - potential money mule or structuring.

ROUND_DOLLAR_WITHDRAWALS

The rule detects suspicious patterns of transactions in exact round dollar amounts (multiples of 100 USD). While occasional round-dollar transactions are normal, a pattern of many such transactions might indicate automated fraud, money mule operations, or coordinated schemes using predetermined amounts.

The trigger conditions are as follows:

• Ten or more transactions have amounts that are exact multiples of 100 USD, such as 100.00 USD, 500.00 USD, or 1,000.00 USD.

• Ten or more transactions have entry methods as In branch, AND the transaction code description contains ATM Withdrawal.

If the conditions are met, all round-dollar transactions are updated with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Pattern of round-dollar ATM withdrawals - potential structuring.

ROUND_DOLLAR_DEPOSITS

The rule detects suspicious patterns of deposits in exact round dollar amounts (multiples of 100 USD). While occasional round-dollar deposits are normal, a pattern of many such deposits might indicate structuring, money laundering, or coordinated schemes using predetermined amounts.

The trigger conditions are as follows:

• Ten or more cash deposit transactions have amounts that are exact multiples of 100 USD (for instance, 100.00 USD, 500.00 USD, 1,000.00 USD).

  AND

• The transaction code description contains Deposit.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Transaction comment is appended with "Pattern of round-dollar deposits - potential structuring.

UNUSUAL_OUTGOING_PATTERNS

The rule detects suspicious outgoing transaction patterns that might indicate fraud, scams, account takeover, or money laundering. It monitors multiple red flags commonly associated with various fraud schemes.

The trigger conditions are as follows:

• Ten or more transactions are in exact round-dollar amounts (multiples of 100 USD).

  OR

• 35 or more outgoing transactions totaling 5,000 USD or more occur.

  OR

• Any cashier's check transaction of 10,000 USD or more is detected.

  OR

• Any cryptocurrency-related transaction is detected (for example, Coinbase, Binance, and so on).

If any of the conditions is met, involved transactions are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Outgoing transactions meet predefined thresholds related to transaction amount, volume or transaction types (cashier’s check or crypto-related).

UNEMPLOYMENT_CONCURRENT_PAYROLL

The rule detects accounts that receive unemployment benefit deposits while also receiving payroll income within a defined time window. Concurrent receipt of unemployment and payroll funds might indicate potential benefit fraud, ineligibility, or delayed reporting of employment status.

The trigger conditions are as follows:

• The transaction list contains at least one transaction with UNEMPLOYMENT identified in the transaction details.

  AND

• The transaction list contains at least one transaction with PAYROLL identified in the transaction details.

  AND

• A payroll deposit occurs within ±30 days of an unemployment deposit.

If any of the conditions is met, involved transactions are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Account receiving both unemployment and payroll deposits - potential fraud or ineligibility.

UNEMPLOYMENT_OFFSHORE_EXIT

The rule identifies potential misuse of unemployment benefits where incoming unemployment funds are rapidly transferred to offshore destinations. Such behavior might indicate fraud proceeds being moved abroad or money mule activity.

The trigger conditions are as follows:

• The transaction list contains an incoming transaction identified as unemployment-related (transaction details contain the UNEMPLOYMENT indication).

  AND

• One or more outgoing transactions are sent to a non-US country.

  AND

• The outgoing foreign transaction occurs within 14 days following the unemployment deposit.

  AND

• The outgoing transaction amount is at least 50% of the unemployment deposit amount.

If the conditions are met, involved transactions are flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the transaction comment is added: Unemployment funds sent offshore - potential fraud proceeds or money mule activity.

UNEMPLOYMENT_CUSTOMER_STATE_VALID

The rule identifies unemployment benefit transactions that are consistent with the customer or a close associated party, even when the benefit originates from a state different from the customer's current residence. The rule is intended to reduce false positives by recognizing legitimate unemployment benefit scenarios.

The trigger conditions are as follows:

• The transaction counterparty relationship is Presumed Same Person, or Presumed Known Associate, or Presumed Same Family Member.

  AND

• The transaction description contains the UNEMPLOYMENT keyword.

  AND

• The transaction location does not match any of the customer's known states of residence.

If the conditions are met, the transaction is flagged with the LOW_RISK transaction status, and the following transaction comment is added: Unemployment benefits match customer or spouse from state of residence.

UNEMPLOYMENT_WRONG_STATE

The rule detects unemployment benefit transactions originating from a state where the customer has no known residence. Such activity might indicate identity theft, fraudulent unemployment claims, or misuse of customer identity information.

The trigger conditions are as follows:

• The transaction description contains the UNEMPLOYMENT keyword.

  AND

• The transaction location does not match any known state of residence.

If the conditions are met, the transaction is flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Unemployment benefits from state where customer does not reside - potential identity theft.

KNOWN_TRANSACTION_METHOD_PATTERNS

The rule identifies transactions processed through recognized and commonly used transaction methods that meet predefined low-risk criteria. Transactions executed via standard channels or internal system processes are often routine in nature and, when combined with small amounts or expected descriptive indicators, generally do not warrant further investigation.

The trigger conditions are as follows:

• The transaction includes the TransactionMethod value in its additional details.

  AND

• The TransactionMethod value is one of the following:

  • POS

  • ACH

  • In Branch

  • System

  AND

• For POS, ACH, or In Branch transactions, the transaction amount is 500 USD or less.

  OR

• For System transactions, the transaction amount is 500 USD or less.

  OR

• The transaction description contains an approved keyword, such as Deposit Loan, Investment sweep, Interest Rate, Interest Deposit, Principal, or Correction.

If the conditions are met, the transaction is flagged with the LOW_RISK status, and the following transaction comment is added: Transaction processed via a known transaction method and meets predefined expected criteria.

CASH_FUNNEL_OFFSHORE_ACTIVITY

The rule detects outgoing cash or cash-like transaction activity conducted offshore or in a different jurisdiction than the customer's known place of residence. Such behavior can indicate attempts to move funds across borders to evade controls, obscure the source of funds, or support money laundering layering activities.

The trigger conditions are as follows:

• The transaction type is ATM Withdrawal, or ACH Deposit, or ACH Payment.

  AND

• The transaction location does not match any known customer's state of residence.

  OR

• The transaction country does not match any known customer's country of residence.

If the conditions are met, the transaction is flagged with the REQUIRES_FURTHER_INVESTIGATION status, and the following transaction comment is added: Outgoing activity conducted offshore or in different jurisdiction than customer residence.

No-code rules

You can configure the no-code rules for transaction monitoring and fraud detection flows in the Transaction Monitoring Alert Investigation Business Process. To do this, find Transformation steps that evaluate transactions against configured criteria and produce decisions such as risk classification or escalation for further investigation.

For information on adding, modifying, and deleting no-code rules, see Configure no-code Transformation step.

info

Make sure to enable the rule engine during Isaac's configuration. If the rule engine is disabled, Isaac will not apply the no-code rules to the transaction data.

You can use the following no-code rules:

Rule	Description
NON-US SOURCE	Identifies transactions associated with non-US countries.
LOW RISK-TRANSACTION DESCRIPTION KEYWORDS	Flags transactions with descriptions containing predefined low-risk keywords.
EIFT-FEE CHARGE OR INTERNAL TRANSFER	Identifies fee charges or internal transfers as low-risk sources of funds.
EIFT-LOW ATM WITHDRAWALS	Flags small ATM withdrawals below 100 USD as low risk.
CASH FUNNEL-PAYROLL OR P2P SOURCE	Identifies cash funnel activity funded by payroll or P2P sources linked to the customer.
EIFT-SOURCE MATCHES CUSTOMER OR SPOUSE	Identifies transactions where the source matches the customer or an immediate family member.
CROSS BORDER-PAYROLL OR P2P SOURCE	Identifies international transactions funded by payroll or P2P sources linked to the customer.
HIGH RISK COUNTRY-PAYROLL OR P2P SOURCE	Identifies payroll or P2P transactions involving high-risk countries.
EIFT-COMPLETE NAME MISMATCH	Detects large transactions from unknown parties with name mismatches.
EIFT-THIRD PARTY SOURCE	Identifies significant transactions originating from third parties.
CROSS BORDER-THIRD PARTY SOURCE	Identifies international transactions funded by unknown third parties.
CASH FUNNEL-THIRD PARTY SOURCE	Identifies cash funnel activity involving unknown third-party sources.
CASH FUNNEL-MERCHANT DISPUTES	Identifies merchant dispute credits potentially followed by suspicious activity.
INCOMING P2P-LARGE SINGLE DEPOSIT	Detects large incoming P2P deposits.
UNEMPLOYMENT-THIRD PARTY NAME	Identifies unemployment deposits from unknown third parties.
CIB-THIRD PARTY SOURCE	Detects large third-party transactions during behavioral changes.
EIFT-LARGE TAX REFUND	Identifies unusually large tax refund deposits.
EIFT-ACH RETURNS DETECTED	Detects ACH return activity.
EOFT-HIGH RISK COUNTRY	Identifies transactions involving high or very high-risk jurisdictions.
EOFT-VIRTUAL CURRENCY	Identifies transactions involving virtual currency platforms.
INCOMING P2P-THIRD PARTY ORIGINATOR	Identifies incoming P2P payments from unknown third parties.
TRAFFICKING-EXPENSE PATTERN COMBINATION	Detects combinations of expense patterns associated with potential trafficking.
LOW RISK-CHECK DEPOSIT	Identifies low-value check deposits.
HIGH RISK-CHECK DEPOSIT	Identifies check deposits of 100 USD or more.

NON-US SOURCE

The rule identifies transactions originating from or associated with non-US countries. Transactions involving foreign jurisdictions might require additional scrutiny, depending on the customer profile and activity context.

The trigger conditions are as follows:

• The transaction country is not equal to the United States of America.

  OR

• The transaction country is not equal to the US.

When the rule is triggered, the following transaction comment is added: Non-US Transaction.

LOW RISK-TRANSACTION DESCRIPTION KEYWORDS

The rule identifies transactions where descriptions contain known low-risk keywords consistent with the expected and legitimate customer activity.

The trigger conditions are as follows:

• The transaction type is credit card.

  AND

• The transaction description contains one or more predefined low-risk keywords:

  • Insurance
  • Billpay
  • Tax Payment
  • Transfer from Credit Karma Savings
  • Transfer to Credit Karma Savings
  • Transfer from Credit Karma Checking
  • Transfer to Credit Karma Checking
  • Internal
  • Deposit Loan
  • Investment sweep
  • Interest Rate
  • Interest Deposit
  • Principal
  • Correction
  • Transfer to DDA
  • Transfer from DDA
  • Title
  • Settlement
  • Mortgage
  • Investment
  • Payroll
  • CD
  • Closure/Closing

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Transaction description contains known low-risk keywords consistent with expected activity. The rule processing is marked as complete.

EIFT-FEE CHARGE OR INTERNAL TRANSFER

The rule identifies transactions that originate from fee charges or internal transfers that are typically low-risk in nature.

The trigger conditions are as follows:

• The transaction type is a fee charge.

  OR

• The transaction is an internal transfer.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Source of funds from either fee charge or internal transfer. Rule processing is marked as complete.

EIFT-LOW ATM WITHDRAWALS

The rule identifies small ATM withdrawals that fall below common reporting thresholds and are generally considered low-risk.

The trigger conditions are as follows:

• The transaction type is ATM withdrawal.

  AND

• The transaction amount is less than 500 USD.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Less than $500 ATM withdrawal amount. Rule processing is marked as complete.

CASH FUNNEL-PAYROLL OR P2P SOURCE

The rule identifies cash funnel activity where the source of funds is linked to the customer through payroll or peer-to-peer transfers.

The trigger conditions are as follows:

• The inter-account relationship indicates the same person or a family member.

  OR

• The transaction description contains payroll or P2P indicators (for instance, PAYROLL, VENMO, ZELLE, CASHAPP).

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Source of funds linked to customer via payroll or P2P. Rule processing is marked as complete.

EIFT-SOURCE MATCHES CUSTOMER OR SPOUSE

The rule identifies transactions where the source of funds matches the account holder or an immediate family member, indicating likely self-transfer behavior.

The trigger conditions is as follows:

• The inter-account relationship indicates the same person or the same family member.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Source of funds matches account holder - likely self-transfer or known recipient. Rule processing is marked as complete.

CROSS BORDER-PAYROLL OR P2P SOURCE

The rule identifies international transactions funded through payroll or P2P sources that are linked to the customer.

The trigger conditions are as follows:

• The inter-account relationship indicates the same person or a family member.

  OR

• The transaction description contains the payroll or P2P indicators.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: International transaction with source linked to customer via payroll or P2P. Rule processing is marked as complete.

HIGH RISK COUNTRY-PAYROLL OR P2P SOURCE

The rule identifies payroll or P2P transactions involving high-risk countries.

The trigger conditions are as follows:

• The inter-account relationship indicates the same person or a family member.

  OR

• The transaction description contains the payroll or P2P indicators.

  AND

• The country risk is high.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: High-risk country transaction with source linked to customer via payroll or P2P. Rule processing is marked as complete.

EIFT-COMPLETE NAME MISMATCH

The rule identifies large transactions from unknown relationships where the counterparty name does not match the customer.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction amount exceeds 5,000 USD.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Complete name mismatch with significant amount - requires investigation.

EIFT-THIRD PARTY SOURCE

The rule identifies significant transactions originating from third parties.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction amount exceeds 1,000 USD.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Third-party source of funds - verify relationship and purpose.

CROSS BORDER-THIRD PARTY SOURCE

The rule identifies international transactions funded by third parties where the relationship to the customer is unknown.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction country is not the US.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: International transaction from third party - requires counterparty identification and relationship review.

CASH FUNNEL-THIRD PARTY SOURCE

The rule identifies cash funnel activity involving funds received from unknown third parties.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction direction is INCOMING.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Source of funds comes from third party - investigate relationship and business purpose.

CASH FUNNEL-MERCHANT DISPUTES

The rule identifies credits resulting from merchant disputes, such as chargebacks or provisional credits, which might be followed by suspicious cash activity.

The trigger condition is as follows:

• The transaction description contains indicators of merchant disputes (for example, PROVISIONAL CREDIT, FINAL CREDIT, CHARGEBACK, DISPUTE).

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Provisional or final credit from merchant dispute - review pattern and subsequent activity.

INCOMING P2P-LARGE SINGLE DEPOSIT

The rule identifies large incoming P2P deposits that might require source verification.

The trigger conditions are as follows:

• The transaction direction is INCOMING.

  AND

• The transaction amount exceeds 3,000 USD.

  AND

• The transaction description indicates the P2P activity.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Large P2P deposit requires source verification and business purpose review.

UNEMPLOYMENT-THIRD PARTY NAME

The rule identifies unemployment benefit deposits received from third-party sources.

The trigger conditions are as follows:

• The transaction description contains UNEMPLOYMENT.

  AND

• The inter-account relationship is UNKNOWN.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Unemployment benefits for third party - potential money mule or identity theft.

CIB-THIRD PARTY SOURCE

The rule identifies large third-party transactions occurring during a period of behavioral change without a legitimate trigger.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction amount exceeds 10,000 USD.

  AND

• The transaction comment does not contain Legitimate trigger event identified.

  AND

• The rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Third-party source during behavior change - verify relationship.

EIFT-LARGE TAX REFUND

The rule identifies unusually large tax refund deposits that might warrant review of subsequent account activity.

The trigger conditions are as follows:

• The transaction amount exceeds 20,000 USD.

  AND

• The transaction description contains tax-related indicators (for example, TAX REFUND, IRS, STATE TAX).

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Large tax refund over $20K - analyze outgoing activity for unusual patterns.

EIFT-ACH RETURNS DETECTED

The rule identifies ACH return activity that may indicate insufficient funds, unauthorized transactions, or account misuse.

The trigger conditions are as follows:

• The transaction code description contains the Automated Clearing House (ACH) return indicators (for instance, Return, NSF, Rxx format).

  AND

• The transaction description does not equal Retry.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: ACH return detected - potential insufficient funds or unauthorized transaction.

EOFT-HIGH RISK COUNTRY

The rule identifies transactions involving high or very high-risk jurisdictions.

The trigger conditions are as follows:

• The country risk is high or very high.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Transfer to high-risk jurisdiction - requires enhanced due diligence.

EOFT-VIRTUAL CURRENCY

The rule identifies transactions involving virtual currency platforms.

The trigger conditions are as follows:

• The transaction description contains known virtual currency indicators (for instance, COINBASE, BINANCE, CRYPTO).

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Virtual currency transaction - assess customer profile alignment.

INCOMING P2P-THIRD PARTY ORIGINATOR

The rule identifies incoming P2P transactions from third parties where the relationship to the customer is unknown.

The trigger conditions are as follows:

• The inter-account relationship is UNKNOWN.

  AND

• The transaction description indicates P2P activity (for instance, VENMO, ZELLE, CASHAPP, P2P).

  AND

• The transaction amount is 500 USD or more.

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: P2P payment from third party - investigate relationship and payment purpose.

TRAFFICKING-EXPENSE PATTERN COMBINATION

The rule identifies a combination of expense patterns that might be indicative of human trafficking or related illicit activity.

The trigger conditions are as follows:

• The transaction descriptions contain indicators across multiple categories, including:

  • Rideshare services (UBER or LYFT)

    AND

  • Food delivery services (UBER EATS or DOORDASH or GRUBHUB)

    AND

  • Lodging services (HOTEL or MOTEL or AIRBNB)

    AND

  • Inmate or identity lookup services (GTL or INMATE or BEEN VERIFIED or BENVERIFIED)

  AND

• Rule processing is not complete.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Combination of rideshare, food delivery, lodging, and inmate/identity lookup indicators found – potential trafficking pattern.

LOW RISK-CHECK DEPOSIT

The rule identifies low-value check deposits that are generally considered low-risk due to their nominal amounts.

The trigger conditions are as follows:

• The transaction code description contains Check.

  AND

• The transaction amount is less than 100 USD.

When the rule is triggered, the transaction status is set to LOW_RISK, and the following transaction comment is added: Check deposit below $100. Rule processing is marked complete`.

HIGH RISK-CHECK DEPOSIT

The rule identifies check deposits of 100 USD or more that require further investigation to verify the counterparty relationship.

The trigger conditions are as follows:

• The transaction code description contains Check.

  AND

• The transaction amount is 100 USD or more.

When the rule is triggered, the transaction status is set to REQUIRES_FURTHER_INVESTIGATION, and the following transaction comment is added: Check deposit $100 or above - verify counterparty relationship.