Rules and Scenarios
15 monitoring rules. Every rule is a plain predicate over aggregated account metrics — no model, no hidden weighting. Switching a rule off rebuilds the alert queue immediately.
Rules enabled
15 / 15
Alerts in the queue
43
Alert threshold
25 points
An account is queued once its combined score reaches this figure.
Rapid Deposit and Withdrawal
AMLR-01Funds arrive and leave again almost immediately with very little gaming in between — the classic pass-through pattern.
Trigger when
- A withdrawal is requested within 60 minutes of a deposit
- Withdrawals exceed 80% of deposited funds
- Gaming turnover is below 20% of deposited funds
- Threshold
- ≤ 60 min · > 80% out · < 20% played
- Risk weight
- +25 points
- Alerts generated
- 1
- Accounts matched
- 1 of 200
Low Gaming Turnover
AMLR-02The account is being used to move money rather than to gamble: deposits are material but almost none of it reaches the games.
Trigger when
- Gaming turnover is below 20% of deposits
- Deposits in the window exceed $10,000
- Threshold
- < 20% turnover on > $10,000
- Risk weight
- +20 points
- Alerts generated
- 7
- Accounts matched
- 7 of 200
Structuring
AMLR-03Deposits are deliberately sized just under the cash reporting threshold and repeated inside a single day.
Trigger when
- At least 3 deposits sized just below $10,000
- Placed within a rolling 24 hour window
- Combined value exceeds $10,000
- Threshold
- ≥ 3 deposits under $10,000 / 24h
- Risk weight
- +20 points
- Alerts generated
- 1
- Accounts matched
- 1 of 200
Income Mismatch
AMLR-04Deposit volume is far beyond what the customer's declared income could reasonably support, so source of funds is unexplained.
Trigger when
- Deposits in a rolling 30 day window exceed 10× declared monthly income
- Threshold
- > 10× declared monthly income
- Risk weight
- +20 points
- Alerts generated
- 11
- Accounts matched
- 25 of 200
Shared Device
FraudR-05More accounts than a household would explain are operating from the same device fingerprint.
Trigger when
- More than 3 accounts use the same device fingerprint
- Threshold
- > 3 accounts per device
- Risk weight
- +15 points
- Alerts generated
- 13
- Accounts matched
- 13 of 200
Shared Payment Method
FraudR-06The same card, bank account or crypto wallet funds or receives money for more than one account.
Trigger when
- The same payment instrument is used by two or more accounts
- Applies to cards, bank accounts and crypto wallets
- Threshold
- ≥ 2 accounts per instrument
- Risk weight
- +15 points
- Alerts generated
- 23
- Accounts matched
- 30 of 200
Multiple Accounts
FraudR-07One person appears to control several accounts: the same identifiers repeat across two or more categories.
Trigger when
- At least 3 linked accounts
- Linkage spans two or more identifier types (device, IP, instrument, contact detail)
- Threshold
- ≥ 3 linked accounts across ≥ 2 identifier types
- Risk weight
- +15 points
- Alerts generated
- 17
- Accounts matched
- 17 of 200
High Transaction Velocity
AMLR-08An unusual burst of financial transactions in a very short period, often automation or an attempt to fragment activity.
Trigger when
- More than 20 financial transactions inside one hour
- Threshold
- > 20 transactions / hour
- Risk weight
- +15 points
- Alerts generated
- 2
- Accounts matched
- 3 of 200
Bonus Abuse
FraudR-09Linked accounts farm the same promotion, meet the wagering requirement with minimal risk and withdraw the proceeds.
Trigger when
- Two or more linked accounts claim the same promotion code
- The accounts share a device, IP address or payment instrument
- Threshold
- ≥ 2 linked accounts on one promotion
- Risk weight
- +15 points
- Alerts generated
- 4
- Accounts matched
- 4 of 200
Chip Dumping
Gaming IntegrityR-10Value moves consistently in one direction between two connected accounts through peer-to-peer play, which transfers funds rather than gambles them.
Trigger when
- At least 5 head-to-head sessions with the same opponent
- Net value transferred exceeds $10,000
- Threshold
- ≥ 5 sessions · > $10,000 net
- Risk weight
- +20 points
- Alerts generated
- 2
- Accounts matched
- 2 of 200
Collusion Pattern
Gaming IntegrityR-11Two accounts repeatedly meet at the same tables far more often than random matchmaking would produce.
Trigger when
- At least 8 sessions against the same opponent
- The two accounts also share at least one identifier
- Threshold
- ≥ 8 shared sessions with a linked account
- Risk weight
- +20 points
- Alerts generated
- 2
- Accounts matched
- 2 of 200
Money Mule Pattern
AMLR-12Funds pass straight through the account to an instrument registered to somebody else, usually alongside other connected accounts.
Trigger when
- At least one payment instrument is registered to a third party
- Withdrawals exceed 85% of deposits, or value arrives through connected-account play
- The account is linked to at least one other account
- Threshold
- Third-party instrument + > 85% pass-through
- Risk weight
- +20 points
- Alerts generated
- 14
- Accounts matched
- 14 of 200
High-Risk Geography
AMLR-13The customer, the source of funds or the payout destination touches a jurisdiction on the operator's elevated-risk list.
Trigger when
- The registered country is on the high-risk list, or
- A deposit source or withdrawal destination is in a high-risk country
- Threshold
- Any high-risk jurisdiction in the customer or money flow
- Risk weight
- +10 points
- Alerts generated
- 6
- Accounts matched
- 13 of 200
Sanction Name Match
ScreeningR-14The customer name matched a sanctions watchlist entry during screening and has not yet been adjudicated.
Trigger when
- Screening returned a sanctions name match that is still open
- Threshold
- Any unresolved sanctions match
- Risk weight
- +50 points
- Alerts generated
- 4
- Accounts matched
- 4 of 200
PEP Match
ScreeningR-15The customer is a politically exposed person or a close associate, which requires enhanced ongoing monitoring.
Trigger when
- Screening returned a politically exposed person match
- Threshold
- Any PEP match
- Risk weight
- +25 points
- Alerts generated
- 8
- Accounts matched
- 8 of 200
Risk Score Bands
Points from every rule that fires are summed and capped at 100.
- Low0–29
- Medium30–49
- High50–69
- Critical70–100
Standing Scoring Factors
Applied alongside the rules; not switchable.
Previous Alert History
+10Applied when the account raised one or more alerts before the current monitoring window. It is a scoring factor rather than a detection rule, so it cannot be switched off.
Jurisdiction risk tiers used by the high-risk geography rule are illustrative for this demonstration only. They do not represent FATF, EU or any other official listing, and would be replaced by the operator's own country risk policy in production.
Synthetic data for demonstration purposes only. Thresholds shown here are demonstration values and are not calibrated against any real portfolio.