Skip to main content

Condition fields

Every Transaction Monitoring rule is a condition over a namespaced field. The builder groups fields into Transaction, Lists, and Identity. This page is the glossary: what each field means, the unit it uses, and a short example.

Amounts are stored in minor units of the currency (the smallest unit: cents for EUR and USD, pence for GBP). The dashboard label is Amount (minor units) (transaction.amountMinor). It is not a banknote denomination. €10.00 is 1000; €1,000.00 is 100000. Pair amount cutoffs with transaction.currency so a EUR threshold is not applied to a USD payment.

Time fields (hourOfDay, dayOfWeek, isOutsideBusinessHours) are computed in the organization timezone from Settings, not in UTC and not per rule.

Transaction​

FieldMeaningExample
Amount (minor units) (amountMinor)Payment amount in the currency’s smallest unit. Integer, never a decimal euro/dollar amount.amountMinor >= 100000 on EUR is “€1,000 or more”.
CurrencyISO 4217 code of the payment.currency Equals EUR
DirectionDeposit, Withdrawal, or Transfer.direction Equals WITHDRAWAL
Payment statusLifecycle status: Pending, Settled, Failed, Canceled, Reversed.Fire only on Settled.
Hour of day (0–23)Hour in the organization timezone.Night-time: hourOfDay >= 0 AND hourOfDay <= 5
Day of week (1 = Monday)ISO day number in the organization timezone.Weekend: dayOfWeek >= 6
Outside business hoursTrue when the event falls outside weekday business hours in the organization timezone.isOutsideBusinessHours Equals true
Counterparty countryISO 3166-1 alpha-2 of the other leg. Derived from IBAN when you omit it.counterpartyCountry Equals IR
Origin countryCountry on the monitored identity’s side.originCountry Equals IT
Counterparty nameName of the other party.counterpartyName Contains exchange
Counterparty account / IBANAccount identifier of the other party.Used with list hits more often than compared directly.
ChannelHow the payment was initiated (free string, e.g. mobile, branch).channel Equals mobile
RailPayment network or provider (free string, e.g. sepa, open_banking).rail Equals sepa
Payment descriptionFree-text reference / SEPA causale. Keyword lists match against this.description Contains prestito
External IDYour transaction identifier (also the idempotency key).Rarely used in rules.
External user IDYour identifier for the verified identity.Rarely used in rules.

Lists​

List matches are boolean flags computed at ingest against your managed lists. Updating a list updates every rule that references it.

FieldMeaningExample
Counterparty blocklist hitThe counterparty account is on a block list.Hard-block template: blocklistHit Equals true
Counterparty allowlist hitThe counterparty account is on an allow list. Use to suppress noise on known-good flows.allowlistHit Equals true
Any country-risk list hitOrigin or counterparty country is on any enabled country-risk list.countryRiskHit Equals true
Country-risk hit (per list)Same, but for one list key (for example the Italian MEF/BdI set).countryRisk_it_high_risk Equals true
Keyword list hitThe payment description contains a term from a keyword list.keywordHits Equals true

Identity​

These fields come from the verified identity the transaction is tied to, not from the payment payload.

FieldMeaningExample
KYC risk score (%)The identity’s latest Risk score, 0–100.riskScorePercent >= 51 (High or Critical)
Account age (minutes)Minutes since the identity was verified.New account: ageMinutes Less Than 1440 (24 hours)

Fields that are not in the builder yet​

Velocity / frequency counters (velocity.*, for example deposit count in 24 hours) and counterparty screening fields (counterparty.*) are reserved. Templates that depend on them are in the catalog but dormant: they will not fire until those namespaces ship. Amount (minor units) is already available; frequency of small amounts is not.

Additional payload fields (for example ATECO / nature of business) cannot be added from the dashboard today. Send the list of fields you need and they can be wired into the condition palette.