Detects high-value transactions breaching defined thresholds 1 million that may indicate money laundering, layering, tax evasion, benami activity, or suspicious fund movement inconsistent with the customer’s profile or declared business activity.

Detects rapid and repeated international wire transfer activity occurring within short time intervals, potentially indicating layering, structuring, hawala settlement, offshore fund diversion, or movement of illicit proceeds. The rule identifies abnormal cross-border transaction behavior inconsistent with the customer’s profile, historical activity, or declared business purpose.

Detects transactions involving entities exhibiting shell company characteristics such as limited operational activity, layered ownership structures, abnormal transaction behavior, or financial activity inconsistent with the declared business profile. The rule identifies potential misuse of corporate entities for layering, fund diversion, common beneficial ownership.

Flags accounts receiving international transfers or foreign income that may not be fully reflected in domestic tax declarations. Critical for FEMA compliance and foreign income taxation

Flags accounts that have been inactive for an extended period (e.g., 3 months) and then suddenly show a burst of high-volume or high-value transactions.

Primary rule to classify tax evasion risk based on percentage mismatch between declared income and bank inflows. High risk: >500% mismatch, Medium risk: 125-500% mismatch, Low risk: 1-125% mismatch

Monitors transactions involving Politically Exposed Persons or their known associates, requiring enhanced due diligence especially for high-value or unusual transactions.

Detects cash transactions exceeding ₹50,000 in a single transaction or ₹100,000 in cumulative daily transactions, which may indicate cash structuring or money laundering activities.

Identifies transactions originating from or destined to countries with high AML risk ratings, especially when combined with unusual transaction patterns or amounts.

Flags dormant accounts (inactive for 6+ months) that suddenly receive large deposits followed by immediate outbound transfers, indicating potential account takeover or money mule activity.

Detects suspicious account opening activities such as multiple accounts opened by same individual/entity within short timeframe or accounts with minimal KYC documentation.

Identifies potential trade-based money laundering through over/under invoicing, phantom shipments, or transactions that don't align with typical trade finance patterns.

Detects transactions involving cryptocurrency exchanges, particularly when combined with jurisdictions known for crypto money laundering or when amounts exceed typical retail trading patterns.

If some one tries to make multiple transactions of dividing large funds into smaller chunks it should trigger. For example depositing 50 lakhs into 5 different accounts

Flags transactions occurring during unusual hours (2 AM - 5 AM) especially when combined with high values or international destinations, as this may indicate automated laundering systems.

Detects fund flows that originate from and return to the same or a closely related entity, which can be a sign of round-tripping.

Detects complex fund movements (chains or trees) within the same financial instrument or between a closed loop of accounts to obscure the money trail.

Flags withdrawals to unverified or high-risk cryptocurrency wallets, potentially linked to mixers, tumblers, or sanctioned addresses.

Monitors for an unusually high number of small-value cross-border transactions to multiple beneficiaries from a single account, often used for hawala-type schemes.

Detects multiple cash deposits just below the reporting threshold of ₹10,00,000 to avoid triggering a CTR. This is a common structuring technique.

Detects accounts receiving funds from multiple sources (salary, business, freelance) where total inflows significantly exceed declared income from primary source

Flags scenarios where a large incoming credit is quickly dispersed into multiple smaller transactions to different accounts, a common layering technique.

Detects businesses with unusual spikes in expenses during the last quarter of financial year, potentially indicating artificial expense inflation to reduce taxable income

Flags single transactions that exceed a defined high-value threshold, requiring closer scrutiny.

Identifies businesses with irregular income patterns that don't align with their declared business type, particularly sudden spikes in income near financial year-end

Detects multiple cash deposits just below the reporting threshold of ₹10,00,000 to avoid triggering a CTR. This is a common structuring technique.

Detects businesses with unusual spikes in expenses during the last quarter of financial year, potentially indicating artificial expense inflation to reduce taxable income

Flags multiple small cash withdrawals from various locations by different individuals linked to the same account, a common smurfing tactic.

Identifies businesses with irregular income patterns that don't align with their declared business type, particularly sudden spikes in income near financial year-end

Detects a sudden and significant increase in transaction volume or value for an account that historically has low activity.

Detects unusually large cash deposits in the months leading up to tax filing deadlines (January-March), which may indicate attempt to show legitimate income sources

Identifies funds that leave an account and return to it after passing through a series of at least 3 other entities, indicating potential round-tripping.

Detects unusually large cash deposits in the months leading up to tax filing deadlines (January-March), which may indicate attempt to show legitimate income sources

Detects accounts receiving funds from multiple sources (salary, business, freelance) where total inflows significantly exceed declared income from primary source

Detects accounts making more than 10 transfers within 30 minutes, indicative of mule activity.

Identifies accounts receiving large deposits followed by rapid, smaller outbound transfers to multiple other accounts, indicative of layering.

test new

Identifies a high frequency of transactions occurring during unusual hours (e.g., midnight to 4 AM), which is often indicative of fraudulent activity.

high value transcation

Flags a large insurance claim payout occurring within 30 days of the policy's inception, a potential indicator of insurance fraud.

Identifies suspicious patterns of round-number transactions (multiples of 50,000 or 100,000) which may indicate structured cash management to avoid detection

Identifies suspicious patterns of round-number transactions (multiples of 50,000 or 100,000) which may indicate structured cash management to avoid detection

Flags withdrawals from a different country than last login within 12 hours.

Monitors the ratio of cash deposits to cash withdrawals over a period and flags accounts with abnormal ratios, suggesting potential cash-intensive illicit activities.

Flags accounts with unusually high cash withdrawals during tax preparation period (December-March), which may indicate cash-based unreported transactions

Detects an unusually high number of ATM withdrawals in a short period (e.g., 24 hours), which can be a sign of structuring or cash-out schemes.

Detects any single cash transaction (deposit or withdrawal) where the transaction_amount recorded in CTR data exceeds INR 10,00,000.

Flags accounts with unusually high cash withdrawals during tax preparation period (December-March), which may indicate cash-based unreported transactions

Monitors accounts that have been inactive for over 180 days and suddenly receive a large credit or perform high-velocity transactions.

Detects large transactions from accounts inactive for over 1 year.