E. Geography and high-risk exposure

Where money comes from and goes to matters. Some countries have weak anti-money-laundering controls or are under international sanctions; some border regions are known routes for smuggling and cash. And for fraud, location is one of the strongest signals that someone other than the customer is using an account.

Lists and values here are examples

Which countries count as high-risk is your decision, informed by the FATF lists and your own risk assessment. Values on this page illustrate how the rules behave; see Tuning and calibration.

Rules in this category

ID	Rule	Mode	Status
E1	Transfer to or from high-risk jurisdiction	RT/PE	Ships (core, post-event)
E2	New country for this customer	RT	Ships (fraud, real-time)
E3	Impossible travel	RT	Ships (fraud, real-time)
E4	Activity in border or high-risk region	PE	Ships (gh-psp and gh-bank, post-event)
GB5	Cross-border flow through a high-risk correspondent	PE	Ships (gh-bank, post-event)

---

E1 Transfer to or from high-risk jurisdiction

Ships today: core.high_risk_jurisdiction in the core pack

Needs the high_risk_countries list and stays silent until it has entries. Checks both the transaction’s country and the counterparty’s. min_amount defaults to 0. Exact defaults and logic: Pack contents.

What it looks for: any transaction where the counterparty or the transaction itself is in a country on your high-risk countries list.

Example

With high_risk_countries set to a list based on the current FATF “black” and “grey” lists plus countries your risk assessment adds:

• ✅ Fires: a customer receives GHS 12,000 from a counterparty in a listed country.
• ❌ Does not fire: a transfer to a country that is not on the list.

Parameters

Parameter	Meaning	How to tune
high_risk_countries	The list of countries (a tenant list)	Review whenever FATF publishes updates (several times a year) and record who changed it and why

Mode and pack: post-event, in core.

Keep the list current

FATF updates its lists several times a year. A stale list means the rule silently misses newly listed countries. Assign someone to review it after every FATF plenary.

Data it needs: counterparty country or transaction country, as ISO country codes.

---

E2 New country for this customer

Ships today: fraud.new_country in the fraud pack

Real-time, answers step_up. Fires on a transaction of at least min_amount (default GHS 1,000), in either direction, involving a country this customer has never transacted with, once they have more than min_history (default 10) transactions in the last 90 days. The country is the counterparty’s when sent, otherwise the transaction’s. “Never” means since SpeculaPro started receiving their transactions, up to 180 days of inactivity; there is no lookback setting. Exact defaults and logic: Pack contents.

What it looks for: a transaction involving a country this customer has never transacted with before, above a minimum amount. Fraudsters who take over an account often send money somewhere the real owner never has.

Example

With min_amount GHS 2,000 and lookback 365 days, for a customer who has only ever paid counterparties in Ghana and Togo:

• ✅ Fires: a GHS 6,000 transfer to a counterparty in a country they have never used.
• ❌ Does not fire: a GHS 6,000 transfer to Togo.

Parameters

Parameter	Meaning	How to tune
min_amount	Minimum amount to consider	Avoids alerts for small online purchases
lookback	How far back “never before” looks	Months to a year

Mode and pack: real-time, fraud pack. Ships today.

False positives: travel, first-time online purchases from foreign merchants. Pair with other signals (new device, new payee) for a stronger alert — see H2.

Data it needs: country of counterparty or transaction, customer history.

---

E3 Impossible travel

Ships today: fraud.impossible_travel in the fraud pack

Real-time, answers review. Fires when a transaction’s location is more than min_km (default 100) km from the customer’s previous known location, and getting there in the time between would need more than max_kmh (default 900) km/h. Locations come from geo_lat and geo_lon on transactions only; logins and IP addresses aren’t used yet. Exact defaults and logic: Pack contents.

What it looks for: two logins or transactions from places so far apart that the customer could not have travelled between them in the time available — for example Accra at 10:00 and Lagos at 10:20. One of them is very likely not the customer.

Example

With max_kmh 900 (roughly airliner speed):

• ✅ Fires: a card used in Kumasi and, 25 minutes later, online from an IP address located in another continent.
• ❌ Does not fire: Accra in the morning and Takoradi in the evening.

Parameters

Parameter	Meaning	How to tune
max_kmh / min_minutes	The fastest believable travel speed, or the minimum time between distant events	Remember VPNs and mobile networks can make locations look further apart than they are

Mode and pack: real-time, fraud pack. Ships today.

False positives: VPN users and mobile data routed through another country. E3 works best on card-present transactions and device GPS, and less well on IP addresses alone.

Data it needs: geo_lat and geo_lon (from device GPS, the card terminal, or your own IP geolocation) on transactions, with accurate timestamps. A transaction sent late with a location can look like a jump back in time; see What “new” means.

---

E4 Activity in border or high-risk region

Ships today: gh.border_region in the gh-psp and gh-bank packs

Post-event, alerts about the customer. Fires on a transaction of at least GHS 5,000 through cash, agent, branch or mobile money when its region, district, town or branch region is one of the listed areas. The default list is eleven border crossing towns. Exact defaults and logic: Pack contents.

What it looks for: transactions taking place in areas you treat as higher risk, for example border towns on known smuggling and cash-courier routes.

Example

With the defaults:

• ✅ Fires: a GHS 15,000 agent cash-out whose transaction carries "town": "Aflao".
• ✅ Fires: the same with "district": "aflao": names are matched ignoring case.
• ❌ Does not fire: a GHS 15,000 card payment in Aflao: card isn’t in the default channels.
• ❌ Does not fire: a transaction with no region, district, town or branch region.

Parameters

Parameter	Meaning	How to tune
regions	Areas: towns, districts or regions	Based on your institution’s risk assessment and the national risk assessment
channels	Only these channels; empty means all	Defaults: cash, agent, branch, momo
min_amount	Amount at or above (base currency)	Everyone who lives in a border town transacts there; the amount keeps everyday payments out

The rule also checks the workspace list high_risk_regions, if you create one, so the areas can be kept in a list that several rules share instead of in the rule.

The border-town list is an illustration

The default areas (Aflao, Akanu, Kpetoe, Elubo, Sampa, Paga, Hamile, Kulungugu, Tumu, Bawku and Nkwanta) are well-known crossing points, not a regulatory list. Replace them with the areas your own risk assessment identifies, and confirm the approach with your MLRO.

Mode and pack: post-event, in gh-psp 1.2.0 and gh-bank 1.0.0. If you install both packs, the rule is added once, by whichever pack you install first.

False positives: everyone who lives and trades in those areas. Consider a higher min_amount or a lower severity so it adds weight to other alerts rather than leading the queue alone.

Data it needs: where the transaction happened, as a region, district, town or branch_region attribute on the transaction, for example the agent’s or branch’s town.

---

GB5 Cross-border flow through a high-risk correspondent

Ships today: ghb.correspondent_high_risk in the gh-bank pack

Post-event, alerts about the customer. Fires on a cross-border transaction of at least GHS 10,000, in either direction, whose counterparty’s bank is on your high_risk_correspondents list. Exact defaults and logic: Pack contents.

What it looks for: money moving abroad, or coming in from abroad, through a correspondent bank your institution has rated high risk in its correspondent due diligence.

Example

With the defaults (home_country GH, threshold 10,000), and xyzbaead on the high_risk_correspondents list:

• ✅ Fires: GHS 85,000 sent to the UAE, with the counterparty’s provider sent as XYZBAEAD.
• ❌ Does not fire: the same payment through a bank that isn’t on the list.
• ❌ Does not fire: a domestic transfer, or one whose counterparty has no provider.

Parameters

Parameter	Meaning	How to tune
home_country	Your country’s ISO code	GH
threshold	Amount at or above (base currency)

The banks themselves are in the workspace list high_risk_correspondents (item type text): one entry per bank, matching the counterparty’s provider on your transactions, for example a SWIFT BIC. The match ignores capitals and spaces around an entry (since gh-bank 1.1.0), so XYZBAEAD and xyzbaead both work. Until the list exists and has an entry, the rule never fires. See Lists in rules.

The correspondent list is yours to maintain

Which correspondents count as high risk comes from your own due diligence, which the Bank of Ghana’s AML/CFT&P directive expects you to perform. Confirm the expected scope with your regulator.

Mode and pack: post-event, in gh-bank 1.0.0.

False positives: legitimate trade through a bank you rated high risk for reasons unrelated to this customer. That is expected: the alert is the prompt for enhanced due diligence on the payment.

Data it needs: counterparty_country, and the counterparty’s provider (the bank’s code) on each cross-border transaction.

Related

• F. Customer risk and designations — sanctions and deny-lists
• H. Card and online fraud
• Risk designations and lists
• Tuning and calibration