Skip to content

E. Geography and high-risk exposure

Where money comes from and goes to matters. Some countries have weak anti-money-laundering controls or are under international sanctions; some border regions are known routes for smuggling and cash. And for fraud, location is one of the strongest signals that someone other than the customer is using an account.

Rules in this category

Section titled “Rules in this category”
ID Rule Mode Status
E1 Transfer to or from high-risk jurisdiction RT/PE Ships (core, post-event)
E2 New country for this customer RT Ships (fraud, real-time)
E3 Impossible travel RT Ships (fraud, real-time)
E4 Activity in border or high-risk region PE Ships (gh-psp and gh-bank, post-event)
GB5 Cross-border flow through a high-risk correspondent PE Ships (gh-bank, post-event)

E1 Transfer to or from high-risk jurisdiction

Section titled “E1 Transfer to or from high-risk jurisdiction”

What it looks for: any transaction where the counterparty or the transaction itself is in a country on your high-risk countries list.

Example

With high_risk_countries set to a list based on the current FATF “black” and “grey” lists plus countries your risk assessment adds:

  • ✅ Fires: a customer receives GHS 12,000 from a counterparty in a listed country.
  • ❌ Does not fire: a transfer to a country that is not on the list.

Parameters

Parameter Meaning How to tune
high_risk_countries The list of countries (a tenant list) Review whenever FATF publishes updates (several times a year) and record who changed it and why

Mode and pack: post-event, in core.

Data it needs: counterparty country or transaction country, as ISO country codes.

E2 New country for this customer

Section titled “E2 New country for this customer”

What it looks for: a transaction involving a country this customer has never transacted with before, above a minimum amount. Fraudsters who take over an account often send money somewhere the real owner never has.

Example

With min_amount GHS 2,000 and lookback 365 days, for a customer who has only ever paid counterparties in Ghana and Togo:

  • ✅ Fires: a GHS 6,000 transfer to a counterparty in a country they have never used.
  • ❌ Does not fire: a GHS 6,000 transfer to Togo.

Parameters

Parameter Meaning How to tune
min_amount Minimum amount to consider Avoids alerts for small online purchases
lookback How far back “never before” looks Months to a year

Mode and pack: real-time, fraud pack. Ships today.

False positives: travel, first-time online purchases from foreign merchants. Pair with other signals (new device, new payee) for a stronger alert — see H2.

Data it needs: country of counterparty or transaction, customer history.

E3 Impossible travel

Section titled “E3 Impossible travel”

What it looks for: two logins or transactions from places so far apart that the customer could not have travelled between them in the time available — for example Accra at 10:00 and Lagos at 10:20. One of them is very likely not the customer.

Example

With max_kmh 900 (roughly airliner speed):

  • ✅ Fires: a card used in Kumasi and, 25 minutes later, online from an IP address located in another continent.
  • ❌ Does not fire: Accra in the morning and Takoradi in the evening.

Parameters

Parameter Meaning How to tune
max_kmh / min_minutes The fastest believable travel speed, or the minimum time between distant events Remember VPNs and mobile networks can make locations look further apart than they are

Mode and pack: real-time, fraud pack. Ships today.

False positives: VPN users and mobile data routed through another country. E3 works best on card-present transactions and device GPS, and less well on IP addresses alone.

Data it needs: geo_lat and geo_lon (from device GPS, the card terminal, or your own IP geolocation) on transactions, with accurate timestamps. A transaction sent late with a location can look like a jump back in time; see What “new” means.

E4 Activity in border or high-risk region

Section titled “E4 Activity in border or high-risk region”

What it looks for: transactions taking place in areas you treat as higher risk, for example border towns on known smuggling and cash-courier routes.

Example

With the defaults:

  • ✅ Fires: a GHS 15,000 agent cash-out whose transaction carries "town": "Aflao".
  • ✅ Fires: the same with "district": "aflao": names are matched ignoring case.
  • ❌ Does not fire: a GHS 15,000 card payment in Aflao: card isn’t in the default channels.
  • ❌ Does not fire: a transaction with no region, district, town or branch region.

Parameters

Parameter Meaning How to tune
regions Areas: towns, districts or regions Based on your institution’s risk assessment and the national risk assessment
channels Only these channels; empty means all Defaults: cash, agent, branch, momo
min_amount Amount at or above (base currency) Everyone who lives in a border town transacts there; the amount keeps everyday payments out

The rule also checks the workspace list high_risk_regions, if you create one, so the areas can be kept in a list that several rules share instead of in the rule.

Mode and pack: post-event, in gh-psp 1.2.0 and gh-bank 1.0.0. If you install both packs, the rule is added once, by whichever pack you install first.

False positives: everyone who lives and trades in those areas. Consider a higher min_amount or a lower severity so it adds weight to other alerts rather than leading the queue alone.

Data it needs: where the transaction happened, as a region, district, town or branch_region attribute on the transaction, for example the agent’s or branch’s town.

GB5 Cross-border flow through a high-risk correspondent

Section titled “GB5 Cross-border flow through a high-risk correspondent”

What it looks for: money moving abroad, or coming in from abroad, through a correspondent bank your institution has rated high risk in its correspondent due diligence.

Example

With the defaults (home_country GH, threshold 10,000), and xyzbaead on the high_risk_correspondents list:

  • ✅ Fires: GHS 85,000 sent to the UAE, with the counterparty’s provider sent as XYZBAEAD.
  • ❌ Does not fire: the same payment through a bank that isn’t on the list.
  • ❌ Does not fire: a domestic transfer, or one whose counterparty has no provider.

Parameters

Parameter Meaning How to tune
home_country Your country’s ISO code GH
threshold Amount at or above (base currency)

The banks themselves are in the workspace list high_risk_correspondents (item type text): one entry per bank, matching the counterparty’s provider on your transactions, for example a SWIFT BIC. The match ignores capitals and spaces around an entry (since gh-bank 1.1.0), so XYZBAEAD and xyzbaead both work. Until the list exists and has an entry, the rule never fires. See Lists in rules.

Mode and pack: post-event, in gh-bank 1.0.0.

False positives: legitimate trade through a bank you rated high risk for reasons unrelated to this customer. That is expected: the alert is the prompt for enhanced due diligence on the payment.

Data it needs: counterparty_country, and the counterparty’s provider (the bank’s code) on each cross-border transaction.

Section titled “Related”