Combining Rules: Creating a Memory Rule

A memory rule combines two rules to link two independent events; these combined rules process events as a single rule. One event is not linked to the other through a transaction, yet there is a need to monitor this. The second parent rule contains both volume and velocity criteria. For memory rules, the order of precedence is important!

To create a memory rule, several different rules need to be created; proceed as detailed in the example below.

Create a rule to analyze if a pre-paid card is used for money laundering by loading the card with funds and then withdrawing those funds.

In this example, two independent events take place:

1. Loading the card.

2. Withdrawing the funds from or spending on the card.

The order or precedence is significant because in this scenario, no alert is necessary if money is first spent and the card loading happens after that!

The memory rules analyze if a card is loaded with an amount which is then withdrawn; two rules are created which are then linked:

The first rule, CL GE3000 in 1 Day, analyzes pending alerts for a card load amount greater than or equal to 3000.

The second rule, ML 3000 Load Then 2800 Spend in 1, analyzes pending alerts for a card loading of greater than or equal to 3000, followed by a card spending transaction that is greater than or equal to 2800.

To monitor such events, two child rules (history criteria) must be created; one is looking for a card spend volume threshold being breached, the other is looking to see if there has been a card load rule match:

• The volume (history) child rule of ML 3000 Load Then 2800 Spend in 1—in our example with the name Card Spend GE2800 in 1 day—analyzes pending alerts where the type of transaction is money being spent with the card.

• The velocity (history) child rule of ML 3000 Load Then 2800 Spend in 1—in our example with the name Memory Link Card Load >= 1 Match—links the loading of the card and the money-spending transactions.

Ensure to select the check box Rule Memory for the second child rule!

Create the "CL GE3000 in 1 Day" and the "ML 3000 Load Then 2800 Spend in 1" rules as explained in Creating basic rules and activate both rules by clicking Toggle Rule.

Create the child rule "Card Spend GE2800 in 1 day" as explained in Creating rules with history criteria with the following criteria:

Transaction type is spending money with the card

1. Click Add in the Create Rule step of the Create Rule and Action Wizard.

2. From the Criteria list menu, select IS - TXN_TYPE_ID - = and an adequate transaction type from the list menu. In this example, Card Spend is used—this option is available because database transaction types of the Risk Analytics instance used for this example have been configured accordingly.

3. Click Save & Next in the Create Rule and Action Wizard.

Transaction greater than (or equal to) USD2800

1. In the Create History Criteria step, ensure that the check box Rule Memory is not selected.

2. From the Value to Sum list menu select AMT_CH_BILL.

3. In the Sum Threshold list menus, set the volume to >= (Volume Greater Than or Equal) and enter 2800; in the Frequency Threshold list menus, set the velocity to >= (Velocity Greater Than or Equal) and enter 0.

4. Set the value for the Days field to 1, and ensure that the values for Hours and Mins are set to 0.

Create the child rule "Memory Link Card Load >= 1 Match Criteria", and add the following criteria

1. In the Create History Criteria step, select the Rule Memory check box.

2. From the Rule list menu, select the rule detecting the card load process, i.e. CL GE3000 in 1 Day.

3. Ensure that the analysis level in the Aggregate By list menu is set to Relationship Level.

4. From the Value to Sum list menu select AMT_CH_BILL.

5. In the Sum Threshold list menus, set the volume to >= (Volume Greater Than or Equal) and enter 0.

6. In the Frequency Threshold list menus, set the velocity to >= (Velocity Greater Than or Equal) and enter 1.

7. Ensure that the value for the Days field to 1, and the values for Hours and Mins must be set to 0.

The defined criteria are now all displayed in the Summary accordion of the Create Rule and Action Wizard dashboard, and the procedure is completed. Complete the Create Rule and Action Wizard, navigate to the rule you have just created, and activate it by clicking Toggle Rule.