Supported Scenarios (System Recommended Thresholds)
The section provides the list of supported scenarios.
The following table provides the list of supported scenarios.
Table 9-2 List of Supported Scenarios
| Scenario Name | Scenario Description | Aggregates+ |
|---|---|---|
| Rapid Movement of Funds – All Activity (RMF) | Money launderers typically move funds between accounts to help integrate the funds and give the appearance of legitimacy. One possible indication of money laundering activity is the rapid movement of funds into and out of an account. The scenario detects both new accounts/customers and more seasoned accounts/customers that move transactions of all types in and out of an account or accounts within a specified Lookback Period. The scenario can take into account the amount or velocity of funds through the account relative to the account balance or net worth. | TOTAL_AMOUNT and TOTAL_COUNT |
| Single or Multiple Cash Transactions: Large Significant Transactions (SigCash) | Money launderers may deposit or withdraw significant amounts of cash, either in a single transaction, or in multiple transactions over a period. Such deposits may not appear to be consistent with the type of account or the declared business or activity that the customer is involved with. This scenario detects instances of large cash deposits or withdrawals (over USD 10,000 or comparable cash reporting threshold for different jurisdictions) and detects smaller, multiple deposits or withdrawals over a specified Lookback Period (typically two weeks or 30 days) that aggregate to a significant amount. The scenario enables detection of structuring activity across branches or locations. Thresholds can be modified to enable application of scenarios to various reporting threshold requirements. | TOTAL_AMOUNT and TOTAL_COUNT |
| Large Reportable Transactions (LRT) | Certain countries require that financial institutions report customer transactions that exceed a specified threshold. These requirements typically pertain to new customer relationships and transactions associated with account opening. They may also pertain to existing customer relationships. Clients may also have internal policies that require the reporting or review of transactions exceeding certain amounts. This scenario detects deposits of any type (across products and asset types), made at account opening or within a certain period after account opening, that exceed a specified threshold. The definition of new account is configurable. The scenario also detects deposits or withdrawals of any type (across products and asset types) in existing accounts that exceed a certain threshold. The scenario detects such transactions involving a single account or multiple accounts that are linked to the customer or household through the client’s house holding process. The scenario provides separate thresholds for each type of relationship (new or existing) that are tunable to support client and country specific regulatory requirements. | TOTAL_AMOUNT |
| CIB: Significant Change from Previous Average Activity (CIB:PAA) | A sudden change in transaction activity may be suspicious and warrant additional investigation. The large number of various types of transactions within an account including funds transfers, checks presented, cash deposits, etc. on a daily basis makes it very difficult to detect changes or anomalies in account activity. The product monitors transaction activity and detects significant changes from the typical activity of an account. This scenario identifies accounts, customers, and correspondent banks that may be considered to be at risk by monitoring electronic funds transfers, check, monetary instrument, cash and journal activity and detecting significant changes from the average of previous monthly transaction activity. | TOTAL_AMOUNT |
| CIB: Significant Change from Previous Peak Activity (CIB:PPA) | A sudden change in transaction activity may be suspicious and warrant additional investigation. The large number of various types of transactions within an account including funds transfers, checks presented, cash deposits, and so forth on a daily basis makes it very difficult to detect changes or anomalies in account activity. The product monitors transaction activity and detects significant changes from the typical activity of an account. This scenario is targeted to accounts, customers, and correspondent banks that have a volatile historical behavior. The scenario monitors electronic funds transfers, check, monetary instrument, cash, and journal transactions; and detects significant changes from the previous monthly peak transaction activity. | TOTAL_AMOUNT |
| CIB: High Risk Geography Activity (CIB:HRG) | A sudden change in transaction activity may be suspicious and warrant additional investigation. The large number of various types of transactions within an account including funds transfers, checks presented, cash deposits, and so forth on a daily basis makes it very difficult to detect changes or anomalies in account activity. The product monitors transaction activity and detects significant changes from the typical activity of an account. This scenario identifies accounts and correspondent banks that may be considered to be at risk by monitoring for electronic funds transfers, check, and monetary instrument activity involving high risk geographies and detecting significant changes from the previous monthly high-risk geography transaction activity. | TOTAL_AMOUNT and HRG_AMOUNT |
| High Risk Transactions: Focal High Risk Entity (HRG:HRE) | Financial institutions must apply enhanced scrutiny to transactions involving high-risk entities, as such activity that may subject the institution to a greater risk of money laundering or fraud. Any account, customer, correspondent bank, or external entity found on a watch list is considered to be a high-risk entity. This scenario monitors transactions to and from high-risk entities during a specified Lookback Period. | TOTAL_HIGH_RISK_AMOUNT and TOTAL_HIGH_RISK_COUNT |
| High Risk Transactions: High Risk Geography (HRG:HRT) | Financial institutions are expected to apply enhanced scrutiny to transactions both to and from areas considered high risk. Because of the large volume and speed of transactions, electronic funds transactions are considered particularly vulnerable to money laundering. This scenario identifies accounts, customer, or entities that may be at risk based on the incidence of electronic funds transfers, cash, checks, or monetary instrument transactions involving specified high-risk geographic areas. | HRG_AMOUNT, HRG_COUNT, TOTAL_AMOUNT, VHRG_AMOUNT, and VHRG_COUNT |
| Deposits/Withdrawals in Same or Similar Amounts | Most deposits and withdrawals of funds into and out of an account are done for specific purposes and, therefore occur in varying amounts. The occurrence of repetitive patterns, or a high percentage, of deposits or withdrawals in the same amount or similar amount, may be unusual activity for the account or customer. This type of activity may indicate attempts to structure funds into the institution or remit funds in a structured manner to fund illicit activities. This scenario detects patterns of deposits and/or withdrawals made in the same or similar amounts that aggregate above specified thresholds. The specification of similar amounts is configurable. | OCCURRENCE_COUNT |
| Anomalies in ATM, Bank Card: Excessive Withdrawals | Bank/Debit cards can be easily used at Automated Teller Machine (ATM) to transfer assets to other individuals or locations due to the anonymity they afford the users. Deposits can be made into accounts in any number of ways and then be removed as currency from almost any location. A sudden increase in the number or amount of ATM deposits and withdrawals may indicate an attempt to launder funds; an increase in ATM withdrawals, or change in the location of ATMs used may also indicate account takeover. Sudden increases in the activity at a certain location may indicate fraudsters’ use of skimmed or compromised Bank/Debit cards. This scenario monitors a sudden increase in the amount of Bank/Debit cards withdrawals at ATMs that may indicate money laundering, terrorist financing, or an account takeover. | TWO_DAY_AVG_AMOUNT and HIST_MONTH_AVG |
| Transactions in Round Amounts | Most electronic funds transfers (EFT) or monetary instruments are done for a specific purpose and, therefore, in a precise amount. The occurrence of a high percentage of transactions in round amounts may be indicative of attempts to launder funds or perpetrate fraud. This scenario detects patterns of EFT or monetary instruments in round amounts that in the aggregate satisfy specified thresholds. | TOTAL_ROUND_AMOUNT, TOTAL_ROUND_COUNT, TOTAL_AMOUNT, and TOTAL_COUNT |
| CIB: Foreign | A sudden change in transaction activity may be suspicious and warrant additional investigation. The large number of various types of transactions within an account including funds transfers, checks presented, cash deposits, and so forth on a daily basis makes it very difficult to detect changes or anomalies in account activity. The product monitors transaction activity and detects significant changes from the typical activity of an account. This scenario identifies accounts and correspondent banks that may be considered to be at risk by monitoring for foreign electronic funds transfers and check transactions and detecting significant changes from the previous monthly foreign transaction activity. | TOTAL_AMOUNT and TOTAL_FOREIGN_AMOUNT |
| CIB: Product Utilization Shift | A sudden change in transaction activity may be suspicious and warrant additional investigation. The large number of various types of transactions within an account including funds transfers, checks presented, cash deposits, and so forth on a daily basis makes it very difficult to detect changes or anomalies in account activity. The product monitors transaction activity and detects significant changes from the typical activity of an account. This scenario identifies accounts and correspondent banks that may be considered to be at risk by monitoring for changes in the types of products that are utilized by the account, (product utilization shift) among electronic funds transfers, check, monetary instrument, cash, and journal transactions. | TOTAL_AMOUNT |
| Rapid Movement of Funds: Funds Transfers (RMF:FTN) | This scenario targets one of the typical behaviors of the placement stage of money laundering, where illegally obtained money from various sources is collected at one place and then disbursed for the purpose of layering. The scenario monitors the activity where funds are funneled into the accounts of one beneficiary from many originators or funds are transferred out by one originator to many beneficiaries. | TOTAL_AMOUNT and TOTAL_COUNT |
| Large Depreciation of Account Value (LDA) | A large and sudden debit, or series of debits, from an account causing a significant depreciation in the account’s net worth could signal account takeover or other type of fraudulent activity. This scenario identifies accounts that experience a significant value depreciation within a specified period. The scenario also distinguishes between new and seasoned accounts based on the account open date. | TOTAL_AMOUNT |
| Single or Multiple Cash Transactions: Possible Currency Transaction Report | Money launderers seeking to place or move funds in the banking system may structure their deposits or withdrawals of cash and cash equivalent monetary instruments to avoid the filing of a CTR. For example, the launderer may make deposits of cash at various branches that aggregate over the CTR threshold, but go unreported because the deposit at each branch did not trigger a reporting action. This scenario detects instances of a single deposit or withdrawal over the CTR threshold, or multiple deposits or withdrawals over the current and previous day that aggregate over the threshold. | TOTAL AMOUNT |
| Anomalies in ATM Bank Card - Foreign Transactions | Bank/Debit cards can be easily utilized at ATMs to
transfer assets to other individuals or locations due to the
anonymity afforded to ATM users. Deposits can be made into accounts
in any number of ways and then be removed as currency from almost
any location. A sudden increase in the number or amount of ATM
deposits and withdrawals may indicate an attempt to launder funds;
an increase in ATM withdrawals, or change in the location of ATMs
used may also indicate account takeover. Sudden increases in the
activity at a certain location may indicate fraudsters’ use of
skimmed or compromised Bank/Debit cards.
This scenario monitors foreign ATM withdrawal activity that could be indicative of money laundering or terrorist financing. |
TOTAL_FOREIGN_COUNT, TOTAL_AMOUNT, and TOTAL_FOREIGN_AMOUNT |
| Anticipatory Profile – Expected Activity | Financial institutions are under increased
regulatory pressure to improve their collection and verification of
customer information, particularly at account opening. The
information collected to support these efforts provides a rich
source of data that can be used to support enhanced profiling
capabilities. Anticipatory profiling is designed to leverage key
parameters that describe anticipated or expected account
activity
This scenario monitors transactions involving client accounts relative to the expected activity involving the account and generates an alert when activity deviates significantly from expected activity. |
TOTAL_AMOUNT, TOTAL_COUNT, and TOTAL_EXPECTED_AMOUNT |
| Escalation in Inactive Accounts | Money launderers may open accounts, deposit illicit
funds, conduct a small number of transactions to test the system,
and then leave the account alone for a period to avoid raising
suspicions. They then remove a significant portion of the balance of
the account, often leaving the remaining balance behind to avoid
detection.
This scenario generates an alert for accounts that are inactive for a predefined period and then have a sudden escalation in activity. It identifies accounts that may be considered to be at risk based on the number, amount, or a large portion of recent transactions in contrast to its previous dormant status. The client’s risk exposure is greater for outgoing funds relative to incoming funds. The system then monitors significant withdrawal activity at more stringent thresholds than deposit activity. |
TOTAL_AMOUNT and TOTAL_COUNT |
| Structuring - Avoidance of Reporting Thresholds | Money launderers seeking to place or move funds in
the banking system may structure their cash monetary instrument, or
wire transactions to avoid reporting requirements, such as the
filing of a currency transaction report (CTR) or other report
required in a given country. The institution may wish to monitor
more closely any accounts, customers, households, or external
entities engaging in such activity.
Oracle detects instances of cash, monetary instrument, or wire transaction(s) in amounts just below applicable reporting thresholds during a specified Lookback Period. The scenario supports the use of multiple threshold sets to accommodate reporting requirements that may differ by country or jurisdiction, as well as to support multiple thresholds within a country or jurisdiction (that is, support of CTR and cash log thresholds can occur simultaneously). |
TOTAL_ATTEMPT_COUNT |
| Anticipatory Profile - Income | Financial institutions are under increased
regulatory pressure to improve their collection and verification of
customer information, particularly at account opening. The
information collected to support these efforts provides a rich
source of data that can be used to support enhanced profiling
capabilities. Anticipatory profiling is designed to leverage key
parameters that describe anticipated or expected account activity.
This scenario monitors all transactions involving the focal customer and generates an alert when the amount of credits into the focal customer’s accounts exceeds a percentage of the monthly income (income as stated by the customer or verified by the client). |
TOTAL_AMOUNT, MONTHLY_INCOME, and TRANSACTIONS_RELATED |
+Based on transactions data to compute threshold for the given scenario.