Static and Match Screening
Definition: a deterministic or fuzzy match against a known reference set.
Construction: a List for internal reference data, and a Sanction for regulatory lists. A Sanction returns a
value, retrieved by GetValueOrThrow, which is compared, and is not a Boolean. Device blacklists are covered here, and
need no separate class. See the Rule Taxonomy.
| Question an analyst asks | Rule Taxonomy type that answers it |
|---|---|
| Is this account on our internal deny list? | Static Screening: a List |
| Is this device on the blacklist? | Static Screening: a List of device identifiers |
| Is this name close to a sanctioned party? | Match Screening: a Sanction |
| Is this name close to a name on our internal watch list? | Match Screening: SomehowInList against a List |
| Does the narrative mention a risky term? | Not this type: Unstructured Text Screening |
Static Screening: Lists
A List is maintained in the Lists page (or by CSV upload, database or API), and referenced from rules by name, without embedding the values in the rule. Lists are synchronised by the engine in the background continuously and do not need a model synchronisation, so a new value applies almost immediately. A List Value can be given a Delete Expiry Date, after which it lapses, which suits temporary blocks. See Lists.
A rule reads a List as List.<Name>, which is a collection of strings, and tests membership with the InList steps of
a pipeline (see the Rule Pipeline Reference). InList is case sensitive, and
InListIgnoreCase is not. Both are null safe, so a missing value fails the test and does not fault the rule:
Matched = Payload.AccountId.MatchInList(List.BadCustomers)
Combined with a threshold, using Against to switch to the amount, keeping the state:
Matched = Payload.AccountId.RequireInList(List.BadCustomers).Against(Payload.CurrencyAmount).MatchGreater(100)
An Accept list exemption, rejecting an event whose device is on a trusted List before any other step runs:
Matched = Payload.DeviceId.RejectInList(List.TrustedDevices).Against(Payload.CurrencyAmount).MatchGreater(1000)
List matching is a whole value match, not a substring or fuzzy match. A Gateway Rule using a List is the cheapest place to stop or route an event, which is also where Accept lists (allow lists) belong, so that trusted parties skip later processing. See Gateway Rules.
Static Screening: Dictionary Lookups
Where the reference data has a numeric value per key, such as a country risk score, use a Dictionary in place of a List. A Dictionary pairs a key from the payload with a value, and returns zero if the key is absent, so encode risk so that zero is the safe default. See Dictionary.
Matched = Dictionary.CountryRisk.MatchGreaterOrEqual(4)
Match Screening: Sanctions
A Sanction definition names a payload field holding a multipart string (a name of space separated tokens, order
insensitive), a maximum Levenshtein Distance, and Max Distance Ratio and Max Coverage Ratio controls. The engine
performs the fuzzy match against the loaded regulatory lists during the invocation, before rules run, and makes the
aggregated distance available as Sanction.<Name>. See Sanctions and
Sanction Searching.
The value is a distance, so smaller is closer, and zero is an exact match. Compare it, and do not treat it as a Boolean:
Matched = Sanction.PartyName.MatchLessOrEqual(1)
A tiered response is two Activation Rules on the same value, each with its own response elevation. An exact match:
Matched = Sanction.PartyName.MatchIsZero()
A near match, using the inclusive InRange test:
Matched = Sanction.PartyName.MatchInRange(1, 2)
When there is no match, or the multipart field is absent from the payload, no value is added for the definition, and
reading Sanction.<Name> throws. A faulting fragment is logged and does not match, per the methodology, so a rule of
this shape is safe, but it logs an exception for every event with no match. That guarding lives in the Sanctions stage
of the invocation pipeline, not in an extension method, and is covered there. The aggregation over multiple matches is
set on the Sanction definition (Sum, Average, Count, Max, Min, First or Last). See the
Rule Pipeline Reference and
Jube.Engine/EntityAnalysisModelInvoke/Context/Extensions/SanctionsExtensions.cs.
Match Screening: Fuzzy Matching Against an Internal List
Sanctions cover regulatory lists. For an internal reference set, such as a watch list of names, use the fuzzy List steps, which compare the payload value with every entry of a List and need no Sanction definition. The default profile folds case, accents and punctuation, then accepts a Jaro-Winkler or token sort similarity of at least 0.92:
Matched = Payload.CustomerName.MatchSomehowInList(List.WatchList)
A tuned profile is written as an options string, where each option is described in the Rule Pipeline Reference. This one tolerates a swapped pair of letters, drops titles, and skips very short names, where similarity is noisy:
Matched = Payload.CustomerName.MatchSomehowInListWith(List.WatchList, "damerau=1,soundex,notitles,minlength=4")
Single algorithm steps exist for the simple cases (LevenshteinInList, DamerauInList, SimilarInList,
JaroWinklerInList, NormalisedInList). An invalid options string fails closed, so nothing matches. Every event is
compared with every entry, so for a large List add firstletter or minlength, and put an exact MatchInList first.
Static and Match Screening: Common Faults
Symptoms of a misbuilt screening rule, with the likely cause.
| Symptom in a screening rule | Likely cause |
|---|---|
| A List never matches | Case or whitespace differs. Use InListIgnoreCase, or normalise the value with Trim and Lower in the pipeline. |
| The Sanction rule never matches | The Distance is too tight; the multipart field is not in the payload; the sanctions lists have not been loaded. |
| The Sanction rule matches too much | Distance is too loose for short names. Tighten Max Distance Ratio. |
| A List change is not applied | Lists sync in the background, but a Dictionary needs a model synchronisation. |
Examples by Sub-Class
Validated. Every fragment in this section is compiled individually through the Jube Parser, with its payload fields and its TTL Counter, Abstraction, Calculation, List and Sanction tokens declared, so each extension method and argument type is checked against the engine. Compilation does not validate a rule’s logic or its thresholds, which are illustrative placeholders to be tuned on data.
6.1 Sanctions screening
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.1-01 | Customer name match to sanctions list | Fuzzy match of customer name against OFAC SDN, UN, EU, UK OFSI and other consolidated lists. | Sanction definition ConsolidatedSanctions over the consolidated regulatory lists, fuzzy on Payload.CustomerName. The sanction entity analysis model is engine-synced; the daily rescreen is the scheduled re-run of this same model, not a fragment. The Activation rule thresholds the match distance (1 is an illustrative placeholder). |
Matched = Sanction.ConsolidatedSanctions.MatchLessOrEqual(1) |
Check: Named regimes (OFAC SDN, UN, EU, UK OFSI) and the consolidation of their lists are regulatory facts: verify which sources are loaded and their update cadence Tag: Screening · AML · Customer · onboarding + daily rescreen |
| 6.1-02 | Beneficiary name match to sanctions list | Payee name screened pre-payment. | Sanction definition BeneficiarySanctions over the same consolidated lists, fuzzy on Payload.BeneficiaryName. A definition names one payload field, so this is a separate definition from the customer one. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.BeneficiarySanctions.MatchLessOrEqual(1) |
Tag: Screening · AML · Beneficiary · per transaction |
| 6.1-03 | Originator name match to sanctions list | Sender in an inbound payment screened. | Sanction definition OriginatorSanctions over the same consolidated lists, fuzzy on Payload.OriginatorName, a separate definition from the customer and beneficiary ones. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.OriginatorSanctions.MatchLessOrEqual(1) |
Tag: Screening · AML · Originator · per transaction |
| 6.1-04 | Intermediary/correspondent bank match to sanctions list | Banks in the payment chain screened. | List SanctionedBics holds the sanctioned bank codes. The intermediaries are a JSON array in Payload.PaymentChainJson, and every element is tested against the list with MatchJsonTextArrayAnyInList, navigating to the array at the path $.intermediaryBics. A single intermediary BIC would be a plain institution-code list test; an any-element screen over a chain needs this step. |
Matched = Payload.PaymentChainJson.MatchJsonTextArrayAnyInList("$.intermediaryBics", List.SanctionedBics) |
Tag: Screening · AML · Bank · per transaction |
| 6.1-05 | BIC/SWIFT code match to sanctioned bank | Deterministic match on BIC. | List SanctionedBicInstitutions holds the institution codes of sanctioned banks. The institution part of the BIC is compared, so branch codes cannot evade the list. IsValidBic can gate the format first. |
Matched = Payload.BeneficiaryBic.BicInstitutionCode().MatchInList(List.SanctionedBicInstitutions) |
Tag: Screening · AML · Bank · per transaction |
| 6.1-06 | Vessel name/IMO match to sanctioned vessels | Trade finance and shipping screening. | Sanction definition VesselSanctions on Payload.VesselName fuzzy, in the first Activation rule. The IMO number is an exact List test, List.SanctionedImoNumbers on Payload.ImoNumber, in a second Activation rule with Matched = Payload.ImoNumber.MatchInList(List.SanctionedImoNumbers). They are kept apart because a Sanction read throws when there is no match, which would fault a combined fragment. IMO check-digit validation has no existing extension and is not needed for the match. |
Matched = Sanction.VesselSanctions.MatchLessOrEqual(1) |
Tag: Screening · AML · Vessel · per transaction |
| 6.1-07 | Aircraft tail number match | Aircraft identifiers against sanctioned lists. | List SanctionedTailNumbers, a case-insensitive whole-value test on Payload.AircraftTailCode. Tail numbers have no validator in the library, so the match is exact against the list only. |
Matched = Payload.AircraftTailCode.MatchInListIgnoreCase(List.SanctionedTailNumbers) |
Tag: Screening · AML · Aircraft · per transaction |
| 6.1-08 | Country or territory sanctioned region match (e.g. comprehensively sanctioned) | Counterparty or payment routed to or from embargoed jurisdictions. | The counterparty country is normalised to alpha-2 with CountryAlpha2, then tested against List EmbargoedJurisdictions, which holds the programme scope. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.EmbargoedJurisdictions) |
Check: Comprehensive embargo scope changes with each programme: verify the current territories and whether sub-territories are included Tag: Screening · AML · Payment · per transaction |
| 6.1-09 | Sectoral/regional sanctions address match | Address within restricted region (e.g. specific regions subject to sanctions). | List RestrictedRegions tested for containment, ignoring case, in Payload.Address. It misses regions written in other scripts or abbreviations unless the list carries those variants. |
Matched = Payload.Address.MatchContainsAnyInListIgnoreCase(List.RestrictedRegions) |
Check: Which regions are restricted, and under which programme, is a regulatory fact: verify against current OFAC, EU and UK programmes Tag: Screening · AML · Address · per transaction |
| 6.1-11 | Digital asset address match to sanctioned wallet | Wallet addresses listed by regulators. | List SanctionedWallets, loaded from the regulator wallet lists, tested as a whole value on Payload.WalletAddress. Base58 addresses are case-sensitive, so they match as held; hex addresses (Ethereum) need a lowercased key on both sides. |
Matched = Payload.WalletAddress.MatchInList(List.SanctionedWallets) |
Check: Regulator-listed digital currency addresses: verify source and loading cadence Tag: Screening · AML · Wallet · per transaction |
| 6.1-12 | Trade goods match to dual-use/controlled items | Goods descriptions matched against export-control lists. | Fuzzy List test of Payload.GoodsDescription against List ControlledGoods. The stricter route is the HS-code prefix test in 6.4-08. |
Matched = Payload.GoodsDescription.MatchSomehowInList(List.ControlledGoods) |
Check: Control-list editions (for example the EU dual-use Annex I) are regulatory and change: verify the edition used Tag: Screening · AML · Trade · per transaction |
| 6.1-13 | Payment narrative match to sanctioned terms/locations | Free-text covered also by class 7; structured fields here. | Structured-field version only. Case-insensitive containment of Payload.PaymentNarrative against List SanctionedTerms. Free-text screening is class 7 scope and is not duplicated here. |
Matched = Payload.PaymentNarrative.MatchContainsAnyInListIgnoreCase(List.SanctionedTerms) |
Tag: Screening · AML · Payment · per transaction |
| 6.1-15 | Transliteration and alias-aware match | Matching across scripts and aliases. | The customer name is transliterated to Latin with TransliterateToLatin, then fuzzy-tested against List SanctionNamesAndAliases, which carries the aliases. Cross-script names (Cyrillic, Arabic, Greek, CJK) need a stateless table-driven transliteration, which the existing normalisers (case, punctuation, diacritics) do not provide. |
Matched = Payload.CustomerName.TransliterateToLatin().MatchSomehowInList(List.SanctionNamesAndAliases) |
Tag: Screening · AML · Customer · per transaction |
| 6.1-16 | Phonetic match (Soundex/Metaphone-style) | Sound-alike names. | Soundex comparison of Payload.CustomerName against List SanctionNames. There is no Metaphone-style code in the library, so phonetic coverage is Soundex’s English-biased behaviour. |
Matched = Payload.CustomerName.MatchSoundexInList(List.SanctionNames) |
Tag: Screening · AML · Customer · per transaction |
| 6.1-17 | Edit-distance match (Levenshtein/Jaro-Winkler) | Typographical variants. | Levenshtein test of Payload.CustomerName against List SanctionNames, allowing a whole number of edits (2 is an illustrative placeholder, from 0 to 10). Jaro-Winkler (MatchJaroWinklerInList) is the alternative for short names. |
Matched = Payload.CustomerName.MatchLevenshteinInList(List.SanctionNames, 2) |
Tag: Screening · AML · Customer · per transaction |
| 6.1-18 | Token-set / reordered-name match | Name order variations and omitted middle names. | Token-set comparison of Payload.CustomerName against List SanctionNames, with a similarity threshold (0.85 is an illustrative placeholder). It handles reordered names and omitted middle names; MatchTokenSortInList is the sorted-token variant. |
Matched = Payload.CustomerName.MatchTokenSetInList(List.SanctionNames, 0.85) |
Tag: Screening · AML · Customer · per transaction |
| 6.1-20 | Sanctions-evasion typology match (front companies, transshipment hubs) | Counterparties in known diversion jurisdictions combined with controlled goods. | Partial. The counterparty country is tested against List DiversionJurisdictions and the goods description against List ControlledGoods, both in one activation rule. Identifying front companies needs entity attributes (shell or nominee indicators) that are external or absent from the payload, so the typology is only partly covered. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.DiversionJurisdictions) And Payload.GoodsDescription.MatchSomehowInList(List.ControlledGoods) |
Check: Diversion-jurisdiction and transshipment-hub lists are judgement-based and sourced from regulator guidance: verify the source and currency Tag: Screening · AML · Trade · per transaction |
6.2 PEP, adverse media and watchlists
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.2-01 | Customer matches PEP list | Politically exposed person identified. | Sanction definition PepList, a separate source from sanctions so the two can be scored and tuned apart, fuzzy on Payload.CustomerName. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.PepList.MatchLessOrEqual(1) |
Check: PEP definition (FATF Recommendation 12 and its local transposition, including whether domestic PEPs are in scope): verify for the jurisdiction Tag: Screening · AML · Customer · onboarding + periodic |
| 6.2-02 | Relative or close associate of PEP match | RCA flagged. | Single event. The declared associates of the customer are supplied upstream as a JSON array in DeclaredAssociatesJson, and tested against the PEP name List. Family definitions vary by regime. | Matched = Payload.DeclaredAssociatesJson.JsonTextArrayAnyInList("$.associates", List.PepNames) |
Check: RCA definition varies by regime (family members and close associates): verify Tag: Screening · AML · Customer · periodic |
| 6.2-03 | Beneficial owner or director is PEP | PEP in ownership chain. | Officer and director names supplied in the KYC payload are screened element by element with MatchJsonTextArrayAnyInList, navigating to $.officerNames, against List PepNames. The PEP source is held as a List because a Sanction is a match distance, not a list of names, so it cannot be the list argument. The indirect ownership chain is outside the payload and needs the graph route. |
Matched = Payload.OfficersJson.MatchJsonTextArrayAnyInList("$.officerNames", List.PepNames) |
Tag: Screening · AML · Entity · onboarding + periodic |
| 6.2-04 | Payment to or from PEP-linked entity | Counterparty is PEP. | Sanction definition PepCounterparty (the PEP source) on Payload.CounterpartyName, a separate definition from the customer one because a definition names one field. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.PepCounterparty.MatchLessOrEqual(1) |
Tag: Screening · AML · Counterparty · per transaction |
| 6.2-05 | Adverse media match | Name appears in negative news categories (financial crime, terrorism, corruption). | Single event. The adverse media categorisation is supplied upstream by the news-screening vendor as AdverseMediaCategory, and tested against the financial-crime category List. | Matched = Payload.AdverseMediaCategory.MatchInList(List.FinancialCrimeCategories) |
Tag: Screening · AML · Customer · periodic |
| 6.2-06 | Law-enforcement watchlist match | Internal or external law enforcement lists. | Sanction definition LawEnforcementWatchlist on Payload.CustomerName, fuzzy. Internal law-enforcement lists can equally load as a List; external ones load as a Sanction source. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.LawEnforcementWatchlist.MatchLessOrEqual(1) |
Check: Access and legal basis for holding law-enforcement watchlists vary by jurisdiction: verify Tag: Screening · AML · Customer · per transaction |
| 6.2-07 | Terrorist financing watchlist match | Specific TF lists (national and international). | Sanction definitions TfInternational and TfNational on Payload.CustomerName, one per list source so each keeps its own source and score. The example shows the international definition; the national one has the same shape with its own name. |
Matched = Sanction.TfInternational.MatchLessOrEqual(1) |
Check: Which TF lists apply (for example the UN 1267/1989 and 1988 regimes and national designations): verify list names and sources Tag: Screening · AML · Customer · per transaction |
| 6.2-08 | Proliferation financing watchlist match | Names, goods, countries linked to proliferation. | Three independent screens: Sanction definition PfNames on Payload.CustomerName, List PfGoods on Payload.GoodsDescription, and List PfCountries on the counterparty country. They are separate Activation rules, because a Sanction read throws when there is no match and would fault a combined fragment. The example shows the name screen. |
Matched = Sanction.PfNames.MatchLessOrEqual(1) |
Check: UN proliferation regimes and their goods and country scope (for example the DPRK and Iran regimes): verify current status Tag: Screening · AML · Customer/Trade · per transaction |
| 6.2-09 | Internal watchlist (previous SAR subjects) | Customer with prior SAR/STR. | Internal, access-restricted List SarSubjects, matched on the internal customer ID rather than the name to limit exposure of SAR status. |
Matched = Payload.CustomerId.MatchInList(List.SarSubjects) |
Check: Tipping-off and SAR confidentiality rules: verify the jurisdiction’s prohibition on disclosing a SAR to the customer, and restrict access to the list accordingly Tag: Screening · AML · Customer · per transaction |
| 6.2-10 | Internal fraud-loss list (confirmed fraudsters) | Applicants/customers linked to previous fraud losses. | Fuzzy List test of Payload.CustomerName against List ConfirmedFraudsters. Date-of-birth corroboration with a Flow equality test is added before a decision. |
Matched = Payload.CustomerName.MatchSomehowInList(List.ConfirmedFraudsters) |
Tag: Screening · Fraud · Customer · onboarding |
| 6.2-11 | Exited customer list | Previously offboarded customer reapplying. | Customer ID match against List ExitedCustomers for returning customers. Name fuzzy matching is secondary. |
Matched = Payload.CustomerId.MatchInList(List.ExitedCustomers) |
Tag: Screening · Both · Customer · onboarding |
| 6.2-12 | Shared industry fraud database match (consortium) | Match against cross-industry data (CIFAS-style/consortium). | Consortium industry fraud database reports a match. Upstream field: Payload.ConsortiumMatchFlag, supplied before Jube or by an inline-script hook. The match flag is supplied by the consortium query. | Matched = Payload.ConsortiumMatchFlag.MatchIsTrue() |
Check: Consortium data-sharing terms and lawful basis (CIFAS-style schemes): verify for the jurisdiction Tag: Screening · Fraud · Customer/Application · onboarding |
| 6.2-13 | Deceased persons register match | Applicant or customer reported deceased. | Name and date of birth appear on the deceased register. Upstream field: Payload.DeceasedRegisterKey, built by the hook from name and date of birth with the String.ConcatWith method, supplied before Jube or by an inline-script hook. List: List.DeceasedRegister, the bulk extract keyed the same way. | Matched = Payload.DeceasedRegisterKey.MatchInList(List.DeceasedRegister) |
Check: Deceased-register access terms and accuracy: verify Tag: Screening · Fraud · Customer · onboarding + periodic |
| 6.2-14 | Politically exposed person risk-tier escalation | Tiered handling based on level of office. | Tier 1 is a fuzzy List test against List PepTier1. Tier 2 is a second Activation rule over List PepTier2 with its own response elevation. Tiers are held as separate Lists rather than combined in one fragment. |
Matched = Payload.CustomerName.MatchSomehowInList(List.PepTier1) |
Check: Tier definitions by level of office are a local policy choice: verify the policy basis Tag: Screening · AML · Customer · periodic |
6.3 Jurisdiction and country risk
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.3-01 | Payment to FATF high-risk jurisdiction | Counterparty in call-for-action jurisdiction. | The counterparty country is normalised with CountryAlpha2, then tested against List FatfCallForAction. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.FatfCallForAction) |
Check: FATF call-for-action list is revised periodically: verify the current membership and effective date Tag: Screening · AML · Payment · per transaction |
| 6.3-02 | Payment to FATF increased-monitoring jurisdiction | Counterparty in grey-list jurisdiction. | The counterparty country is normalised with CountryAlpha2, then tested against List FatfIncreasedMonitoring. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.FatfIncreasedMonitoring) |
Check: FATF increased-monitoring list is revised periodically: verify the current membership and effective date Tag: Screening · AML · Payment · per transaction |
| 6.3-03 | Payment to EU high-risk third country | Per EU list. | The counterparty country is normalised with CountryAlpha2, then tested against List EuHighRiskThirdCountries, maintained from the current EU annex. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.EuHighRiskThirdCountries) |
Check: EU high-risk third-country list is an EU delegated act revised over time: verify the current annex Tag: Screening · AML · Payment · per transaction |
| 6.3-04 | Payment to tax haven/secrecy jurisdiction | Offshore financial centres. | The counterparty country is normalised with CountryAlpha2, then tested against List TaxNonCooperativeJurisdictions. One named source is chosen (the EU list of non-cooperative jurisdictions for tax purposes, or an internal offshore list); the two are not interchangeable. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.TaxNonCooperativeJurisdictions) |
Check: Which secrecy or tax-haven list is adopted: verify the source and date Tag: Screening · AML · Payment · per transaction |
| 6.3-05 | Payment to or from conflict-affected region | Conflict zone exposure. | Country-level only: the counterparty country, normalised with CountryAlpha2, is tested against List ConflictAffectedCountries. Sub-national regions would need a payload region field. |
Matched = Payload.CounterpartyCountry.CountryAlpha2().MatchInList(List.ConflictAffectedCountries) |
Check: Conflict-affected classification is a judgement made by a named source (for example the EU conflict-affected areas list): verify the source Tag: Screening · AML · Payment · per transaction |
| 6.3-06 | Payment to high-corruption-index country | Based on corruption perception index. | Dictionary CorruptionRisk, keyed on the payload field Payload.CounterpartyCountryAlpha2, a field the channel supplies already normalised, because a Dictionary key is a payload field and not an expression. The stored value is inverted from the index (higher is riskier), so that zero, the absent-key default, means no known risk. The threshold is a placeholder policy choice. |
Matched = Dictionary.CorruptionRisk.MatchGreaterOrEqual(40) |
Check: Corruption Perceptions Index scores are published annually by Transparency International: verify the year and the threshold used Tag: Screening · AML · Payment · per transaction |
| 6.3-07 | Payment to high-risk fraud jurisdiction | Country with high fraud losses for the product. | Dictionary FraudLossByCountry, keyed on the normalised country field Payload.CounterpartyCountryAlpha2, holding the internal loss rate. The threshold is an internal calibration (placeholder). |
Matched = Dictionary.FraudLossByCountry.MatchGreater(1) |
Tag: Screening · Fraud · Payment · per transaction |
| 6.3-08 | Customer nationality/residence in high-risk country | Customer attribute risk. | Nationality and residence are separate customer attributes; both are normalised with CountryAlpha2 and tested against List HighRiskCountries. |
Matched = Payload.Nationality.CountryAlpha2().MatchInList(List.HighRiskCountries) Or Payload.ResidenceCountry.CountryAlpha2().MatchInList(List.HighRiskCountries) |
Tag: Screening · AML · Customer · onboarding |
| 6.3-09 | IP geolocation in high-risk country | Session from high-risk country. | Single event. The IP country is supplied upstream by the channel or a GeoIP enrichment as IpCountry, and tested against the high-risk country List. | Matched = Payload.IpCountry.MatchInList(List.HighRiskCountries) |
Tag: Screening · Both · Session · per event |
| 6.3-10 | Card issued in high-risk country transacting domestically | Issuer country mismatch with risk list. | The issuer country is held in the payload as Payload.CardIssuerCountry, normalised with CountryAlpha2, and tested against List HighRiskCountries. The domestic condition is that the issuer country equals the merchant country. A BIN reference Dictionary cannot supply the issuer country, because a Dictionary returns a number, so the payload must carry it. |
Matched = Payload.CardIssuerCountry.CountryAlpha2().MatchInList(List.HighRiskCountries) And Payload.CardIssuerCountry.CountryAlpha2().MatchEqual(Payload.MerchantCountry.CountryAlpha2()) |
Tag: Screening · Fraud · Card · per transaction |
| 6.3-11 | Merchant location in high-risk country | Acquirer-side location. | The acquirer-side merchant country, as supplied in the payload, normalised with CountryAlpha2 and tested against List HighRiskCountries. |
Matched = Payload.MerchantCountry.CountryAlpha2().MatchInList(List.HighRiskCountries) |
Tag: Screening · Both · Merchant · per transaction |
| 6.3-12 | Corridor-based risk (origin–destination pair) | Specific corridors with elevated risk. | The corridor key is origin, a pipe, and destination, built with ConcatWith, and tested against List RiskyCorridors, whose entries are stored in the same form. |
Matched = Payload.OriginCountry.ConcatWith("/", Payload.DestinationCountry).MatchInList(List.RiskyCorridors) |
Tag: Screening · AML · Payment · per transaction |
6.4 Industry, merchant and product risk
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.4-01 | High-risk MCC | Gambling, adult content, crypto, money transfer, pharmacies etc. | The four-digit merchant category code is tested as a whole value against List HighRiskMcc. |
Matched = Payload.MerchantCategoryCode.MatchInList(List.HighRiskMcc) |
Check: Card-scheme high-risk MCC designations change: verify against current scheme lists Tag: Screening · Both · Transaction · per transaction |
| 6.4-02 | High-risk business type (cash-intensive, MSB, casinos, precious metals) | Customer industry on risk list. | Fuzzy List test of Payload.BusinessType against List HighRiskBusinessTypes, because customer-supplied industry labels vary in wording. |
Matched = Payload.BusinessType.MatchSomehowInList(List.HighRiskBusinessTypes) |
Tag: Screening · AML · Customer · onboarding |
| 6.4-03 | Unlicensed money service business indicator | Customer behaves like an MSB without licence. | TTL counter RemittanceOut30Days (Customer key, 30-day interval, Sum setting) is incremented by a separate Activation rule on each outbound remittance. The Activation rule shown reads it, and tests the licence number against List LicensedMsbs. The sum threshold is a placeholder, and a licence number absent from the payload fires the not-in-list test by design. |
Matched = TTLCounter.RemittanceOut30Days.MatchGreater(5000) And Payload.LicenceCode.MatchNotInList(List.LicensedMsbs) |
Check: Regulator MSB registration regimes differ by jurisdiction: verify the register and regime Tag: Screening · AML · Customer · periodic |
| 6.4-04 | High-risk merchant (terminated merchant file, MATCH) | Merchant on terminated list. | Scheme-operated terminated-merchant file loaded as List TerminatedMerchants, tested on Payload.MerchantId. Load it only where the licence allows. |
Matched = Payload.MerchantId.MatchInList(List.TerminatedMerchants) |
Check: Mastercard MATCH is a scheme file with restricted access and use terms: verify the licence and the scheme’s rules Tag: Screening · Fraud · Merchant · onboarding + per transaction |
| 6.4-05 | Payment facilitator sub-merchant risk list | Sub-merchant on risk list. | Sub-merchant identifier from the payment facilitator feed, tested against List SubMerchantRisk. |
Matched = Payload.SubMerchantId.MatchInList(List.SubMerchantRisk) |
Tag: Screening · Fraud · Merchant · per transaction |
| 6.4-06 | Gambling operator unlicensed | Merchant not on licensed operators list. | Negated membership test of Payload.MerchantId against List LicensedGamblingOperators. A presence guard comes first, so a missing merchant ID does not fire. The same guard form applies to every not-in-list row in this section. |
Matched = Payload.MerchantId.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.LicensedGamblingOperators) |
Check: Licensing is per jurisdiction: verify the licence register used Tag: Screening · Both · Merchant · per transaction |
| 6.4-07 | Virtual asset service provider unregistered | VASP not in regulator register. | Unregistered means absent from the regulator register: a presence-guarded not-in-list test of Payload.CounterpartyVaspId against List RegisteredVasps. |
Matched = Payload.CounterpartyVaspId.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.RegisteredVasps) |
Check: VASP registration regimes (national registers, EU MiCA) vary: verify the register used Tag: Screening · AML · Counterparty · per transaction |
| 6.4-08 | Dual-use goods HS code | Customs codes of concern. | Prefix match of Payload.HsCode against List DualUseHsPrefixes, because HS codes are hierarchical. |
Matched = Payload.HsCode.MatchStartsWithAnyInList(List.DualUseHsPrefixes) |
Check: Dual-use HS mapping to the EU Annex I or national control lists is a regulatory mapping: verify the edition Tag: Screening · AML · Trade · per transaction |
| 6.4-09 | High-value goods (jewellery, art, antiques, luxury vehicles) dealer | Dealer in high-value goods. | Fuzzy List test of the dealer category in Payload.BusinessType against List HighValueGoodsDealers, taken from the customer profile. |
Matched = Payload.BusinessType.MatchSomehowInList(List.HighValueGoodsDealers) |
Check: Dealer registration and cash-payment thresholds (EUR 10,000 cash in EU AML rules) vary by jurisdiction: verify the threshold for the jurisdiction Tag: Screening · AML · Customer · onboarding |
| 6.4-10 | Product risk: anonymous prepaid | Product features reduce traceability. | Product-level flag held as List AnonymousPrepaidProducts of product codes, tested on Payload.ProductCode. |
Matched = Payload.ProductCode.MatchInList(List.AnonymousPrepaidProducts) |
Tag: Screening · AML · Product · per transaction |
| 6.4-11 | Charity/NPO sector risk | NPOs with higher TF risk operating areas. | Sector and operating-area lists are tested together: Payload.SectorCode against List NpoSectors, and the operating country, normalised with CountryAlpha2, against List NpoHighRiskAreas. |
Matched = Payload.SectorCode.MatchInList(List.NpoSectors) And Payload.OperatingCountry.CountryAlpha2().MatchInList(List.NpoHighRiskAreas) |
Check: FATF Recommendation 8 frames NPO risk; the high-risk area list is a judgement: verify its source Tag: Screening · AML · Customer · onboarding |
6.5 Blacklists and whitelists of technical attributes
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.5-01 | Blacklisted device identifier | Device linked to confirmed fraud. | Exact List test of Payload.DeviceId against List FraudDevices. |
Matched = Payload.DeviceId.MatchInList(List.FraudDevices) |
Tag: Screening · Fraud · Device · per event |
| 6.5-02 | Blacklisted IP address | IP in internal/external blacklist (botnets, TOR exits, fraud). | NormaliseIpAddress first, so IPv6 and mapped forms match, then an exact List test against BlacklistedIps. |
Matched = Payload.IpAddress.NormaliseIpAddress().MatchInList(List.BlacklistedIps) |
Tag: Screening · Fraud · IP · per event |
| 6.5-03 | Blacklisted IP range / ASN / ISP | Hosting/data-centre ranges. | The IP address is tested against List HostingCidrs with the any-CIDR step, which needs an any-form over the reference list, bounded by list size and stateless. The ASN is an exact List test against HostingAsns. ISP name matches would also be an A. |
Matched = Payload.IpAddress.MatchIsInAnyCidr(List.HostingCidrs) Or Payload.Asn.MatchInList(List.HostingAsns) |
Tag: Screening · Fraud · IP · per event |
| 6.5-04 | Blacklisted browser fingerprint | Fingerprint linked to fraud. | Exact List test of Payload.BrowserFingerprint against List FraudFingerprints. |
Matched = Payload.BrowserFingerprint.MatchInList(List.FraudFingerprints) |
Tag: Screening · Fraud · Fingerprint · per event |
| 6.5-05 | Blacklisted email address | Email linked to fraud. | Alias normalisation (dots and plus-tags) with NormalizeEmailAlias before an exact List test against FraudEmails. List entries are stored normalised. |
Matched = Payload.Email.NormalizeEmailAlias().MatchInList(List.FraudEmails) |
Tag: Screening · Fraud · Email · per event |
| 6.5-06 | Blacklisted email domain (disposable email providers) | Throwaway domains. | The domain part of the address, from EmailDomain, is tested against List DisposableEmailDomains. |
Matched = Payload.Email.EmailDomain().MatchInList(List.DisposableEmailDomains) |
Tag: Screening · Fraud · Email domain · per event |
| 6.5-07 | Blacklisted phone number / VoIP range | Phone numbers or carriers favoured by fraudsters. | Digits-only exact match against List FraudPhones, or a prefix match against List VoipPrefixes. VoIP is detected by number prefix only; carrier or line-type classification is external data, so the VoIP half is partial. |
Matched = Payload.Phone.PhoneNumberDigits().MatchInList(List.FraudPhones) Or Payload.Phone.PhoneNumberDigits().MatchStartsWithAnyInList(List.VoipPrefixes) |
Tag: Screening · Fraud · Phone · per event |
| 6.5-08 | Blacklisted card number / BIN | Compromised cards, high-risk BINs. | The first six digits, from Left(6), are tested against List HighRiskBins. Rules must not store or log the full card number (PCI scope). |
Matched = Payload.CardPan.Left(6).MatchInList(List.HighRiskBins) |
Tag: Screening · Fraud · Card · per transaction |
| 6.5-09 | Blacklisted account number/IBAN | Mule accounts. | The IBAN is normalised for spaces and case with NormalisedForMatching, then tested against List MuleAccounts. |
Matched = Payload.Iban.NormalisedForMatching().MatchInList(List.MuleAccounts) |
Tag: Screening · Both · Account · per transaction |
| 6.5-10 | Blacklisted beneficiary account | Known mule accounts as payees. | The beneficiary IBAN is normalised with NormalisedForMatching and tested against the same List MuleAccounts as the originator-side screen. |
Matched = Payload.BeneficiaryIban.NormalisedForMatching().MatchInList(List.MuleAccounts) |
Tag: Screening · Fraud · Beneficiary · per transaction |
| 6.5-11 | Blacklisted address (drop addresses) | Freight forwarder/reshipper addresses. | Normalised exact List test of Payload.ShippingAddress against List DropAddresses. MatchSomehowInList is the fuzzy alternative for address variants. |
Matched = Payload.ShippingAddress.NormalisedForMatching().MatchInList(List.DropAddresses) |
Tag: Screening · Fraud · Address · per event |
| 6.5-12 | Blacklisted merchant | Compromised or fraudulent merchants. | Exact List test of Payload.MerchantId against List BlacklistedMerchants. |
Matched = Payload.MerchantId.MatchInList(List.BlacklistedMerchants) |
Tag: Screening · Fraud · Merchant · per transaction |
| 6.5-13 | Blacklisted ATM/terminal | Skimmer-affected terminals. | Exact List test of Payload.TerminalId against List SkimmedTerminals. |
Matched = Payload.TerminalId.MatchInList(List.SkimmedTerminals) |
Tag: Screening · Fraud · Terminal · per transaction |
| 6.5-14 | Blacklisted document number | Lost/stolen/forged documents. | The document number is normalised with NormalisedForMatching and tested against List LostStolenDocumentKeys. The list should hold a hashed key, so document numbers are not kept in plain text. |
Matched = Payload.DocumentCode.NormalisedForMatching().MatchInList(List.LostStolenDocumentKeys) |
Tag: Screening · Fraud · Document · onboarding |
| 6.5-15 | Blacklisted user agent/automation signature | Headless browsers, scripts. | Case-insensitive substring match of Payload.UserAgent against List AutomationSignatures. |
Matched = Payload.UserAgent.MatchContainsAnyInListIgnoreCase(List.AutomationSignatures) |
Tag: Screening · Fraud · User agent · per event |
| 6.5-16 | Emulator/rooted/jailbroken device signature | Compromised runtime. | Emulator, rooted or jailbroken device verdict from the device SDK. Upstream field: Payload.IsEmulator, supplied before Jube or by an inline-script hook. Covers emulator; root and jailbreak verdicts use the same test only if supplied as the same flag. | Matched = Payload.IsEmulator.MatchIsTrue() |
Tag: Screening · Fraud · Device · per event |
| 6.5-17 | Screen-share/remote access app detected | Remote control software present. | Installed package names include a remote-access application. Upstream field: Payload.InstalledPackages, a delimited list of package names, supplied before Jube or by an inline-script hook. List: List.RemoteAccessPackages, the package names to look for. | Matched = Payload.InstalledPackages.MatchContainsAnyInListIgnoreCase(List.RemoteAccessPackages) |
Tag: Screening · Fraud · Device · per event |
| 6.5-18 | Malware signature detected in app environment | Overlay/keylogger indicators. | Malware or overlay signature verdict from the mobile threat vendor. Upstream field: Payload.MalwareFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.MalwareFlag.MatchIsTrue() |
Tag: Screening · Fraud · Device · per event |
| 6.5-19 | TOR exit node | IP is TOR exit. | The normalised IP address is tested against List TorExitNodes, refreshed from the public TOR exit list. |
Matched = Payload.IpAddress.NormaliseIpAddress().MatchInList(List.TorExitNodes) |
Tag: Screening · Fraud · IP · per event |
| 6.5-20 | Known VPN/proxy provider | Anonymising network. | Single event. The anonymiser verdict is supplied upstream by the IP-intelligence vendor as the IsAnonymiser payload flag. | Matched = Payload.IsAnonymiser.MatchIsTrue() |
Tag: Screening · Fraud · IP · per event |
| 6.5-21 | Whitelisted trusted device/beneficiary (suppression) | Allow-list to reduce false positives. | Suppression by Break: a BreakInList test of Payload.DeviceId against List TrustedDevices decides the event broken, so it is not matched. Priority matters: this activation rule is ordered after the sanctions, PEP and blacklist rules so it can never suppress them. |
Matched = Payload.DeviceId.BreakInList(List.TrustedDevices) |
Tag: Screening · Both · Device/Beneficiary · per event |
| 6.5-22 | Whitelisted merchant/utility payee | Known benign payees. | Suppression by Break of Payload.BeneficiaryId against List TrustedPayees, known benign utility and merchant payees. The same ordering caution as the trusted-device list applies: it runs after the sanctions, PEP and blacklist rules. |
Matched = Payload.BeneficiaryId.BreakInList(List.TrustedPayees) |
Tag: Screening · Fraud · Beneficiary · per transaction |
| 6.5-23 | Whitelisted corporate payer | Known corporate counterparties for suppression. | Suppression by Break of Payload.CounterpartyId against List TrustedCorporatePayers. It sits after the sanctions rules, because corporate payer suppression must not remove sanctions screening. |
Matched = Payload.CounterpartyId.BreakInList(List.TrustedCorporatePayers) |
Tag: Screening · AML · Counterparty · per transaction |
6.6 Reference-data validity and format checks
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.6-01 | Invalid IBAN checksum | Fails modulus check. | The modulus-97 checksum is applied by the IBAN validator inside the test. | Matched = Payload.Iban.MatchIsNotValidIban() |
Tag: Screening · Both · Beneficiary · per transaction |
| 6.6-02 | BIN/country inconsistent with billing country | Issuer country differs from expected. | Both countries are normalised with CountryAlpha2 and compared. The BIN country is taken from the payload as Payload.BinCountry, because a BIN reference Dictionary returns a number and cannot supply a country code. |
Matched = Payload.BinCountry.CountryAlpha2().MatchNotEqual(Payload.BillingCountry.CountryAlpha2()) |
Tag: Screening · Fraud · Card · per transaction |
| 6.6-03 | Payee name mismatch (confirmation of payee failure) | Name does not match account. | Confirmation-of-payee result is not a match. Upstream field: Payload.CopResult, supplied before Jube or by an inline-script hook. Applies only in jurisdictions where the scheme service exists. | Matched = Payload.CopResult.MatchNotEqual("match") |
Check: CoP is a scheme service in some jurisdictions only (for example the UK and EU verification-of-payee rules): verify applicability Tag: Screening · Fraud · Beneficiary · per transaction |
| 6.6-04 | Invalid or impossible date of birth | Out of range or placeholder. | Invalid or unparseable dates match through the errored outcome of ParseDate, read with IsErrored. Implausibly old dates match through the parsed date tested with MatchOlderThanDays. The age ceiling of 43830 days (about 120 years) is a placeholder, because the parser checks format only, so placeholder dates need explicit bounds. |
Matched = Payload.BornOnText.ParseDate().MatchOlderThanDays(43830) Or Payload.BornOnText.ParseDate().IsErrored() |
Check: The upper age bound is a policy choice: verify the internal limit Tag: Screening · Fraud · Application · onboarding |
| 6.6-06 | Document expired | Expired document supplied. | The document expiry date, a DateTime field, is tested for being in the past. The near-expiry buffer is a business policy and is added as a further pipeline if needed. | Matched = Payload.DocumentExpiryDate.MatchIsPast() |
Tag: Screening · Fraud · Document · onboarding |
| 6.6-07 | Address not found in postal database | Address undeliverable. | Address verification result is negative. Upstream field: Payload.AddressVerifiedFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.AddressVerifiedFlag.MatchIsFalse() |
Tag: Screening · Fraud · Address · onboarding |
| 6.6-08 | Phone number invalid or VoIP | Fails validation. | Partial: format validity only, through IsValidE164PhoneNumber, negated. VoIP classification is external (see 6.5-07). |
Matched = Not Payload.Phone.IsValidE164PhoneNumber() |
Tag: Screening · Fraud · Phone · onboarding |
| 6.6-09 | Company not found in registry | Entity absent from corporate registry. | Company number is not in the registry extract. Upstream field: Payload.CompanyRegistrationCode, supplied before Jube or by an inline-script hook. List: List.RegisteredCompanies, the registry extract of company numbers. | Matched = Payload.CompanyRegistrationCode.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.RegisteredCompanies) |
Tag: Screening · AML · Entity · onboarding |
| 6.6-10 | Company struck-off/dissolved | Transacting entity no longer exists. | Registry status of the company is not active. Upstream field: Payload.CompanyStatus, supplied before Jube or by an inline-script hook. A missing status is required to be present before the test applies. | Matched = Payload.CompanyStatus.RequireIsNotNullOrWhiteSpace().MatchNotEqual("active") |
Tag: Screening · AML · Entity · per transaction |
| 6.6-11 | Company age under threshold | Very newly incorporated. | The incorporation date, a DateTime field, is converted to whole days with AgeInDays and tested below a placeholder of 365 days. It depends on an incorporation date in the payload, typically registry-sourced; without it the row is C. |
Matched = Payload.IncorporationDate.AgeInDays().MatchLess(365) |
Tag: Screening · AML · Entity · onboarding |
| 6.6-12 | Shell company indicators (nominee director, no employees, virtual office) | Registry attributes of shell structure. | Registered address is a known virtual office address. Upstream field: Payload.RegisteredAddress, supplied before Jube or by an inline-script hook. List: List.VirtualOfficeAddresses. The nominee-director and employee-count elements are not part of this fragment. | Matched = Payload.RegisteredAddress.MatchInList(List.VirtualOfficeAddresses) |
Tag: Screening · AML · Entity · onboarding |
| 6.6-14 | Tax ID/TIN mismatch | Mismatch with tax authority data. | Tax ID verification result is negative. Upstream field: Payload.TaxIdVerifiedFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.TaxIdVerifiedFlag.MatchIsFalse() |
Tag: Screening · AML · Customer · onboarding |
| 6.6-15 | Beneficial owner undisclosed | Missing required UBO. | Assumes the KYC form writes owners to one field, so the test is for a blank field. If owners are a JSON array, the test is an array-length check at a path instead. | Matched = Payload.BeneficialOwners.MatchIsNullOrWhiteSpace() |
Check: The beneficial-ownership threshold (commonly 25 percent under EU AML rules) and the required fields by jurisdiction: verify Tag: Screening · AML · Entity · onboarding |
| 6.6-16 | Missing mandatory KYC fields | Absent data on regulated customers. | One pipeline with a Match step per mandatory field, switched with Against. A decided Match skips the later steps, so the first blank field matches. The mandatory set is a policy choice. | Matched = Payload.Name.MatchIsNullOrWhiteSpace().Against(Payload.BornOnText).MatchIsNullOrWhiteSpace().Against(Payload.Address).MatchIsNullOrWhiteSpace() |
Tag: Screening · AML · Customer · periodic |
| 6.6-17 | Expired KYC refresh | Periodic review overdue and transacting. | The review due date held on the customer record is in the past, and the customer is transacting, a payload flag. | Matched = Payload.KycReviewDueDate.MatchIsPast() And Payload.IsTransacting.MatchIsTrue() |
Check: Periodic review intervals are risk-based and set by regulation or policy: verify for the customer risk tier Tag: Screening · AML · Customer · periodic |
6.7 Transaction-code and payment-field screening
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.7-01 | Reason code mismatch | Payment purpose code inconsistent with the customer’s profile. | One List per customer segment, because a List cannot be keyed by segment and a Dictionary holds numbers. The example shows one segment (Retail) and its allowed-purpose List RetailAllowedPurposes, with the same shape repeated per segment. A per-customer profile would need a Dictionary keyed on customer ID, which is not a purpose set. |
Matched = Payload.CustomerSegment.MatchEqual("Retail") And Payload.PurposeCode.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.RetailAllowedPurposes) |
Tag: Screening · AML · Payment · per transaction |
| 6.7-02 | Purpose code of high-risk category | e.g. unspecified “other” for large cross-border payments. | A combined screen: the purpose code is in List HighRiskPurposeCodes, and the amount is above a placeholder threshold of 50000. The broad “other” code is the case the rule targets. |
Matched = Payload.PurposeCode.MatchInList(List.HighRiskPurposeCodes) And Payload.Amount.MatchGreater(50000) |
Check: The OTHR purpose code value and the large-payment threshold are internal calibrations: verify the ISO 20022 code and the threshold Tag: Screening · AML · Payment · per transaction |
| 6.7-03 | Missing originator/beneficiary information (travel rule) | Required fields blank. | Field presence only, on the originator and beneficiary names. Completeness of the originator address and account are further fields. | Matched = Payload.OriginatorName.MatchIsNullOrWhiteSpace() Or Payload.BeneficiaryName.MatchIsNullOrWhiteSpace() |
Check: Travel-rule thresholds and required fields differ: verify the regime in force, including whether any de minimis applies (EU Transfer of Funds Regulation (EU) 2023/1113; FATF Recommendation 16) Tag: Screening · AML · Payment · per transaction |
| 6.7-04 | Cover payment (MT202COV) with incomplete data | Opaque cover payments. | A cover message with a blank underlying debtor or creditor name. | Matched = Payload.MessageType.MatchEqual("MT202COV") And (Payload.UnderlyingDebtorName.MatchIsNullOrWhiteSpace() Or Payload.UnderlyingCreditorName.MatchIsNullOrWhiteSpace()) |
Check: SWIFT MT cover messages are being retired in favour of ISO 20022 (MX): verify whether MT202COV still appears in the feed and the migration end date Tag: Screening · AML · Payment · per transaction |
| 6.7-05 | Stripped or truncated payment messages | Evidence of message stripping. | Heuristic with two indirect signals: a text length equal to the field maximum (140 is a placeholder), or a blank originator on a message whose originator bank BIC is valid. | Matched = Payload.Narrative.MatchLengthEqual(140) Or (Payload.OriginatorName.MatchIsNullOrWhiteSpace() And Payload.OriginatorBankBic.MatchIsValidBic()) |
Check: Field maximum lengths for the source message format: verify Tag: Screening · AML · Payment · per transaction |
| 6.7-06 | Payment through non-standard routing | Unusual correspondent chain. | The route key, built from the corridor and correspondent chain with ConcatWith, is presence-guarded and tested as not in List StandardRoutes. |
Matched = Payload.RouteKey.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.StandardRoutes) |
Tag: Screening · AML · Payment · per transaction |
| 6.7-07 | Return/reject code analysis (e.g. R-codes) | Returned for account closed/unauthorised. | The return reason code is tested against List AccountClosedOrUnauthorisedCodes, a code set held as reference data. |
Matched = Payload.ReturnReasonCode.MatchInList(List.AccountClosedOrUnauthorisedCodes) |
Check: R-code meanings are scheme-defined (for example R02 account closed and R10 unauthorised in the US ACH rules): verify against the rail’s rules Tag: Screening · Fraud · Payment · per transaction |
| 6.7-08 | ISO 20022 structured field anomalies | Mismatch between structured fields. | Only enumerated cross-field consistency checks are expressible: the debtor country against the debtor agent country, both normalised with CountryAlpha2. Open-ended anomaly patterns are not. |
Matched = Payload.DebtorCountry.CountryAlpha2().MatchNotEqual(Payload.DebtorAgentCountry.CountryAlpha2()) |
Tag: Screening · AML · Payment · per transaction |
6.8 Sector-specific screening
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.8-01 | Claimant or provider on insurance fraud register | Industry fraud database match (claims/provider). | Claimant or provider ID is on the insurance fraud register. Upstream field: Payload.ClaimantOrProviderId, supplied before Jube or by an inline-script hook. List: List.InsuranceFraudRegister, the bulk register keyed on claimant or provider ID. | Matched = Payload.ClaimantOrProviderId.MatchInList(List.InsuranceFraudRegister) |
Check: Register access and sharing terms: verify Tag: Screening · Fraud · Claimant/Provider · per claim |
| 6.8-02 | Vehicle on stolen/written-off register | VIN match. | The VIN is normalised with NormalisedForMatching and tested against a bulk-loaded List StolenOrWrittenOffVins. A live register query would be C. |
Matched = Payload.Vin.NormalisedForMatching().MatchInList(List.StolenOrWrittenOffVins) |
Tag: Screening · Fraud · Vehicle · per policy/claim |
| 6.8-03 | Property address on prior-claim list | Repeat-claim address. | The property address is normalised and tested against List PriorClaimAddresses. The repeat-claim count per address is also expressible as an Abstraction Rule, counting claims per address over a window. |
Matched = Payload.PropertyAddress.NormalisedForMatching().MatchInList(List.PriorClaimAddresses) |
Tag: Screening · Fraud · Address · per claim |
| 6.8-04 | Medical provider on excluded-provider list | Sanctioned providers. | Exact List test of Payload.ProviderId against List ExcludedProviders. |
Matched = Payload.ProviderId.MatchInList(List.ExcludedProviders) |
Check: Excluded-provider lists are jurisdiction-specific (for example the US OIG exclusion list): verify the list used and its scope Tag: Screening · Fraud · Provider · per claim |
| 6.8-05 | Player on self-exclusion register | Excluded player transacting. | An exact List test of Payload.PlayerId against List SelfExcludedPlayers, which flags the event. The compiler does not accept a Rejected assignment in an Activation rule, so blocking belongs to a Gateway Rule, the cheapest place to stop an event, and this rule records the match. |
Matched = Payload.PlayerId.MatchInList(List.SelfExcludedPlayers) |
Check: Self-exclusion registers are regulator-mandated in some jurisdictions and access may be licence-restricted: verify Tag: Screening · Both · Player · per event |
| 6.8-06 | Player on industry-shared fraud/bonus-abuse list | Shared gaming lists. | Exact List test of Payload.PlayerId against a bulk-loaded industry List SharedBonusAbusers. A live shared-database query would be C. |
Matched = Payload.PlayerId.MatchInList(List.SharedBonusAbusers) |
Check: Shared-list sharing terms: verify Tag: Screening · Fraud · Player · onboarding |
| 6.8-07 | Payment to unlicensed gambling operator (merchant list) | Operator not licensed in customer’s jurisdiction. | The same mechanism as 6.4-06, with the List chosen by the customer’s jurisdiction: a presence-guarded not-in-list test of Payload.MerchantId against List LicensedOperatorsForJurisdiction. |
Matched = Payload.MerchantId.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.LicensedOperatorsForJurisdiction) |
Check: Licensing is per jurisdiction: verify the licence register used Tag: Screening · Both · Merchant · per transaction |
| 6.8-08 | Wallet address on sanctions/ransomware/darknet/mixer lists (crypto) | Address attribution match. | Attribution lists (sanctions, ransomware, darknet, mixer) loaded as List AttributedWallets, tested on Payload.WalletAddress. A live attribution API is a vendor verdict and would be C. |
Matched = Payload.WalletAddress.MatchInList(List.AttributedWallets) |
Tag: Screening · AML · Address · per transaction |
| 6.8-09 | Counterparty VASP on FATF-risk or unregistered list | VASP risk. | Exact List test of Payload.CounterpartyVaspId against List VaspRiskList. |
Matched = Payload.CounterpartyVaspId.MatchInList(List.VaspRiskList) |
Check: Which ‘FATF-risk’ VASP list applies is an internal definition: verify its source Tag: Screening · AML · VASP · per transaction |
| 6.8-10 | Token on scam-token/rug-pull list | Asset-level risk. | Case-insensitive exact test of Payload.TokenContract against List ScamTokens, because hex contract addresses are compared case-insensitively. |
Matched = Payload.TokenContract.MatchInListIgnoreCase(List.ScamTokens) |
Tag: Screening · Both · Asset · per transaction |
| 6.8-11 | Smart contract on exploit/flagged list | Contract risk. | Case-insensitive exact test of Payload.ContractAddress against List FlaggedContracts, because hex contract addresses are compared case-insensitively. |
Matched = Payload.ContractAddress.MatchInListIgnoreCase(List.FlaggedContracts) |
Tag: Screening · Both · Contract · per transaction |
| 6.8-12 | Security on restricted/penny-stock watchlist (brokerage) | Restricted-asset list. | Validity first, with the check-digit test IsValidIsin in a Require step, so a malformed ISIN is rejected before the List test against RestrictedSecurities. |
Matched = Payload.SecurityCode.RequireIsNotNullOrWhiteSpace().RequireThat(Payload.SecurityCode.IsValidIsin()).MatchInList(List.RestrictedSecurities) |
Check: Penny-stock definition (the US Exchange Act rule 3a51-1 price test) and the restricted-list scope: verify the definition that applies Tag: Screening · Both · Security · per order |
| 6.8-13 | Issuer on promotional-campaign watchlist | Pump-and-dump targets. | Exact List test of the issuer identifier Payload.PromotedIssuerCode against List PromotionWatchlist. |
Matched = Payload.PromotedIssuerCode.MatchInList(List.PromotionWatchlist) |
Tag: Screening · Fraud · Security · per order |
| 6.8-14 | Insider list match for traded security | Account holder is on issuer insider list. | A fuzzy test of the account holder name against List IssuerInsiderList, combined with an exact test of the security against List TradedSecuritiesWithInsiderLists. A person identifier is preferable when the insider list carries one. |
Matched = Payload.AccountHolderName.MatchSomehowInList(List.IssuerInsiderList) And Payload.SecurityCode.MatchInList(List.TradedSecuritiesWithInsiderLists) |
Check: Insider lists under EU MAR Article 18 and the list-keeping duty: verify the regime Tag: Screening · Both · Account · per order |
| 6.8-15 | Phone number on recently-ported/SIM-swapped list (telco signal) | Telco risk feed. | Phone number was recently ported or its SIM was swapped, per the telco signal. Upstream field: Payload.RecentlyPortedFlag, supplied before Jube or by an inline-script hook. The signal is a boolean. | Matched = Payload.RecentlyPortedFlag.MatchIsTrue() |
Tag: Screening · Fraud · Phone · per event |
| 6.8-16 | Phone number on scam-caller registry | Known scam numbers. | Digits-only exact test of the phone number against List ScamCallerNumbers, the registry loaded as a List. |
Matched = Payload.Phone.PhoneNumberDigits().MatchInList(List.ScamCallerNumbers) |
Tag: Screening · Fraud · Phone · per event |
| 6.8-17 | Mobile-money agent on suspended-agent list | Agent risk. | Exact List test of Payload.AgentId against List SuspendedAgents. |
Matched = Payload.AgentId.MatchInList(List.SuspendedAgents) |
Tag: Screening · AML · Agent · per transaction |
| 6.8-18 | Vendor on sanctions/debarment list (procurement) | Debarred suppliers. | Sanction definition DebarmentList, loaded as a Sanction source, fuzzy on Payload.VendorName. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.DebarmentList.MatchLessOrEqual(1) |
Check: Debarment list in use (for example the World Bank debarment list or a national list): verify the source Tag: Screening · Both · Vendor · onboarding |
| 6.8-19 | Vendor missing from approved-vendor master | Payment to unapproved vendor. | A presence-guarded not-in-list test of Payload.VendorId against List ApprovedVendors, a master-data presence check. |
Matched = Payload.VendorId.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.ApprovedVendors) |
Tag: Screening · Fraud · Vendor · per payment |
| 6.8-20 | Employee bank details match vendor bank details | Direct match. | The vendor IBAN is normalised with NormalisedForMatching and tested against List EmployeeAccounts. |
Matched = Payload.VendorIban.NormalisedForMatching().MatchInList(List.EmployeeAccounts) |
Check: Lawful basis for holding employee account numbers in a rule list: verify with data protection Tag: Screening · Fraud · Vendor · onboarding |
| 6.8-21 | Shipping address on freight-forwarder/reshipper list (e-commerce) | Drop address. | The same mechanism as the drop-address List, on the e-commerce shipping field, normalised with NormalisedForMatching, against List FreightForwarderAddresses. |
Matched = Payload.ShippingAddress.NormalisedForMatching().MatchInList(List.FreightForwarderAddresses) |
Tag: Screening · Fraud · Address · per order |
| 6.8-22 | Email on breached-credential list | Credentials leaked. | Single event. The breach verdict is supplied upstream by the breach-lookup service as the CredentialBreachedFlag payload flag. The breached-hash List is impractical, so the verdict stays outside Jube. | Matched = Payload.CredentialBreachedFlag.MatchIsTrue() |
Tag: Screening · Fraud · Email · per login |
| 6.8-23 | Seller on counterfeit-goods list | Marketplace seller risk. | Exact List test of Payload.SellerId against List CounterfeitSellers. |
Matched = Payload.SellerId.MatchInList(List.CounterfeitSellers) |
Tag: Screening · Fraud · Seller · onboarding |
| 6.8-24 | Borrower on default/collections register | Credit risk register. | Credit bureau default flag is set for the applicant. Upstream field: Payload.BureauDefaultFlag, supplied before Jube or by an inline-script hook. The flag is a boolean. | Matched = Payload.BureauDefaultFlag.MatchIsTrue() |
Check: Bureau data-use rules: verify Tag: Screening · Fraud · Applicant · onboarding |
| 6.8-25 | Applicant on deceased, bankruptcy or disqualified-director registers | Public registers. | Bulk-loaded public registers keyed on name and date of birth, joined with ConcatWith into a key, tested against List DeceasedInsolvencyDisqualifiedKeys. Live register queries would be C. |
Matched = Payload.DeceasedCheckKey.MatchInList(List.DeceasedInsolvencyDisqualifiedKeys) |
Check: Disqualified-director and insolvency registers are jurisdiction-specific (for example the UK Insolvency Service): verify the registers used Tag: Screening · Both · Applicant · onboarding |
| 6.8-26 | Charity not on regulator register (NPO) | Unregistered NPO. | The register is bulk-loaded, and the refresh cadence matters for a not-registered test. The charity number is normalised with NormalisedForMatching, presence-guarded, and tested as not in List RegulatorCharityRegister. |
Matched = Payload.CharityCode.NormalisedForMatching().RequireIsNotNullOrWhiteSpace().MatchNotInList(List.RegulatorCharityRegister) |
Check: Charity registration obligations are jurisdiction-specific: verify Tag: Screening · AML · Entity · onboarding |
| 6.8-27 | Art/antiques dealer or precious-metals dealer not registered | Regulated-sector registration. | A presence-guarded not-in-list test of the business registration number against the loaded register List RegisteredHighValueDealers. |
Matched = Payload.BusinessRegistrationCode.RequireIsNotNullOrWhiteSpace().MatchNotInList(List.RegisteredHighValueDealers) |
Check: Dealer registration and the cash threshold (EUR 10,000 under EU AML rules for high-value dealers) are regulatory: verify the threshold for the jurisdiction Tag: Screening · AML · Entity · onboarding |
| 6.8-28 | Lawyer/accountant/TCSP on regulatory sanction list (gatekeepers) | Professional-enabler screening. | Professional-body or regulator sanction lists loaded as a Sanction definition GatekeeperSanctions, fuzzy on Payload.CounterpartyName. The Activation rule thresholds the match distance (placeholder). |
Matched = Sanction.GatekeeperSanctions.MatchLessOrEqual(1) |
Check: Gatekeeper sanction lists are regulator-specific: verify the source Tag: Screening · AML · Counterparty · per transaction |
6.9 Document and biometric verification checks
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 6.9-01 | Document authenticity failure (MRZ, hologram, font) | Document fails forensic checks. | Document authenticity verdict from the document-verification vendor is negative. Upstream field: Payload.DocumentAuthenticFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean; the MRZ check-digit part needs a validator the library lacks and is not covered. | Matched = Payload.DocumentAuthenticFlag.MatchIsFalse() |
Tag: Screening · Fraud · Document · onboarding |
| 6.9-02 | Document template known forgery | Template on forgery list. | The template ID supplied by the verification vendor in the payload is tested against List ForgedTemplates. |
Matched = Payload.DocumentTemplateId.MatchInList(List.ForgedTemplates) |
Tag: Screening · Fraud · Document · onboarding |
| 6.9-03 | Selfie-to-document face match failure | Biometric mismatch. | Selfie-to-document face match score is low. Upstream field: Payload.FaceMatchScore, supplied before Jube or by an inline-script hook. Threshold 0.8 is an illustrative placeholder. | Matched = Payload.FaceMatchScore.MatchLess(0.8) |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-04 | Liveness failure (presentation attack) | Printed photo, mask, screen replay. | Liveness check did not pass. Upstream field: Payload.LivenessPassedFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.LivenessPassedFlag.MatchIsFalse() |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-05 | Deepfake/injection attack detected | Synthetic video injected into camera stream. | Injection or deepfake attack detected on the camera stream. Upstream field: Payload.InjectionAttackFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.InjectionAttackFlag.MatchIsTrue() |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-08 | Voiceprint match to known fraudster | Voice biometrics in call centre. | Voiceprint matched a known fraudster. Upstream field: Payload.VoiceprintMatchFlag, supplied before Jube or by an inline-script hook. The match is a boolean. | Matched = Payload.VoiceprintMatchFlag.MatchIsTrue() |
Tag: Screening · Fraud · Caller · per call |
| 6.9-09 | Voice synthetic/clone detected | Deepfake voice. | Synthetic or cloned voice detected. Upstream field: Payload.SyntheticVoiceFlag, supplied before Jube or by an inline-script hook. The verdict is a boolean. | Matched = Payload.SyntheticVoiceFlag.MatchIsTrue() |
Tag: Screening · Fraud · Caller · per call |
| 6.9-10 | Document data mismatch with application fields | OCR vs typed data. | OCR extraction is a vendor step; the comparison of the two strings is in the fragment. Similarity below a placeholder of 0.85 is a mismatch. | Matched = Payload.OcrFullName.SimilarityTo(Payload.ApplicationFullName).MatchLess(0.85) |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-11 | Document issued in country inconsistent with address/phone | Geographic inconsistency. | The document country and the address country are both normalised with CountryAlpha2 and compared. A phone country-code check can be added with a Dictionary of dialling prefixes. |
Matched = Payload.DocumentCountry.CountryAlpha2().MatchNotEqual(Payload.AddressCountry.CountryAlpha2()) |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-12 | Proof-of-address document altered | Utility bill tampering. | Proof-of-address document is flagged as altered. Upstream field: Payload.ProofOfAddressAlteredFlag, supplied before Jube or by an inline-script hook. The flag is a boolean. | Matched = Payload.ProofOfAddressAlteredFlag.MatchIsTrue() |
Tag: Screening · Fraud · Document · onboarding |
| 6.9-13 | Bank statement upload inconsistent (open-banking mismatch) | Statement figures differ from live data. | Single event. The live open-banking balance is supplied upstream as LiveBalance next to the stated balance. The 2% cut-off is illustrative. | Matched = Payload.StatedBalance.PercentDifferenceFrom(Payload.LiveBalance).MatchGreater(2) |
Tag: Screening · Fraud · Applicant · onboarding |
| 6.9-14 | Payslip/employer verification failure | Employer unreachable or non-existent. | Employer verification did not succeed. Upstream field: Payload.EmployerVerifiedFlag, supplied before Jube or by an inline-script hook. The result is a boolean. | Matched = Payload.EmployerVerifiedFlag.MatchIsFalse() |
Tag: Screening · Fraud · Applicant · onboarding |