Velocity and Volume

Definition: raw frequency (velocity) or magnitude (volume) of events. How often or how much is the signal itself.

Construction: a TTL Counter, windowed, keyed on the entity, read by an Activation Rule and written by an Activation Rule. See the Rule Taxonomy for how this type differs from its neighbours, and the Rule Authoring Methodology for how the rule fragment itself is written.

Question an analyst asks	Rule Taxonomy type that answers it
How many card payments in the last hour?	Velocity (count)
How much value moved out of the account in 24 hours?	Volume (sum)
How many different devices in 7 days?	Not this type: Cardinality
Is this hour unusual for this customer?	Not this type: Behavioral Baseline and Ratio
Is the amount just under a reporting limit?	Not this type: Structuring, though it consumes a velocity counter for the repetition

Velocity and Volume: TTL Counters or Abstraction Rules

There are two ways to build a Velocity or Volume rule in Jube: TTL Counters and Abstraction Rules.

Abstraction Rules keep the full event picture in the cache and carry a significant in-memory and cache performance penalty. A TTL Counter delivers the same count or sum with a much lighter footprint that can be retained for a much longer period, backed by an efficient deprecation algorithm. It follows that Abstraction Rules are strongly discouraged for Velocity and Volume rules. They are reserved for what a counter cannot express: cardinality (same, distinct, take first, take last) and aggregations beyond count and sum (average, min, max, median, standard deviation). See TTL Counters and Abstraction Rules.

A TTL Counter can only count and sum. If the question needs a distinct count or an average, this is the wrong type.

Velocity and Volume: Construction Steps

A Velocity or Volume rule in Jube is built in four steps: define the TTL Counter (Models » Abstraction » TTL Counters), increment it from an Activation Rule, threshold it in a second Activation Rule, then set the Priority order and test.

Step 1: Define the TTL Counter for a Velocity or Volume Rule

The TTL Counter definition answers four questions. Get these right first, as a counter cannot be re-windowed retrospectively.

TTL Counter design question	TTL Counter field	Guidance
Counted for whom?	TTL Counter Data Name	The payload key that groups the counter (AccountId, CardId, IP). This is the entity. Required, and the counter is skipped on an event whose payload lacks the key.
Counted over how long?	TTL Counter Interval Type and Value	The window. A one day rule is a Days / 1 counter. Seconds, Minutes, Hours, Days, Months and Years are valid.
Counting events or value?	Sum and TTL Counter Data Value	Off: each increment adds one (velocity). On: each increment adds the named payload Float or Integer, for example CurrencyAmount (volume).
How precisely does it wash off?	Online Aggregation, Live Forever, Resolution Interval	Covered in the precision options for TTL Counters.

TTL Counter window precision options for Velocity and Volume rules:

• Default (Online Aggregation off). The counter is pre-aggregated and a background job decrements it once entries lapse. Cheap on recall, but the decrement is slightly latent, by up to the Resolution Interval. Suitable for windows measured in hours to years.
• Online Aggregation on. Every event is counted in real time from the individual entries. Exact to the second, but more expensive on recall. Use it only where the rule is hypersensitive to the edge of the window, such as a 60 second burst rule. Because it targets the transaction’s Reference Date, it is correct for back-dated or replayed data.
• Live Forever. The counter is never decremented. That is a lifetime total, not a velocity, and belongs to Behavioral Baseline and Ratio territory (for example, lifetime deposits as a denominator).
• Resolution Interval (Minutes, Hours or Days). How coarsely entries are bucketed for storage and decrement. Pick it at a fraction of the window: a one day window with Hours resolution is accurate to the hour, whereas a one hour window with Days resolution is meaningless.

The window is measured against the model’s own Reference Date, not wall-clock time. A model that stops receiving transactions stops ageing its counters, so a quiet system does not appear to “cool down”.

The TTL Counter name is what a rule reads as TTLCounter.<Name>, so name it for what it means, including the window, for example CardPaymentsLastHour or OutboundValue24h. Names are unique within a model (case-insensitive).

A TTL Counter must also be enabled at the model level (Enable Ttl Counter); otherwise the process is stepped over and an INFO message is logged.

Step 2: Increment the TTL Counter from an Activation Rule

A counter is not incremented by the payload arriving. It is incremented as the consequence of an Activation Rule matching, by ticking Increment TTL Counter on that rule and selecting the counter. See TTL Counter Activation Rule Incrementation.

This has three consequences that drive how Velocity and Volume rules are shaped:

• The condition on the incrementing rule is the count’s filter. “Card payments” is an incrementing rule with Matched = Payload.TxnType.MatchEqual("CardPayment"). To count every event, use a rule that always matches, for example Matched = True. Filtering here, rather than in the reading rule, means the counter holds exactly what it is named for.
• The counter can be incremented across models, provided the grouping key is present in both payloads. This is the bridge to Event Sequencing.
• Priority decides whether the reading Activation Rule counts the current event. See Step 4: Order the Activation Rules by Priority and Test.

Step 3: Threshold the TTL Counter in an Activation Rule

TTL Counters are recalled once per invocation, in a single request to the cache, and are then available to every rule as TTLCounter.<Name>, and are numbers, so the numeric steps apply directly. Thresholding is a pipeline, per the Rule Authoring Methodology, and every step named here is listed in the Rule Pipeline Reference. A pipeline that ends without deciding does not match. A velocity threshold on a count counter:

Matched = TTLCounter.CardPaymentsLastHour.MatchGreater(5)

A volume band on a sum counter, using the inclusive InRange test:

Matched = TTLCounter.OutboundValue24h.MatchInRange(10000, 50000)

A volume limit on a sum counter. The counter already includes the current amount when the incrementing rule has an earlier Priority:

Matched = TTLCounter.OutboundValue24h.MatchGreater(50000)

A TTL Counter combined with a payload structuring check. RequireGreater is the guard on the counter, and Against switches the pipeline to the payload value, keeping the state:

Matched = TTLCounter.CardPaymentsLastHour.RequireGreater(5).Against(Payload.CurrencyAmount).MatchIsJustBelowThreshold(10000, 10)

A guard clause selecting Velocity and Volume thresholds by product segment, keeping the evaluation itself in the expression:

If (Payload.ProductType = "Corporate" And TTLCounter.OutboundValue24h > 250000) Then
    Return True
End If
If (Payload.ProductType <> "Corporate" And TTLCounter.OutboundValue24h > 25000) Then
    Return True
End If

Two TTL Counters over different windows express acceleration, a burst against the recent norm, without leaving the Velocity and Volume type. The share of the day’s payments that fell in the last hour is a derived number, so it is an Abstraction Calculation HourShareOfDay, with the function:

```vb calculation Matched = TTLCounter.CardPaymentsLastHour.RatioOf(TTLCounter.CardPayments24h).ZeroIfUndefined()

and the Activation Rule compares it, guarded by a minimum count:

```vb
Matched = TTLCounter.CardPaymentsLastHour.RequireGreaterOrEqual(5).Against(AbstractionCalculation.HourShareOfDay).MatchGreaterOrEqual(0.5)

Scope boundary: where the question becomes “is this unusual for this entity” rather than “is this over a fixed number”, it has become Behavioral Baseline and Ratio, which owns ratio construction such as RatioAbove and PercentageChangeFrom.

Step 4: Order the Activation Rules by Priority and Test

TTL Counters are recalled at the start of the invocation, and are then updated inside the same invocation as each incrementing Activation Rule matches: the in-invocation counter value is increased immediately and the cache write is queued. Activation Rules are evaluated in Priority order, so priority decides whether a rule sees the current event:

Incrementing Activation Rule Priority relative to the reading Activation Rule	TTL Counter value the reading rule sees	Use for
Earlier (lower Priority number)	Prior events plus the current event	Velocity and volume rules: “the fifth payment in the hour” includes this one
Later (higher Priority number)	Prior events only	Sequenced patterns that must not count the current event, see Event Sequencing

Rules of thumb for TTL Counter incrementation and Priority:

• For a Velocity or Volume rule, put the incrementing rule ahead of the reading rule. TTLCounter.CardPaymentsLastHour > 5 then fires on the sixth payment, with the sixth counted.
• The incrementing rule only counts if it matches. If its filter is not matched on this event, the counter is not moved, and the reading rule sees prior events only, whatever the priority.
• The reading rule can be the incrementing rule. A rule that both matches on a threshold and increments a counter increments only after it matches, so it never sees its own increment. Split counting and alerting into two rules.
• A counter that is not moved does not change. Incrementation is skipped if the payload lacks the counter’s Data Name key, and for a payload being reprocessed through a reprocessing rule instance, so a replay does not double count. Where idempotency across retries is required, enable the ActivationRuleIdempotency setting.
• Priority also orders Activation Rule Chaining. A later rule can read an earlier rule’s match as Activation.<Name>.
• Suppression applies to the reading rule, not the counter. A suppressed reading rule still allows the incrementing rule to feed the counter.
• State the convention in the rule name or description (“includes current event”), as the off-by-one between “prior events” and “including this one” is the most common source of disagreement in review.

Testing a Velocity or Volume rule: use the model validation and test endpoints adjacent to the Activation Rule service (see the authoring note in the Rule Taxonomy). A velocity rule needs a sequence of invocations, not a single payload, so a useful test posts N events for one entity, asserts the alert on the event that crosses the threshold, then posts an event for a different entity to prove the key isolates counts. Assert the priority behaviour too, by swapping the two Priorities and confirming the alert moves one event later.

Velocity and Volume: Where to Look in the Source

This page is a construction guide. TTL Counter behaviour is defined in the following places, which are the authority where this page and the code disagree:

TTL Counter concern	Source file or documentation page
Recall of counters at the start of the invocation	Jube.Engine/EntityAnalysisModelInvoke/Context/Extensions/TtlCounterExtensions.cs
Increment on Activation Rule match, in-invocation update, idempotency, reprocessing skip	Jube.Engine/.../Context/Extensions/ActivationRules/ActivationRuleTtlCounterExtensions.cs
Where increment sits in the Activation Rule Priority iteration	Jube.Engine/.../Context/Extensions/ActivationRules/IterateActivationRulesExtensions.cs
Background decrement of lapsed counters	Jube.Engine/EntityAnalysisModelManager/BackgroundTasks/TaskStarters/TtlCounterAdministrationTaskStarter.cs
Cache storage of counters and entries	Jube.Cache/Redis/CacheTtlCounterRepository.cs
Definition, validation and the increment fields	TTL Counters, TTL Counter Activation Rule Incrementation, Activation Rules

Worked Example: Card Velocity Rule (Count TTL Counter)

Requirement: alert when a card is used more than five times in an hour.

1. TTL Counter CardPaymentsLastHour: TTL Counter Data Name CardId, Interval Hours / 1, Resolution Minutes, Sum off, Online Aggregation off.
2. Incrementing Activation Rule CardPaymentSeen, Priority 1: Matched = Payload.TxnType.MatchEqual("CardPayment"), with Increment TTL Counter ticked and CardPaymentsLastHour selected. No response elevation: it exists only to count.
3. Alerting Activation Rule CardVelocity1Hour, Priority 2: Matched = TTLCounter.CardPaymentsLastHour.MatchGreater(5).

Because CardPaymentSeen has the earlier Priority, the current payment is already counted when CardVelocity1Hour is evaluated, so the alert fires on the sixth payment in the hour. Reversing the two Priorities would move it to the seventh.

Worked Example: Outbound Volume Rule (Sum TTL Counter)

Requirement: alert when more than 50,000 leaves an account in 24 hours.

1. TTL Counter OutboundValue24h: Data Name AccountId, Interval Days / 1, Resolution Hours, Sum on with TTL Counter Data Value CurrencyAmount.
2. Incrementing Activation Rule OutboundSeen: Matched = Payload.Direction.MatchEqual("Outbound"), Increment TTL Counter ticked.
3. Alerting Activation Rule OutboundVolume24h: Matched = TTLCounter.OutboundValue24h.MatchGreater(50000), with the earlier-Priority incrementing rule having added the current amount.

Velocity and Volume: Common Faults

Symptoms of a misbuilt TTL Counter Velocity or Volume rule, with the likely cause.

Symptom in a Velocity or Volume rule	Likely cause
Counter is always 0	No Activation Rule increments it; the model was not synchronised; Enable Ttl Counter is off; the payload lacks the Data Name key.
Alert fires one event later than expected	The incrementing rule has a later Priority than the reading rule, or its filter did not match on this event.
Volume counter counts events, not value	Sum is off, or TTL Counter Data Value is unset.
Counts never fall away	Live Forever is on; or the model has stopped receiving events, so its Reference Date has not advanced.
Counts fall away later than the window	Resolution Interval is coarse relative to the window; or Online Aggregation is off and the decrement job is behind.
Counts differ between two entities that are one person	The Data Name key is not the entity. Correct the key, or move to Link and Network.
Retried invocations inflate counts	Enable ActivationRuleIdempotency. Reprocessing already skips incrementation by design.

Velocity and Volume: Departures From This Type

Anything that needs a distinct count, an average, a percentile, or a comparison against the entity’s own history is not this type, and should not be forced into a counter with extra windows. Departures from the documented taxonomy are unsupported.

Examples by Sub-Class

Validated. Every fragment in this section is compiled individually through the Jube Parser, with its payload fields and its TTL Counter, Abstraction, Calculation, List and Sanction tokens declared, so each extension method and argument type is checked against the engine. Compilation does not validate a rule’s logic or its thresholds, which are illustrative placeholders to be tuned on data.

1.1 Payment and transfer velocity (count)

#	Example	Description	Jube construction	Fragment	Notes
1.1-01	High count of outbound payments in 1 hour	An account sends an unusual number of outbound payments in a short window, typical of account takeover cash-out or mule onward-movement.	Counter OutboundPayments1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on an outbound payment (Payload.Direction.MatchEqual("Outbound")), so the count includes the current event. This rule reads it at 8, the library’s illustrative value.	Matched = TTLCounter.OutboundPayments1h.MatchGreaterOrEqual(8)	Tag: Velocity · Both · Account · 1h, count ≥ 8
1.1-02	High count of outbound payments in 24 hours	Daily outbound payment count far above product norm.	Counter OutboundPayments24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on an outbound payment (Payload.Direction.MatchEqual("Outbound")), so the count includes the current event. This rule reads it at 20, the library’s illustrative value.	Matched = TTLCounter.OutboundPayments24h.MatchGreaterOrEqual(20)	Tag: Velocity · Both · Account · 24h, count ≥ 20
1.1-03	High count of outbound payments in 7 days	Sustained high payment frequency over a week, indicating a pass-through account.	Counter OutboundPayments7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on an outbound payment (Payload.Direction.MatchEqual("Outbound")), so the count includes the current event. This rule reads it at 60, the library’s illustrative value.	Matched = TTLCounter.OutboundPayments7d.MatchGreaterOrEqual(60)	Tag: Velocity · AML · Account · 7d, count ≥ 60
1.1-04	Burst of first-time-beneficiary payments	Many payments to payees never paid before inside a short period.	Counter NewPayees1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a payment whose Abstraction Rule PriorPaymentsToPayee (Search Key AccountId, Search Interval 10 Years, Function Same Count on Payee, a placeholder field) shows zero prior matches. Whether Same Count includes the current event decides whether the test reads 0 or 1, so confirm before use. This rule reads it at 3, a placeholder because the library gives no value; the 10 Years window needs a long look-back cost check.	Matched = TTLCounter.NewPayees1h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 1h, count of new payees ≥ 3
1.1-05	High count of inbound credits in 24 hours	Many separate incoming credits in a day, consistent with a collection/mule account.	Counter InboundCredits24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on an inbound credit (Payload.Direction.MatchEqual("Inbound")), so the count includes the current event. This rule reads it at 15, the library’s illustrative value.	Matched = TTLCounter.InboundCredits24h.MatchGreaterOrEqual(15)	Tag: Velocity · AML · Account · 24h, count ≥ 15
1.1-06	High count of inbound credits from distinct senders	Credits from many sources into one account in a short period (also see Cardinality).	Abstraction Rule InboundDistinctSenders72h (Search Key AccountId, Search Interval 72 Hours, Function Distinct Count on Sender, a placeholder field) over inbound credits. This rule reads it at 5, a placeholder because the library gives no N. It uses the same distinct-count construct as the cardinality section.	Matched = Abstraction.InboundDistinctSenders72h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 72h
1.1-07	Rapid in-out turnover	Value received is forwarded within minutes/hours, with count of debits closely following count of credits.	Counters OutboundPayments24h and InboundCredits24h (as in 1.1-02 and 1.1-05). The ratio is computed inline as TTLCounter.OutboundPayments24h.RatioOf(TTLCounter.InboundCredits24h).ZeroIfUndefined(), and this rule tests it at 0.9, a placeholder. It approximates closely following by a count ratio only; pairing each credit with the debit that follows it within minutes is not expressible with counters or Abstraction Rules.	Matched = TTLCounter.OutboundPayments24h.RatioOf(TTLCounter.InboundCredits24h).ZeroIfUndefined().MatchGreaterOrEqual(0.9)	Tag: Velocity · AML · Account · 24h
1.1-08	High count of declined payments	Repeated declines indicate probing for working credentials, limits or balances.	Counter DeclinesPerCard30m (Data Name CardId, Interval 30 Minutes, Count). Incremented by an earlier-Priority activation on a declined payment (Payload.Outcome.MatchEqual("Declined"), Outcome is a placeholder field), so the count includes the current event. This rule reads it at 5, the library’s illustrative value.	Matched = TTLCounter.DeclinesPerCard30m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account/Card · 30m, declines ≥ 5
1.1-09	High count of failed payment authorisations (insufficient funds)	Repeated insufficient-funds attempts can indicate testing or stolen-credential use.	Counter InsufficientFundsDeclines1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a payment declined for insufficient funds (Payload.DeclineReason.MatchEqual("InsufficientFunds"), DeclineReason is a placeholder field), so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.InsufficientFundsDeclines1h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 1h
1.1-10	High count of reversed or recalled payments	Many recalls or chargebacks relative to activity.	Counter Recalls30d (Data Name AccountId, Interval 30 Days, Count) is incremented by an earlier-Priority activation on a recall or chargeback event (Payload.EventType.MatchInList(List.RecallEventTypes), EventType and the list are placeholders); counter Payments30d (same key and window) is incremented on every payment. The ratio is computed inline as TTLCounter.Recalls30d.RatioOf(TTLCounter.Payments30d).ZeroIfUndefined(), and this rule tests it at 0.05, a placeholder for the unstated r.	Matched = TTLCounter.Recalls30d.RatioOf(TTLCounter.Payments30d).ZeroIfUndefined().MatchGreaterOrEqual(0.05)	Tag: Velocity · Fraud · Account · 30d
1.1-11	High count of instant/faster payments	Concentration of irrevocable real-time payments.	Counter FasterPayments1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a faster payment (Payload.Rail.MatchEqual("FasterPayment"), Rail is a placeholder field and the rail code is not given by the library), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.FasterPayments1h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 1h
1.1-12	High count of international transfers	Frequent cross-border payments from an account with no such profile.	Counter CrossBorderPayments30d (Data Name AccountId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a payment where Payload.BeneficiaryCountry <> Payload.HomeCountry (both placeholder fields; home country must be in the payload or a Dictionary keyed on the account), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.CrossBorderPayments30d.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 30d
1.1-13	High count of SWIFT/wire transfers	Frequent high-value wires in a short time.	Counter SwiftPayments7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on Payload.Rail.MatchEqual("SWIFT") And Payload.CurrencyAmount.MatchGreaterOrEqual(5000), where 5000 is a placeholder high-value threshold. This rule reads it at 4, a placeholder because the library gives no N.	Matched = TTLCounter.SwiftPayments7d.MatchGreaterOrEqual(4)	Tag: Velocity · AML · Account · 7d
1.1-14	High count of standing-order/direct-debit amendments	Many changes to recurring instructions in a short window.	Counter StandingOrderAmendments7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a standing-order or direct-debit amendment event (EventType is a placeholder field), so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.StandingOrderAmendments7d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 7d
1.1-15	High count of payments to the same beneficiary	Repeated payments to one payee in a short window (scam drip-feed or layering).	Counter PaymentsToSameBeneficiary24h (Data Name AccountBeneficiaryKey, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on an outbound payment (AccountBeneficiaryKey is a composite placeholder field, since a Data Name takes one payload key), so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.PaymentsToSameBeneficiary24h.MatchGreaterOrEqual(3)	Tag: Velocity · Both · Account+Beneficiary · 24h
1.1-16	High count of micro-payments	Many very low-value payments, used for card testing, enumeration or structuring.	Counter MicroPayments1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on Payload.CurrencyAmount.MatchLess(2), where 2 is the library’s value. This rule reads it at 10, a placeholder because the library gives no N.	Matched = TTLCounter.MicroPayments1h.MatchGreaterOrEqual(10)	Check: Amount 2 depends on currency and minor-unit basis, which the section does not give; confirm before use Tag: Velocity · Fraud · Account · 1h, amount < 2
1.1-17	High count of round-amount payments	Repeated payments of exact round values.	Counter RoundAmountPayments7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on Payload.CurrencyAmount.MatchIsRoundAmount(1000), where 1000 is a placeholder nearest value. This rule reads it at 5, a placeholder because the library gives no N.	Matched = TTLCounter.RoundAmountPayments7d.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 7d
1.1-18	High count of payments just after midnight	Unusual out-of-hours burst.	Counter AfterMidnightPayments1d (Data Name AccountId, Interval 1 Day, Count). Incremented by an earlier-Priority activation on Payload.Timestamp.ToZone("Europe/London").HourOfDay().MatchLess(4), where the zone must be the customer local zone (the library gives none) and the 4 is the library’s time-of-day band. The counter window is one day, because the library’s 4h describes the band and not the window. This rule reads it at 3, a placeholder because the library gives no N.	Matched = TTLCounter.AfterMidnightPayments1d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 4h window
1.1-20	Peer-to-peer transfer velocity	High count of P2P sends/receives suggesting scam or mule routing.	Counter P2pTransfers24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a P2P send or receive (Payload.Channel.MatchEqual("P2P"), Channel is a placeholder field), so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.P2pTransfers24h.MatchGreaterOrEqual(10)	Tag: Velocity · Both · Account · 24h
1.1-21	Request-to-pay/ payment request velocity	Many payment requests issued in a short window (collections for scams).	Counter RequestsToPay24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a request-to-pay issued (Payload.Channel.MatchEqual("RequestToPay"), Channel is a placeholder field), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.RequestsToPay24h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 24h

1.2 Payment and transfer velocity (value)

#	Example	Description	Jube construction	Fragment	Notes
1.2-01	High total outbound value in 1 hour	Cumulative debit value in an hour exceeds a threshold.	Counter OutboundValue1h (Data Name AccountId, Interval 1 Hour, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on an outbound payment, so the sum includes this amount. This rule reads it at 10000, the library’s illustrative value.	Matched = TTLCounter.OutboundValue1h.MatchGreaterOrEqual(10000)	Check: Currency, and whether 10,000 is in major or minor units, is not stated in the section; verify the reporting basis Tag: Velocity · Fraud · Account · 1h, sum ≥ 10,000
1.2-02	High total outbound value in 24 hours	Daily debit value far above ceiling for segment.	Counter OutboundValue24h (Data Name AccountId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on an outbound payment, so the count includes the current event. This rule reads it at 50000, a placeholder, because the library gives no value.	Matched = TTLCounter.OutboundValue24h.MatchGreater(50000)	Tag: Velocity · Both · Account · 24h
1.2-03	High total outbound value in 30 days	Rolling 30-day debit value exceeds expected income/turnover.	Counter OutboundValue30d (Data Name AccountId, Interval 30 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on an outbound payment. Dictionary ExpectedTurnover30d is keyed on AccountId and holds expected turnover per account. The ratio is computed inline as TTLCounter.OutboundValue30d.RatioOf(Dictionary.ExpectedTurnover30d).ZeroIfUndefined(); this rule tests it above 1. A missing key gives zero, which the ZeroIfUndefined guard turns into no match.	Matched = TTLCounter.OutboundValue30d.RatioOf(Dictionary.ExpectedTurnover30d).ZeroIfUndefined().MatchGreater(1)	Tag: Velocity · AML · Account · 30d
1.2-04	High total inbound value in 24 hours	Large credits in a short window.	Counter InboundValue24h (Data Name AccountId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on an inbound credit, so the count includes the current event. This rule reads it at 50000, a placeholder, because the library gives no value.	Matched = TTLCounter.InboundValue24h.MatchGreaterOrEqual(50000)	Tag: Velocity · AML · Account · 24h
1.2-05	Cumulative cash deposits over rolling period	Total cash deposited across branches/ATMs exceeds the reporting-style limit.	Counter CashDeposits30d (Data Name CustomerId, Interval 30 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on Payload.Channel.MatchEqual("CashDeposit") (Channel is a placeholder field). The limit is a jurisdiction rule the library does not state, so 25000 is a placeholder and not a regulatory figure.	Matched = TTLCounter.CashDeposits30d.MatchGreater(25000)	Check: Cash reporting thresholds and aggregation periods differ by jurisdiction (for example the US Currency Transaction Report applies to cash over USD 10,000 in one business day); verify the applicable regime and basis Tag: Velocity · AML · Customer · 7d/30d
1.2-06	Cumulative cash withdrawals over rolling period	Total cash taken out across ATMs/branches is high.	Counter CashWithdrawals24h (Data Name CustomerId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a cash withdrawal at an ATM or branch (Payload.Channel.MatchEqual("CashWithdrawal"), Channel is a placeholder field), so the count includes the current event. This rule reads it at 5000, a placeholder, because the library gives no value.	Matched = TTLCounter.CashWithdrawals24h.MatchGreater(5000)	Tag: Velocity · Both · Customer · 24h/7d
1.2-07	Cumulative cash-equivalent purchases	Value of gift cards, prepaid cards, money orders, chips purchased in a window.	Counter CashEquivalentPurchases7d (Data Name CustomerId, Interval 7 Days, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a purchase at an MCC in List.CashEquivalentMccs (gift cards, prepaid cards, money orders, chips; a compliance-maintained list), so the count includes the current event. This rule reads it at 1000, a placeholder, because the library gives no value.	Matched = TTLCounter.CashEquivalentPurchases7d.MatchGreaterOrEqual(1000)	Tag: Velocity · Both · Customer · 7d
1.2-08	Cumulative value to a single beneficiary	Total sent to one payee exceeds a ceiling, especially a new payee.	Counter ValueToBeneficiary30d (Data Name AccountBeneficiaryKey, Interval 30 Days, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on an outbound payment (AccountBeneficiaryKey is a composite placeholder field), so the count includes the current event. This rule reads it at 5000, a placeholder, because the library gives no value.	Matched = TTLCounter.ValueToBeneficiary30d.MatchGreater(5000)	Tag: Velocity · Both · Account+Beneficiary · 30d
1.2-09	Cumulative value to high-risk jurisdictions	Total sent to higher-risk countries in a period.	Counter ValueToHighRiskJurisdictions30d (Data Name CustomerId, Interval 30 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on Payload.DestinationCountry.MatchInList(List.HighRiskJurisdictions). The list is governed reference data. This rule reads it at 5000, a placeholder because the library gives no N.	Matched = TTLCounter.ValueToHighRiskJurisdictions30d.MatchGreater(5000)	Check: The list must come from a current authoritative source (for example the FATF public lists); verify list version and date Tag: Velocity · AML · Customer · 30d
1.2-10	Cumulative value to crypto exchanges	Total transferred to virtual asset providers.	Counter ValueToVirtualAssetProviders30d (Data Name CustomerId, Interval 30 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on Payload.BeneficiaryId.MatchInList(List.VirtualAssetProviders). Jube tests membership only; the maintained list carries the identification. This rule reads it at 5000, a placeholder because the library gives no N.	Matched = TTLCounter.ValueToVirtualAssetProviders30d.MatchGreater(5000)	Check: Virtual-asset provider scope varies by jurisdiction (travel-rule regimes); verify the list definition Tag: Velocity · Both · Customer · 30d
1.2-11	Cumulative value to gambling merchants	Total spend at betting/gaming merchants.	Counter GamblingSpend7d (Data Name CustomerId, Interval 7 Days, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a purchase at an MCC in List.GamblingMccs, so the count includes the current event. This rule reads it at 1000, a placeholder, because the library gives no value.	Matched = TTLCounter.GamblingSpend7d.MatchGreaterOrEqual(1000)	Check: Verify gambling MCC codes against the current card-scheme MCC list (for example MCC 7995) Tag: Velocity · Both · Customer · 7d
1.2-12	Cumulative value of first-time-payee payments	Total sent to newly added payees within first 24h of adding them.	Counter NewPayeeValue24h (Data Name AccountId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a payment to a first-seen payee (Abstraction Rule PriorPaymentsToPayee of 1.1-04 shows zero prior matches) that also falls within 24 hours of the payee being added, tested as Payload.PayeeAddedAt.HoursBetween(Payload.PaymentAt).MatchInRange(0, 24) (PayeeAddedAt is a placeholder field). This rule reads it at 5000, a placeholder because the library gives no N.	Matched = TTLCounter.NewPayeeValue24h.MatchGreater(5000)	Tag: Velocity · Fraud · Account · 24h
1.2-13	Cumulative online banking transfer value after credential change	Value sent soon after password/device/phone change.	Counter CredentialChanges24h (Data Name AccountId, Interval 24 Hours, Count), incremented on a credential, device or phone change. Counter PostCredentialTransferValue24h (Data Name AccountId, Interval 24 Hours, Sum on, Data Value CurrencyAmount) is incremented by an earlier-Priority activation on an online transfer where TTLCounter.CredentialChanges24h.MatchGreater(0), so only transfers after a change are summed. This rule reads it at 2000, a placeholder because the library gives no N.	Matched = TTLCounter.PostCredentialTransferValue24h.MatchGreaterOrEqual(2000)	Tag: Velocity · Fraud · Account · 24h
1.2-14	Daily limit consumption rate	Share of the daily/transaction limit used in a short time.	Reads counter OutboundValue1h (as in 1.2-01) against a daily limit. The limit is carried in the payload in production; the fragment uses 10000 as a placeholder for it. The ratio is computed inline as TTLCounter.OutboundValue1h.RatioOf(<daily limit>).ZeroIfUndefined(), and this rule tests it at 0.8, a placeholder.	Matched = TTLCounter.OutboundValue1h.RatioOf(10000).ZeroIfUndefined().MatchGreaterOrEqual(0.8)	Tag: Velocity · Fraud · Account · 1h
1.2-15	Large single payment	One payment above a hard monetary threshold for the segment.	No counter. A single-event test on Payload.CurrencyAmount; the segment threshold is not stated and 50000 is a placeholder.	Matched = Payload.CurrencyAmount.MatchGreater(50000)	Tag: Velocity · Both · Account · single event
1.2-16	Large payment relative to product ceiling	Single payment close to the product maximum.	No counter. A single-event test of the amount against a product maximum, with 10000 as a placeholder for it and 5 percent as a placeholder band. In production the maximum is carried in the payload and must be a numeric field.	Matched = Payload.CurrencyAmount.MatchWithinPercentOf(10000, 5)	Tag: Velocity · Fraud · Account · single event
1.2-17	Large credit to dormant or new account	Big credit hitting an account with little history.	Abstraction Rule PriorTransactions12m (Search Key AccountId, Search Interval 12 Months, Function Count) gives the prior count. The match is zero prior transactions together with an amount above a placeholder 5000. Zero over 12 months approximates dormant or new; the dormancy period is firm policy the library does not state. Confirm whether the current event is in the count.	Matched = Abstraction.PriorTransactions12m.MatchEqual(0) And Payload.CurrencyAmount.MatchGreater(5000)	Tag: Velocity · AML · Account · single event
1.2-18	High turnover for stated business type	Aggregate turnover exceeds the declared expected turnover.	Counter Turnover30d (Data Name CustomerId, Interval 30 Days, Sum on, Data Value CurrencyAmount). Dictionary DeclaredTurnover is keyed on a composite placeholder field CustomerBusinessTypeKey and holds declared turnover. The ratio is computed inline as TTLCounter.Turnover30d.RatioOf(Dictionary.DeclaredTurnover).ZeroIfUndefined(); this rule tests it above 1.	Matched = TTLCounter.Turnover30d.RatioOf(Dictionary.DeclaredTurnover).ZeroIfUndefined().MatchGreater(1)	Tag: Velocity · AML · Customer · 30d

1.3 Card-present and card-not-present velocity

#	Example	Description	Jube construction	Fragment	Notes
1.3-01	Card transaction count in 10 minutes	Short-window burst of card authorisations.	Counter CardAuthorisations10m (Data Name CardId, Interval 10 Minutes, Count). Incremented by an earlier-Priority activation on a card authorisation (Payload.TxnType.MatchEqual("CardAuthorisation")), so the count includes the current event. This rule reads it at 5, the library’s illustrative value.	Matched = TTLCounter.CardAuthorisations10m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card · 10m, count ≥ 5
1.3-02	Card transaction value in 1 hour	Hourly spend on a card exceeds a threshold.	Counter CardValue1h (Data Name CardId, Interval 1 Hour, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a card authorisation, so the count includes the current event. This rule reads it at 2000, a placeholder, because the library gives no value.	Matched = TTLCounter.CardValue1h.MatchGreaterOrEqual(2000)	Tag: Velocity · Fraud · Card · 1h
1.3-03	Card declined count	Many declines on a single card (testing, limit probing).	Counter CardDeclines30m (Data Name CardId, Interval 30 Minutes, Count). Incremented by an earlier-Priority activation on a declined card payment (Payload.Outcome.MatchEqual("Declined"), Outcome is a placeholder field), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.CardDeclines30m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card · 30m
1.3-04	BIN attack: many declines per BIN	A large number of declines across card numbers sharing one BIN at a merchant.	Abstraction Rule BinMerchantDistinctCards15m (Search Key BinMerchant, a composite placeholder field, Search Interval 15 Minutes, Function Distinct Count on CardId) over declined events. The BIN must arrive as a payload field, because TTL and Abstraction keys are raw payload fields. This rule reads it at 10, a placeholder because the library gives no N.	Matched = Abstraction.BinMerchantDistinctCards15m.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · BIN+Merchant · 15m
1.3-05	Card testing: small-value approvals followed by large	Series of tiny approved transactions at one merchant (count component).	Counter SmallApprovals30m (Data Name CardMerchant, a composite placeholder field, Interval 30 Minutes, Count), incremented by an earlier-Priority activation on an approved payment where Payload.CurrencyAmount.MatchLess(2), with 2 a placeholder. A second activation on Payload.CurrencyAmount.MatchGreater(500), with 500 a placeholder, reads the same counter, so followed-by-large is approximated by the small-approval count. This rule reads it at 3, a placeholder.	Matched = TTLCounter.SmallApprovals30m.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Card · 30m
1.3-06	Merchant decline rate spike	Count of declines at a merchant jumps over its normal level.	Counters MerchantDeclines15m (Data Name MerchantId, Interval 15 Minutes, Count) and MerchantDeclines30d (Data Name MerchantId, Interval 30 Days, Count), both incremented on declines. The spike ratio is computed inline as TTLCounter.MerchantDeclines15m.RatioOf(TTLCounter.MerchantDeclines30d.DividedBy(2880)).ZeroIfUndefined(), where 2880 is 30 days in 15-minute slots, so the 30-day counter is a crude normal-level baseline. This rule tests the spike ratio at 3, a placeholder for k.	Matched = TTLCounter.MerchantDeclines15m.RatioOf(TTLCounter.MerchantDeclines30d.DividedBy(2880)).ZeroIfUndefined().MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Merchant · 15m
1.3-07	Merchant authorisation velocity	Surge in total authorisations at a merchant (bust-out, card-testing target).	Counters MerchantAuthorisations1h (Data Name MerchantId, Interval 1 Hour, Count) and MerchantAuthorisations30d (Data Name MerchantId, Interval 30 Days, Count). The spike ratio is computed inline as TTLCounter.MerchantAuthorisations1h.RatioOf(TTLCounter.MerchantAuthorisations30d.DividedBy(720)).ZeroIfUndefined(), where 720 is 30 days in hours. This is the same baseline approximation as 1.3-06. This rule tests the spike ratio at 3, a placeholder for k.	Matched = TTLCounter.MerchantAuthorisations1h.RatioOf(TTLCounter.MerchantAuthorisations30d.DividedBy(720)).ZeroIfUndefined().MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Merchant · 1h
1.3-08	ATM withdrawal count	Multiple ATM withdrawals within a short window.	Counter AtmWithdrawals2h (Data Name CardId, Interval 2 Hours, Count). Incremented by an earlier-Priority activation on an ATM withdrawal (Payload.TxnType.MatchEqual("AtmWithdrawal")), so the count includes the current event. This rule reads it at 4, the library’s illustrative value.	Matched = TTLCounter.AtmWithdrawals2h.MatchGreaterOrEqual(4)	Tag: Velocity · Fraud · Card · 2h, count ≥ 4
1.3-09	ATM withdrawal value in 24h	Cumulative ATM cash taken in a day.	Counter AtmWithdrawalValue24h (Data Name CardId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on an ATM withdrawal, so the count includes the current event. This rule reads it at 1000, a placeholder, because the library gives no value.	Matched = TTLCounter.AtmWithdrawalValue24h.MatchGreaterOrEqual(1000)	Tag: Velocity · Fraud · Card · 24h
1.3-10	ATM balance enquiry velocity	Many balance enquiries without withdrawal.	Counter AtmBalanceEnquiries1h (Data Name CardId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on an ATM balance enquiry (Payload.TxnType.MatchEqual("BalanceEnquiry")), so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.AtmBalanceEnquiries1h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Card · 1h
1.3-11	Contactless count since last PIN	Excess consecutive contactless transactions.	Single event. The contactless count since the last PIN is supplied upstream by the card processor as ContactlessCount, so no counter reset is needed. The threshold of 5 is illustrative.	Matched = Payload.ContactlessCount.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card · rolling
1.3-12	Contactless cumulative value since last PIN	Value accumulated without strong authentication.	Single event. The contactless value since the last PIN is supplied upstream by the card processor as ContactlessValue. The threshold is illustrative.	Matched = Payload.ContactlessValue.MatchGreaterOrEqual(250)	Tag: Velocity · Fraud · Card · rolling
1.3-13	Chargeback count per merchant	Chargebacks at a merchant exceed a threshold.	Counter ChargebacksPerMerchant30d (Data Name MerchantId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a chargeback, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.ChargebacksPerMerchant30d.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Merchant · 30d
1.3-14	Refund velocity	High volume or value of refunds issued to cards.	Counter RefundsPerMerchant7d (Data Name MerchantId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a refund (Payload.TxnType.MatchEqual("Refund")); a Sum on variant with the same window gives value, so the count includes the current event. This rule reads it at 20, a placeholder, because the library gives no value.	Matched = TTLCounter.RefundsPerMerchant7d.MatchGreaterOrEqual(20)	Tag: Velocity · Both · Merchant · 7d
1.3-15	Refund to a different card than purchase	Refunds to a card other than that used to pay (count).	Abstraction Rule RefundCardsPerOrder7d (Search Key OrderId, Search Interval 7 Days, Function Distinct Count on CardId) over refund events. It assumes the purchase and the refund share OrderId in the payload and that both are in the cache. A distinct count above 1 flags a refund to a different card.	Matched = Abstraction.RefundCardsPerOrder7d.MatchGreater(1)	Tag: Velocity · Fraud · Merchant · 7d
1.3-16	Foreign merchant transaction count	Many transactions at overseas merchants in a short window.	Counter ForeignMerchantTxns24h (Data Name CardId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a payment where Payload.MerchantCountry <> Payload.CardCountry (both placeholder fields), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.ForeignMerchantTxns24h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card · 24h
1.3-17	High-risk MCC spend velocity	Spending at risky merchant category codes.	Counter HighRiskMccSpend24h (Data Name CardId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a purchase at an MCC in List.HighRiskMccs, so the count includes the current event. This rule reads it at 500, a placeholder, because the library gives no value.	Matched = TTLCounter.HighRiskMccSpend24h.MatchGreaterOrEqual(500)	Tag: Velocity · Both · Card · 24h
1.3-18	Recurring billing decline retry velocity	Repeated retries after declines on subscriptions.	Counter RecurringRetryDeclines24h (Data Name CardMerchant, a composite placeholder field, Interval 24 Hours, Count), incremented by an earlier-Priority activation on a declined recurring-billing retry (Payload.TxnType.MatchEqual("RecurringRetry")). This rule reads it at 3, a placeholder because the library gives no N.	Matched = TTLCounter.RecurringRetryDeclines24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Card+Merchant · 24h
1.3-19	Pre-authorisation velocity	Many pre-auths (hotels, fuel) without capture.	Counters PreAuths24h (Data Name CardId, Interval 24 Hours, Count) and Captures24h (same key and window), incremented on pre-authorisation and capture. The uncaptured count is computed inline as TTLCounter.PreAuths24h.Minus(TTLCounter.Captures24h). This approximates pre-auths without capture by count. This rule tests it at 3, a placeholder.	Matched = TTLCounter.PreAuths24h.Minus(TTLCounter.Captures24h).MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Card · 24h
1.3-20	Token provisioning velocity	Many wallet tokens provisioned for a card in a short window.	Counter TokenProvisionings24h (Data Name CardId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a token provisioning event (Payload.TxnType.MatchEqual("TokenProvisioning")), so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.TokenProvisionings24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Card · 24h

1.4 Digital channel, session and authentication velocity

#	Example	Description	Jube construction	Fragment	Notes
1.4-01	Failed login count per account	Repeated failed logins against one username (brute force).	Counter FailedLoginsPerAccount15m (Data Name AccountId, Interval 15 Minutes, Count). Incremented by an earlier-Priority activation on a failed login (Payload.EventType.MatchEqual("FailedLogin"), EventType is a placeholder field), so the count includes the current event. This rule reads it at 5, the library’s illustrative value.	Matched = TTLCounter.FailedLoginsPerAccount15m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 15m, count ≥ 5
1.4-02	Failed login count per IP address	Many failed logins from one IP across many accounts (credential stuffing).	Counter FailedLoginsPerIp15m (Data Name IP, Interval 15 Minutes, Count), incremented on failed logins, and Abstraction Rule IpDistinctAccounts15m (Search Key IP, Search Interval 15 Minutes, Function Distinct Count on AccountId). Volume plus breadth gives the credential-stuffing signal. The library gives neither N nor M, so 20 and 5 are placeholders.	Matched = TTLCounter.FailedLoginsPerIp15m.MatchGreaterOrEqual(20) And Abstraction.IpDistinctAccounts15m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · IP · 15m
1.4-03	Failed login count per device	Many failures from one device.	Counter FailedLoginsPerDevice15m (Data Name DeviceId, Interval 15 Minutes, Count). Incremented by an earlier-Priority activation on a failed login, so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.FailedLoginsPerDevice15m.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Device · 15m
1.4-04	Successful logins per account per day	Unusual login frequency for the account.	Counter SuccessfulLogins24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a successful login, so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.SuccessfulLogins24h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Account · 24h
1.4-05	OTP request velocity	Many one-time-passcode requests (SIM-swap/OTP bombing).	Counter OtpRequests30m (Data Name PhoneNumber, Interval 30 Minutes, Count). Incremented by an earlier-Priority activation on an OTP request (keyed on phone, so an account-level count needs a second counter), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.OtpRequests30m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account/Phone · 30m
1.4-06	OTP failure velocity	Repeated wrong OTP entries.	Counter OtpFailures30m (Data Name AccountId, Interval 30 Minutes, Count). Incremented by an earlier-Priority activation on a wrong OTP entry, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.OtpFailures30m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 30m
1.4-07	Password reset request velocity	Many resets requested in a short period.	Counter PasswordResets24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a password reset request, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.PasswordResets24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 24h
1.4-08	Account recovery attempt velocity	Multiple recovery flows started.	Counter RecoveryAttempts24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on the start of an account recovery flow, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.RecoveryAttempts24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 24h
1.4-09	Biometric failure velocity	Repeated biometric authentication failures.	Counter BiometricFailures1h (Data Name DeviceId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a biometric authentication failure, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.BiometricFailures1h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Device · 1h
1.4-10	API call rate per client	Bot-like request rates against payment or login endpoints.	Counter ApiCalls1m (Data Name ApiKey, Interval 1 Minute, Count). Incremented by an earlier-Priority activation on an API call to a payment or login endpoint (sub-minute bursts favour online aggregation), so the count includes the current event. This rule reads it at 300, a placeholder, because the library gives no value.	Matched = TTLCounter.ApiCalls1m.MatchGreaterOrEqual(300)	Tag: Velocity · Fraud · API key/IP · 1m
1.4-11	Session count per account	Many concurrent or sequential sessions.	Counter SessionsCreated1h (Data Name AccountId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a session creation (TTL counters cannot decrement on logout, so this counts sessions created, not concurrent sessions), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.SessionsCreated1h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 1h
1.4-12	Session creation rate per device	Many new sessions from one device.	Counter SessionsCreatedPerDevice1h (Data Name DeviceId, Interval 1 Hour, Count). Incremented by an earlier-Priority activation on a session creation, so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.SessionsCreatedPerDevice1h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Device · 1h
1.4-13	Page-to-payment latency (speed)	Payment initiated implausibly quickly after login (scripted).	Single event. The login and payment timestamps are DateTime payload fields, PaymentTime and LoginTime (placeholder names). SecondsBetween gives the elapsed seconds, a negative value is excluded, and the threshold of 3 seconds is an illustrative placeholder.	Matched = Payload.PaymentTime.SecondsBetween(Payload.LoginTime).RequireGreaterOrEqual(0).MatchLess(3)	Tag: Velocity · Fraud · Session · single event
1.4-14	Form completion speed	Application or payee form completed faster than human possible.	Single event. The form start and submit timestamps are DateTime payload fields, FormStartTime and SubmitTime (placeholder names). The threshold of 10 seconds is an illustrative placeholder.	Matched = Payload.SubmitTime.SecondsBetween(Payload.FormStartTime).RequireGreaterOrEqual(0).MatchLess(10)	Tag: Velocity · Fraud · Session · single event
1.4-15	Beneficiary additions velocity	Many payees added in a short window.	Counter BeneficiaryAdditions24h (Data Name AccountId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a beneficiary added, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.BeneficiaryAdditions24h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 24h
1.4-16	Limit change velocity	Several limit increases requested.	Counter LimitIncreaseRequests7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a limit increase request, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.LimitIncreaseRequests7d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 7d
1.4-17	Contact detail change velocity	Repeated changes to email, phone or address.	Counter ContactDetailChanges30d (Data Name AccountId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on an email, phone or address change, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.ContactDetailChanges30d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 30d
1.4-18	Device enrolment velocity	Multiple devices registered quickly.	Counter DeviceEnrolments7d (Data Name AccountId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a device enrolment, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.DeviceEnrolments7d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 7d

1.5 Onboarding and application velocity

#	Example	Description	Jube construction	Fragment	Notes
1.5-01	Account applications per day from one device/IP	Many applications from one source.	Counter ApplicationsPerDevice24h (Data Name DeviceId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on an account application submitted (an IP-keyed variant swaps the Data Name to IP), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.ApplicationsPerDevice24h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Device/IP · 24h
1.5-02	Applications per identity document	Same document used repeatedly across applications.	Counter ApplicationsPerDocument30d (Data Name DocumentNumber, Interval 30 Days, Count). Incremented by an earlier-Priority activation on an application submitted (DocumentNumber is a placeholder field), so the count includes the current event. This rule reads it at 2, a placeholder, because the library gives no value.	Matched = TTLCounter.ApplicationsPerDocument30d.MatchGreaterOrEqual(2)	Tag: Velocity · Fraud · Document · 30d
1.5-04	Credit application velocity (bureau enquiries)	Many credit enquiries in a short time (bust-out).	Counter BureauEnquiries30d (Data Name CustomerId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a bureau enquiry (Payload.EventType.MatchEqual("BureauEnquiry")), so the count includes the current event. This rule reads it at 4, a placeholder, because the library gives no value.	Matched = TTLCounter.BureauEnquiries30d.MatchGreaterOrEqual(4)	Tag: Velocity · Fraud · Customer · 30d
1.5-05	New account opening velocity per branch/agent	Unusual number of accounts opened by one staff member or agent.	Counter AccountsOpened7dPerAgent (Data Name AgentId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on an account opened, so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.AccountsOpened7dPerAgent.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Agent · 7d
1.5-06	Dormant-to-active reactivation count	Multiple dormant accounts reactivated by one actor.	Counter DormantReactivations7dPerAgent (Data Name AgentId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a reactivation of a dormant account (WasDormant is a Boolean placeholder field), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.DormantReactivations7dPerAgent.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Agent/Device · 7d
1.5-07	New products opened soon after onboarding	Multiple products taken in first days (synthetic identity/bust-out).	Counter EarlyProductsOpened14d (Data Name CustomerId, Interval 14 Days, Count), incremented by an earlier-Priority activation on a product opened where Payload.OnboardedAt.DaysBetween(Payload.ProductOpenedAt).MatchInRange(0, 14) (placeholder fields). DaysBetween returns the later date minus the earlier one, so the range keeps only products opened after onboarding. This rule reads it at 3, a placeholder because the library gives no N.	Matched = TTLCounter.EarlyProductsOpened14d.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Customer · 14d
1.5-08	Early account funding velocity	Large funding within first days of opening.	Counter EarlyFundingValue7d (Data Name AccountId, Interval 7 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on a funding credit where Payload.OpenedAt.DaysBetween(Payload.FundedAt).MatchInRange(0, 7) (placeholder fields). This rule reads it at 5000, a placeholder because the library gives no N.	Matched = TTLCounter.EarlyFundingValue7d.MatchGreaterOrEqual(5000)	Tag: Velocity · AML · Account · 7d
1.5-09	Rapid limit utilisation after account opening	Credit lines fully used soon after opening.	Counter EarlyUtilisationValue30d (Data Name AccountId, Interval 30 Days, Sum on, Data Value CurrencyAmount), incremented by an earlier-Priority activation on a utilisation event where Payload.OpenedAt.DaysBetween(Payload.UtilisedAt).MatchInRange(0, 30) and Payload.CurrencyAmount.PercentOf(Payload.CreditLimit).MatchGreater(80) (CreditLimit is a placeholder field and 80 a placeholder). This rule reads it at 5000, a placeholder.	Matched = TTLCounter.EarlyUtilisationValue30d.MatchGreater(5000)	Tag: Velocity · Fraud · Account · 30d

1.6 Cash, trade, crypto and specialist velocity

#	Example	Description	Jube construction	Fragment	Notes
1.6-01	Cash-intensive business deposit velocity	Deposit volume inconsistent with business type.	Counter CashDeposits7d (Data Name CustomerId, Interval 7 Days, Sum on, Data Value CurrencyAmount), incremented on cash deposits. Dictionary ExpectedCashByBusinessType is keyed on a placeholder BusinessTypeCode field and gives expected cash volume. The ratio is computed inline as TTLCounter.CashDeposits7d.RatioOf(Dictionary.ExpectedCashByBusinessType).ZeroIfUndefined(); this rule tests it above 1.	Matched = TTLCounter.CashDeposits7d.RatioOf(Dictionary.ExpectedCashByBusinessType).ZeroIfUndefined().MatchGreater(1)	Tag: Velocity · AML · Customer · 7d
1.6-02	Third-party cash deposits	Count of cash deposits into an account by non-account holders.	Counter ThirdPartyCashDeposits7d (Data Name AccountId, Interval 7 Days, Count), incremented by an earlier-Priority activation on a cash deposit where Payload.DepositorId <> Payload.AccountHolderId (placeholder fields). This rule reads it at 3, a placeholder because the library gives no N.	Matched = TTLCounter.ThirdPartyCashDeposits7d.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Account · 7d
1.6-03	Foreign currency exchange velocity	Frequent FX conversions, sometimes just under limits.	Counter FxNearLimit7d (Data Name CustomerId, Interval 7 Days, Count), incremented by an earlier-Priority activation on Payload.CurrencyAmount.MatchIsJustBelowThreshold(10000, 5), where 10000 and 5 are placeholder limit and margin. This rule reads it at 3, a placeholder because the library gives no N.	Matched = TTLCounter.FxNearLimit7d.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Customer · 7d
1.6-04	Prepaid card loading velocity	Frequent loads onto prepaid instruments.	Counter PrepaidLoads7d (Data Name CardId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a prepaid card load, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.PrepaidLoads7d.MatchGreaterOrEqual(5)	Tag: Velocity · Both · Card · 7d
1.6-05	Prepaid card cash-out velocity	Rapid ATM cash-out of loaded prepaid cards.	Counter PrepaidAtmCashOuts24h (Data Name CardId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on an ATM cash-out from a prepaid card, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.PrepaidAtmCashOuts24h.MatchGreaterOrEqual(3)	Tag: Velocity · Both · Card · 24h
1.6-06	Crypto purchase velocity	Many crypto purchases with card or bank transfer.	Counter CryptoPurchases24h (Data Name CustomerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a crypto purchase, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.CryptoPurchases24h.MatchGreaterOrEqual(5)	Tag: Velocity · Both · Customer · 24h
1.6-07	Crypto withdrawal velocity to external wallets	Many outbound withdrawals to unhosted wallets.	Counter CryptoExternalWithdrawals24h (Data Name CustomerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a withdrawal to an external wallet, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.CryptoExternalWithdrawals24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Customer · 24h
1.6-08	Trade invoice volume per counterparty	High count/value of invoices with one counterparty.	Counter InvoicesPerCounterparty30d (Data Name CounterpartyId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on an invoice (the section allows Count or Sum; Count shown), so the count includes the current event. This rule reads it at 20, a placeholder, because the library gives no value.	Matched = TTLCounter.InvoicesPerCounterparty30d.MatchGreaterOrEqual(20)	Tag: Velocity · AML · Customer · 30d
1.6-09	Letter-of-credit amendment velocity	Repeated amendments to LC terms.	Counter LcAmendments30d (Data Name LcReference, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a letter-of-credit amendment, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.LcAmendments30d.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Customer · 30d
1.6-10	Securities trade count in a short window	Churning, wash trading, or layering via brokerage.	Counter SecuritiesTrades1d (Data Name AccountId, Interval 1 Day, Count). Incremented by an earlier-Priority activation on a securities trade, so the count includes the current event. This rule reads it at 50, a placeholder, because the library gives no value.	Matched = TTLCounter.SecuritiesTrades1d.MatchGreaterOrEqual(50)	Tag: Velocity · AML · Account · 1d
1.6-11	Insurance policy surrender/loan velocity	Early surrenders or policy loans soon after purchase.	Counter PolicySurrenders90d (Data Name PolicyId, Interval 90 Days, Count), incremented by an earlier-Priority activation on a surrender or policy loan where Payload.PurchasedAt.DaysBetween(Payload.EventAt).MatchInRange(0, 90) (placeholder fields). This rule reads it at 2, a placeholder because the library gives no N.	Matched = TTLCounter.PolicySurrenders90d.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Policy · 90d
1.6-12	Remittance sends per sender	Many small remittances to different recipients.	Counter RemittanceSendsSmall7d (Data Name SenderId, Interval 7 Days, Count), incremented by an earlier-Priority activation on a send where Payload.CurrencyAmount.MatchLess(200) (200 is a placeholder for the small threshold). Abstraction Rule RemittanceDistinctRecipients7d (Search Key SenderId, Search Interval 7 Days, Function Distinct Count on RecipientId). This rule reads the counter at 10 and the abstraction at 5, both placeholders.	Matched = TTLCounter.RemittanceSendsSmall7d.MatchGreaterOrEqual(10) And Abstraction.RemittanceDistinctRecipients7d.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Sender · 7d
1.6-14	Casino chip purchase/cash-out velocity	Frequent chip buy-ins and cash-outs with minimal play.	Counters ChipBuyIns24h (Data Name PlayerId, Interval 24 Hours, Count), ChipBuyInValue24h (same key and window, Sum on, Data Value CurrencyAmount) and WageredValue24h (same key and window, Sum on). The minimal-play ratio is computed inline as TTLCounter.WageredValue24h.RatioOf(TTLCounter.ChipBuyInValue24h).ZeroIfUndefined(), and minimal play is a ratio below 0.2, a placeholder. This rule tests the count at 5, a placeholder, and the ratio below 0.2.	Matched = TTLCounter.ChipBuyIns24h.MatchGreaterOrEqual(5) And TTLCounter.WageredValue24h.RatioOf(TTLCounter.ChipBuyInValue24h).ZeroIfUndefined().MatchLess(0.2)	Tag: Velocity · AML · Player · 24h
1.6-15	Real-estate escrow funding velocity	Many funding events into escrow.	Counter EscrowFundings30d (Data Name AccountId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on an escrow funding event, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.EscrowFundings30d.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 30d
1.6-16	Payroll file size and frequency anomalies	Payroll batches with unusual counts or cadence.	Abstraction Rules PayrollRowCountAverage30d (Search Key AccountId, Search Interval 30 Days, Function Average on RowCount) and PayrollRowCountStdDev30d (same key and window, Function Standard Deviation on RowCount). RowCount is a Double-typed placeholder payload field. The cadence part of the section is a separate Abstraction Rule with function Since on payroll files and is not in this fragment. A z-score of 3 is a placeholder choice the library does not give.	Matched = Payload.RowCount.MatchZScoreAbove(Abstraction.PayrollRowCountAverage30d, Abstraction.PayrollRowCountStdDev30d, 3)	Tag: Velocity · Fraud · Account · 30d
1.6-17	Bulk payment file value spike	Batch upload with value well above usual.	Abstraction Rules FileTotalAverage90d and FileTotalStdDev90d (Search Key AccountId, Search Interval 90 Days, Functions Average and Standard Deviation over FileTotal, a placeholder field). This is a single-event test against that baseline; confirm the baseline excludes the file being tested. A z-score of 3 is a placeholder choice the library does not give.	Matched = Payload.FileTotal.MatchZScoreAbove(Abstraction.FileTotalAverage90d, Abstraction.FileTotalStdDev90d, 3)	Tag: Velocity · Fraud · Account · single event

1.7 Insurance velocity

#	Example	Description	Jube construction	Fragment	Notes
1.7-01	Multiple claims per policy in short period	Claim frequency far above product norm.	Counter ClaimsPerPolicy12m (Data Name PolicyId, Interval 12 Months, Count). Incremented by an earlier-Priority activation on a claim, so the count includes the current event. This rule reads it at 3, the library’s illustrative value.	Matched = TTLCounter.ClaimsPerPolicy12m.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Policy · 12m, claims ≥ 3
1.7-02	Multiple claims per claimant across policies	Same claimant on many claims across products.	Counter ClaimsPerClaimant24m (Data Name ClaimantId, Interval 24 Months, Count). Incremented by an earlier-Priority activation on a claim (across-policy breadth could add an Abstraction Rule Distinct Count on PolicyId), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.ClaimsPerClaimant24m.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Claimant · 24m
1.7-03	Claims filed soon after policy inception	Claim within the first days/weeks of cover.	Single event. The claim and inception dates are DateTime payload fields, ClaimDate and PolicyInceptionDate (placeholder names). The 30 day window is an illustrative placeholder.	Matched = Payload.ClaimDate.DaysBetween(Payload.PolicyInceptionDate).RequireGreaterOrEqual(0).MatchLessOrEqual(30)	Tag: Velocity · Fraud · Policy · first 30d
1.7-04	Claims filed just before policy lapse/expiry	Last-minute claims.	Single event. The expiry and claim dates are DateTime payload fields, PolicyExpiryDate and ClaimDate (placeholder names). The 14 day window is an illustrative placeholder.	Matched = Payload.PolicyExpiryDate.DaysBetween(Payload.ClaimDate).RequireGreaterOrEqual(0).MatchLessOrEqual(14)	Tag: Velocity · Fraud · Policy · final 14d
1.7-05	Policy purchases per payment card/device	Many new policies bought from one card or device.	Counter PolicyPurchases7dPerCard (Data Name CardId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on a policy purchase (a device-keyed variant swaps the Data Name to DeviceId), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.PolicyPurchases7dPerCard.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card/Device · 7d
1.7-06	Premium payments from many different cards	One policy funded by several cards.	Abstraction Rule PremiumDistinctCards90d (Search Key PolicyId, Search Interval 90 Days, Function Distinct Count on CardId) over premium payment events. This rule reads it at 3, a placeholder because the library gives no N.	Matched = Abstraction.PremiumDistinctCards90d.MatchGreaterOrEqual(3)	Tag: Velocity · Both · Policy · 90d
1.7-07	Single-premium life/investment policies purchased in a burst	Several high-value single-premium policies bought in quick succession.	Counter SinglePremiumValue30d (Data Name CustomerId, Interval 30 Days, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a single-premium policy purchase (Payload.ProductType.MatchEqual("SinglePremium"), a placeholder value), so the count includes the current event. This rule reads it at 50000, a placeholder, because the library gives no value.	Matched = TTLCounter.SinglePremiumValue30d.MatchGreaterOrEqual(50000)	Tag: Velocity · AML · Customer · 30d
1.7-08	Policy loan requests velocity	Repeated loans against cash value.	Counter PolicyLoanRequests90d (Data Name PolicyId, Interval 90 Days, Count). Incremented by an earlier-Priority activation on a policy loan request, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.PolicyLoanRequests90d.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Policy · 90d
1.7-09	Beneficiary change velocity	Frequent changes of policy beneficiary.	Counter BeneficiaryChanges12m (Data Name PolicyId, Interval 12 Months, Count). Incremented by an earlier-Priority activation on a beneficiary change, so the count includes the current event. This rule reads it at 2, a placeholder, because the library gives no value.	Matched = TTLCounter.BeneficiaryChanges12m.MatchGreaterOrEqual(2)	Tag: Velocity · Both · Policy · 12m
1.7-10	Broker-submitted application velocity	Broker submits unusual volume of applications.	Counter BrokerApplications7d (Data Name BrokerId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on an application submitted by a broker, so the count includes the current event. This rule reads it at 20, a placeholder, because the library gives no value.	Matched = TTLCounter.BrokerApplications7d.MatchGreaterOrEqual(20)	Tag: Velocity · Fraud · Broker · 7d
1.7-11	Repair-shop/provider invoice velocity	One provider appears on many claims in a window.	Counter ProviderClaims30d (Data Name ProviderId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a claim with a provider, so the count includes the current event. This rule reads it at 10, a placeholder, because the library gives no value.	Matched = TTLCounter.ProviderClaims30d.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Provider · 30d

1.8 Gaming, gambling and casino velocity

#	Example	Description	Jube construction	Fragment	Notes
1.8-01	Deposit count per player per day	Many deposits in a day.	Counter Deposits24h (Data Name PlayerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a deposit (Payload.TxnType.MatchEqual("Deposit")), so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.Deposits24h.MatchGreaterOrEqual(5)	Tag: Velocity · Both · Player · 24h
1.8-02	Deposit value per player per day	Daily deposit value above segment ceiling.	Counter DepositValue24h (Data Name PlayerId, Interval 24 Hours, Sum on, Data Value CurrencyAmount). Incremented by an earlier-Priority activation on a deposit, so the count includes the current event. This rule reads it at 5000, a placeholder, because the library gives no value.	Matched = TTLCounter.DepositValue24h.MatchGreater(5000)	Tag: Velocity · Both · Player · 24h
1.8-03	Withdrawal requests per player	Many withdrawals in a short window.	Counter WithdrawalRequests24h (Data Name PlayerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a withdrawal request, so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.WithdrawalRequests24h.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Player · 24h
1.8-04	Deposit then withdrawal with minimal wagering	Low turnover between in and out (count of such cycles).	Counter DepositWithdrawCycles7d (Data Name PlayerId, Interval 7 Days, Count), incremented by an earlier-Priority activation on a withdrawal where Abstraction Calculation WageredToDeposits7d = TTLCounter.WageredValue7d.RatioOf(TTLCounter.DepositValue7d).ZeroIfUndefined() is below 0.2, a placeholder. Counters WageredValue7d and DepositValue7d (same key and window, Sum on, Data Value CurrencyAmount). The cycle count is approximated by a low wagering ratio. This rule reads it at 2, a placeholder.	Matched = TTLCounter.DepositWithdrawCycles7d.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Player · 7d
1.8-05	Bonus claims per device/IP	Repeated sign-up bonuses (bonus abuse).	Counter BonusClaims30dPerDevice (Data Name DeviceId, Interval 30 Days, Count). Incremented by an earlier-Priority activation on a sign-up bonus claim (an IP-keyed variant swaps the Data Name to IP), so the count includes the current event. This rule reads it at 3, a placeholder, because the library gives no value.	Matched = TTLCounter.BonusClaims30dPerDevice.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Device/IP · 30d
1.8-06	Account registrations per device/IP	Multi-accounting.	Counter Registrations7dPerDevice (Data Name DeviceId, Interval 7 Days, Count). Incremented by an earlier-Priority activation on an account registration, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.Registrations7dPerDevice.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Device/IP · 7d
1.8-07	Chargebacks per player	Repeated disputes on deposits.	Counter ChargebacksPerPlayer90d (Data Name PlayerId, Interval 90 Days, Count). Incremented by an earlier-Priority activation on a chargeback, so the count includes the current event. This rule reads it at 2, a placeholder, because the library gives no value.	Matched = TTLCounter.ChargebacksPerPlayer90d.MatchGreaterOrEqual(2)	Tag: Velocity · Fraud · Player · 90d
1.8-08	Bets per minute (bot betting)	Machine-speed wagering.	Counter BetsPerMinute1m (Data Name PlayerId, Interval 1 Minute, Count). Incremented by an earlier-Priority activation on a bet placed (machine-speed threshold not stated; sub-minute bursts favour online aggregation), so the count includes the current event. This rule reads it at 60, a placeholder, because the library gives no value.	Matched = TTLCounter.BetsPerMinute1m.MatchGreaterOrEqual(60)	Tag: Velocity · Fraud · Player · 1m
1.8-09	Chip transfers between players at a table	Frequent chip passing (chip dumping).	Abstraction Rule TableChipTransfers4h (Search Key TableSessionId, a placeholder field, Search Interval 4 Hours, Function Count) over chip transfer events. The session is approximated by a key and a fixed search interval, since TTL windows have no session boundary. This rule reads it at 10, a placeholder because the library gives no N.	Matched = Abstraction.TableChipTransfers4h.MatchGreaterOrEqual(10)	Tag: Velocity · AML · Player · session
1.8-10	Peer-to-peer game transfers velocity	Poker/social transfers of value.	Counter P2pGameTransfers24h (Data Name PlayerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a P2P game transfer, so the count includes the current event. This rule reads it at 5, a placeholder, because the library gives no value.	Matched = TTLCounter.P2pGameTransfers24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Player · 24h
1.8-11	Cage cash-out count	Multiple cage redemptions in a day.	Counter CageCashOuts24h (Data Name PlayerId, Interval 24 Hours, Count). Incremented by an earlier-Priority activation on a cage cash-out, so the count includes the current event. This rule reads it at 2, a placeholder, because the library gives no value.	Matched = TTLCounter.CageCashOuts24h.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Player · 24h
1.8-12	Lottery ticket cashing frequency	Individual cashing many winning tickets (ticket-cashing scheme).	Counter WinningTicketsCashed90d (Data Name PersonId, Interval 90 Days, Count), incremented by an earlier-Priority activation on a cashed winning ticket (Payload.TicketOutcome.MatchEqual("Winning"), a placeholder field, since the winning flag must be in the payload). This rule reads it at 10, a placeholder because the library gives no N.	Matched = TTLCounter.WinningTicketsCashed90d.MatchGreaterOrEqual(10)	Tag: Velocity · AML · Person · 90d

1.9 Securities, brokerage and investment velocity

#	Example	Description	Jube construction	Fragment	Notes
1.9-01	Trades per account per day	Churning or algorithmic abuse.	TTL counter TradesLastDay (Data Name AccountId, Interval Days / 1, Sum off) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“Trade”), so the reading activation includes the current trade; the threshold of 50 is illustrative.	Matched = TTLCounter.TradesLastDay.MatchGreaterOrEqual(50)	Tag: Velocity · Both · Account · 1d
1.9-03	Deposits followed by withdrawals without trades	Brokerage used as pass-through.	TTL counter NoTradeWithdrawalsWeek (Data Name AccountId, Interval Days / 7, Sum off) is incremented by an activation on withdrawals made while the TTL counter TradesWeek on the same key reads zero; pairing each deposit to the next withdrawal is not expressible, so this counts withdrawals in a zero-trade week. The reading activation thresholds it at an illustrative 3.	Matched = TTLCounter.NoTradeWithdrawalsWeek.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Account · 7d
1.9-04	Transfers of securities (ACATS/journals) velocity	Frequent asset transfers between accounts.	TTL counter AcatsTransfers30Days (Data Name AccountId, Interval Days / 30, Sum off) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“AcatsTransfer”); the reading threshold of 4 is illustrative.	Matched = TTLCounter.AcatsTransfers30Days.MatchGreaterOrEqual(4)	Tag: Velocity · AML · Account · 30d
1.9-05	Journal entries between unrelated accounts	Value moved via book transfers.	TTL counter UnrelatedJournals30Days (Data Name FirmId, a placeholder key, Interval Days / 30, Sum off) is incremented by an activation on journal events where Payload.DestinationAccountId (placeholder) is not a member of List.RelatedAccounts (a maintained list, placeholder name), tested with MatchNotInList. The reading activation thresholds it at an illustrative 5; the list must be kept current, since unrelated depends on it.	Matched = TTLCounter.UnrelatedJournals30Days.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Firm · 30d
1.9-06	Penny-stock purchase velocity	Burst of micro-cap trading.	TTL counter PennyStockBuys7Days (Data Name AccountId, Interval Days / 7, Sum off) is incremented by an earlier-Priority activation on purchases whose Payload.Symbol (placeholder) is a member of List.PennyStockSymbols (placeholder list name), tested with MatchInList; the reading threshold of 10 is illustrative.	Matched = TTLCounter.PennyStockBuys7Days.MatchGreaterOrEqual(10)	Check: Penny-stock definitions vary by market (for example the US SEC Rule 3a51-1 price test); verify the list definition Tag: Velocity · Both · Account · 7d
1.9-07	Physical certificate deposits	Deposits of paper certificates (pump-and-dump).	TTL counter CertificateDeposits90Days (Data Name AccountId, Interval Days / 90, Sum off) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CertificateDeposit”); the reading threshold of 2 is illustrative.	Matched = TTLCounter.CertificateDeposits90Days.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Account · 90d
1.9-08	Margin withdrawals shortly after deposit	Cash-out of margin on newly deposited securities.	Abstraction Rule DaysSinceDeposit (Search Key AccountId, Search Interval 7 Days, Function Since in Days) has a rule fragment that matches both deposits and withdrawals, so the Since value runs from the earliest deposit in the window to the most recent matched event, which is the current withdrawal when it is the latest. The reading activation on margin withdrawals checks that value at an illustrative 2 days. This approximates the deposit-to-withdrawal gap and must be confirmed to compare as intended before relying on it.	Matched = Payload.TxnType.RequireEqual("MarginWithdrawal").Against(Abstraction.DaysSinceDeposit).MatchLessOrEqual(2)	Tag: Velocity · AML · Account · 7d
1.9-09	Fund switch velocity	Repeated fund switches in investment products.	TTL counter FundSwitches30Days (Data Name AccountId, Interval Days / 30, Sum off) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“FundSwitch”); the reading threshold of 4 is illustrative.	Matched = TTLCounter.FundSwitches30Days.MatchGreaterOrEqual(4)	Tag: Velocity · Both · Account · 30d
1.9-10	Third-party payment-in velocity	Funding by non-account-holders.	TTL counter ThirdPartyPaymentsIn30Days (Data Name AccountId, Interval Days / 30, Sum off) is incremented by an earlier-Priority activation on incoming payments where Payload.Payer (placeholder) does not equal Payload.AccountHolder (placeholder), tested with MatchNotEqual; the reading threshold of 3 is illustrative.	Matched = TTLCounter.ThirdPartyPaymentsIn30Days.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Account · 30d

1.10 Crypto / virtual-asset velocity

#	Example	Description	Jube construction	Fragment	Notes
1.10-01	On-chain deposits per account	Many inbound transfers from different addresses.	Abstraction Rule DistinctSourceAddresses24h (Search Key AccountId, Search Interval 24 Hours, Function Distinct Count on SourceAddress, a placeholder field) has a rule fragment matching inbound on-chain deposits; the reading activation thresholds it at an illustrative 5 distinct addresses.	Matched = Abstraction.DistinctSourceAddresses24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 24h
1.10-02	Fiat on-ramp purchase velocity	Frequent fiat-to-crypto purchases.	TTL counter FiatOnRamps24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“FiatToCrypto”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.FiatOnRamps24h.MatchGreaterOrEqual(3)	Tag: Velocity · Both · Account · 24h
1.10-04	Stablecoin conversion velocity	Rapid swaps into stablecoins (layering).	TTL counter StablecoinSwaps24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on swaps where Payload.ToAsset (placeholder) is a member of List.Stablecoins (placeholder list name), tested with MatchInList; the reading threshold of 4 is illustrative.	Matched = TTLCounter.StablecoinSwaps24h.MatchGreaterOrEqual(4)	Tag: Velocity · AML · Account · 24h
1.10-05	Internal (off-chain) transfer velocity	Many internal account-to-account transfers.	TTL counter InternalTransfers24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“InternalTransfer”); the reading threshold of 10 is illustrative.	Matched = TTLCounter.InternalTransfers24h.MatchGreaterOrEqual(10)	Tag: Velocity · AML · Account · 24h
1.10-06	Address generation velocity	Many new deposit addresses created.	TTL counter AddressesGenerated24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“AddressGenerated”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.AddressesGenerated24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 24h
1.10-07	API-key trading velocity	Bot trading after API key creation.	TTL counter ApiKeyTrades1h (Data Name AccountId, Interval Hours / 1, Count) is incremented by an earlier-Priority activation on trades where Payload.ApiKeyCreatedAt (placeholder) HoursBetween Payload.TradeAt (placeholder) is at most 1, since HoursBetween returns the later time minus the earlier; the reading threshold of 10 is illustrative.	Matched = TTLCounter.ApiKeyTrades1h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Account · 1h
1.10-08	NFT mint/sale velocity	Frequent NFT trades between a small set of wallets.	Abstraction Rule NftCounterparties24h (Search Key WalletAddress, a placeholder key, Search Interval 24 Hours, Function Distinct Count on Counterparty) gives the distinct counterparties; TTL counter NftTrades24h (Data Name WalletAddress, Interval Days / 1, Count) counts mints and sales. The reading activation requires an illustrative 20 trades and then at most an illustrative 3 distinct counterparties.	Matched = TTLCounter.NftTrades24h.RequireGreaterOrEqual(20).Against(Abstraction.NftCounterparties24h).MatchLessOrEqual(3)	Tag: Velocity · AML · Wallet · 24h
1.10-09	Mixer/tumbler interaction count	Transactions with mixing services.	TTL counter MixerInteractions30Days (Data Name WalletAddress, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.CounterpartyAddress (placeholder) being a member of List.MixerAddresses (firm-maintained, placeholder list name), tested with MatchInList; the threshold of 1 is a judgement, not a regulatory figure.	Matched = TTLCounter.MixerInteractions30Days.MatchGreaterOrEqual(1)	Tag: Velocity · AML · Wallet · 30d
1.10-10	Bridge usage velocity	Cross-chain bridge transfers in a window.	TTL counter BridgeUses24h (Data Name WalletAddress, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.Contract (placeholder) being a member of List.BridgeContracts (placeholder list name); the reading threshold of 5 is illustrative.	Matched = TTLCounter.BridgeUses24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Wallet · 24h
1.10-11	Peer-to-peer marketplace trades velocity	Frequent P2P crypto trades (cash-based).	TTL counter P2PCashTrades7Days (Data Name AccountId, Interval Days / 7, Count) is incremented by an earlier-Priority activation on P2P trades where Payload.PaymentMethod (placeholder) equals “Cash”; the reading threshold of 5 is illustrative.	Matched = TTLCounter.P2PCashTrades7Days.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Account · 7d
1.10-12	Dust transactions received	Many tiny inbound amounts (dusting attack).	TTL counter DustInbound24h (Data Name WalletAddress, Interval Days / 1, Count) is incremented by an earlier-Priority activation on inbound transfers whose Payload.Amount is below a dust threshold chosen per asset (not stated in the section); the reading threshold of 10 is illustrative.	Matched = TTLCounter.DustInbound24h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Wallet · 24h

1.11 Telecom, e-money and wallet velocity

#	Example	Description	Jube construction	Fragment	Notes
1.11-01	Mobile money cash-in count per agent	Agent processes unusual count.	TTL counter AgentCashIns24h (Data Name AgentId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CashIn”); the reading threshold of 50 is illustrative.	Matched = TTLCounter.AgentCashIns24h.MatchGreaterOrEqual(50)	Tag: Velocity · AML · Agent · 24h
1.11-02	Mobile money cash-out count per customer	Multiple cash-outs in a day.	TTL counter WalletCashOuts24h (Data Name WalletId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CashOut”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.WalletCashOuts24h.MatchGreaterOrEqual(5)	Tag: Velocity · Both · Wallet · 24h
1.11-03	Airtime top-up velocity	Frequent airtime purchases (airtime as value transfer).	TTL counter AirtimeTopUps24h (Data Name WalletId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“AirtimeTopUp”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.AirtimeTopUps24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Wallet · 24h
1.11-04	Airtime transfers to many numbers	Airtime sent to multiple subscribers.	Abstraction Rule DistinctAirtimeRecipients24h (Search Key WalletId, a placeholder key, Search Interval 24 Hours, Function Distinct Count on RecipientNumber, a placeholder field) has a rule fragment matching Payload.TxnType.MatchEqual(“AirtimeTransfer”); the reading threshold of 5 is illustrative.	Matched = Abstraction.DistinctAirtimeRecipients24h.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Wallet · 24h
1.11-05	SIM activations per retailer	Bulk SIM activation (SIM-box/fraud).	TTL counter SimActivations24h (Data Name RetailerId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“SimActivation”); the reading threshold of 20 is illustrative.	Matched = TTLCounter.SimActivations24h.MatchGreaterOrEqual(20)	Tag: Velocity · Fraud · Retailer · 24h
1.11-06	International premium-rate call volume	IRSF indicators.	TTL counter PremiumRateCalls1h (Data Name SubscriberId, a placeholder key, Interval Hours / 1, Count) is incremented by an earlier-Priority activation on calls where Payload.DestinationPrefix (placeholder) is a member of List.PremiumRatePrefixes (placeholder list name), tested with MatchInList; the reading threshold of 10 is illustrative.	Matched = TTLCounter.PremiumRateCalls1h.MatchGreaterOrEqual(10)	Check: Premium-rate number ranges are set by each national regulator and change; verify the prefix list source and date Tag: Velocity · Fraud · Subscriber · 1h
1.11-07	Wallet-to-bank transfer velocity	Frequent sweeps out of wallet.	TTL counter WalletToBank24h (Data Name WalletId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“WalletToBank”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.WalletToBank24h.MatchGreaterOrEqual(5)	Tag: Velocity · Both · Wallet · 24h
1.11-08	Merchant QR payments received velocity	Burst of QR receipts at one merchant.	TTL counter QrReceived1h (Data Name MerchantId, a placeholder key, Interval Hours / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“QrPayment”); the reading threshold of 30 is illustrative.	Matched = TTLCounter.QrReceived1h.MatchGreaterOrEqual(30)	Tag: Velocity · Both · Merchant · 1h
1.11-09	Wallet-to-wallet transfers to new contacts	Many transfers to never-seen recipients.	A first-seen test uses an Abstraction Rule Same Count on Recipient (Search Key WalletId, a placeholder key) over a long Search Interval, such as 10 Years, to see whether the recipient has been seen before; a first-seen activation ticks TTL counter NewRecipients24h (Data Name WalletId, Interval Days / 1, Count) when that count is one. This assumes Same Count includes the current event, which must be confirmed, and the long look-back cost must be checked. The reading threshold of 3 is illustrative.	Matched = TTLCounter.NewRecipients24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Wallet · 24h
1.11-10	Bill-payment velocity to one biller	Many bill payments to the same biller account (biller as mule).	TTL counter BillerPayments7Days (Data Name BillerId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“BillPayment”); the reading threshold of 50 is illustrative.	Matched = TTLCounter.BillerPayments7Days.MatchGreaterOrEqual(50)	Tag: Velocity · AML · Wallet · 7d

1.12 Lending, BNPL and credit velocity

#	Example	Description	Jube construction	Fragment	Notes
1.12-01	BNPL orders per customer per day	Many instalment purchases in a day.	TTL counter BnplOrders24h (Data Name CustomerId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“BnplOrder”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.BnplOrders24h.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Customer · 24h
1.12-02	BNPL accounts per device	Multiple BNPL accounts created from one device.	TTL counter BnplAccountsByDevice30Days (Data Name DeviceId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“BnplAccountOpened”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.BnplAccountsByDevice30Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Device · 30d
1.12-03	Loan top-up requests	Frequent requests for additional advances.	TTL counter LoanTopUpRequests30Days (Data Name AccountId, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“TopUpRequest”); the reading threshold of 2 is illustrative.	Matched = TTLCounter.LoanTopUpRequests30Days.MatchGreaterOrEqual(2)	Tag: Velocity · Fraud · Account · 30d
1.12-04	Payment-holiday requests	Repeated forbearance requests.	TTL counter PaymentHolidayRequests12Months (Data Name AccountId, Interval Months / 12, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“PaymentHolidayRequest”); the reading threshold of 2 is illustrative.	Matched = TTLCounter.PaymentHolidayRequests12Months.MatchGreaterOrEqual(2)	Tag: Velocity · Fraud · Account · 12m
1.12-05	Returned repayments (bounced)	Count of failed direct debits.	TTL counter BouncedRepayments90Days (Data Name AccountId, Interval Days / 90, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“FailedDirectDebit”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.BouncedRepayments90Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 90d
1.12-06	Early settlement with third-party funds count	Loans repaid early by others.	TTL counter EarlySettlementsThirdParty12Months (Data Name CustomerId, a placeholder key, Interval Months / 12, Count) is incremented by an earlier-Priority activation on early settlements where Payload.Payer (placeholder) does not equal Payload.Borrower (placeholder); the reading threshold of 2 is illustrative.	Matched = TTLCounter.EarlySettlementsThirdParty12Months.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Customer · 12m
1.12-07	Credit card balance transfers velocity	Balance shuffling across cards.	TTL counter BalanceTransfers90Days (Data Name CustomerId, a placeholder key, Interval Days / 90, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“BalanceTransfer”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.BalanceTransfers90Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Customer · 90d
1.12-08	Cash advance count	Many cash advances in a short window.	TTL counter CashAdvances7Days (Data Name CardId, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CashAdvance”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.CashAdvances7Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Card · 7d
1.12-09	Overpayment then refund count	Credit balance refunds requested repeatedly.	TTL counter CreditBalanceRefunds90Days (Data Name CardId, Interval Days / 90, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CreditBalanceRefund”); the reading threshold of 2 is illustrative.	Matched = TTLCounter.CreditBalanceRefunds90Days.MatchGreaterOrEqual(2)	Tag: Velocity · AML · Card · 90d
1.12-10	Mortgage drawdown and redemption within short period	Property turned over quickly.	TTL counter QuickRedemptions12Months (Data Name PropertyId, a placeholder key, Interval Months / 12, Count) is incremented by an earlier-Priority activation on redemptions where Payload.DrawdownAt (placeholder) DaysBetween Payload.RedemptionAt (placeholder) is at most an illustrative 180 days; the short-period length is not stated in the section.	Matched = TTLCounter.QuickRedemptions12Months.MatchGreaterOrEqual(1)	Tag: Velocity · AML · Customer · 12m

1.13 Corporate banking, treasury and payroll velocity

#	Example	Description	Jube construction	Fragment	Notes
1.13-01	Bulk payment files per day	Unusual number of batches submitted.	TTL counter BulkFiles24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“BulkFile”); the reading threshold of 10 is illustrative.	Matched = TTLCounter.BulkFiles24h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Account · 24h
1.13-02	Payroll runs outside cycle	Payroll files submitted off-cycle.	The off-cycle branch is an incrementing activation for payroll runs: a Reject on the scheduled days followed by Match gives the negation, so only runs on other days tick TTL counter OffCyclePayroll30Days (Data Name AccountId, Interval Days / 30, Count). A second activation reads it at an illustrative 3. The scheduled days 1 and 15 are placeholders.	Matched = Payload.TransactionDate.RejectDayOfMonthIn(1, 15).Match()	Tag: Velocity · Fraud · Account · 30d
1.13-03	New vendor payments per period	Many payments to newly created vendors.	TTL counter NewVendorPayments30Days (Data Name AccountId, Interval Days / 30, Count) is incremented by an earlier-Priority activation on payments where Payload.VendorCreatedAt (placeholder) AgeInDaysAsOf Payload.PaymentAt is at most 30; the reading threshold of 5 is illustrative.	Matched = TTLCounter.NewVendorPayments30Days.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 30d
1.13-04	Intercompany transfers velocity	Frequent inter-entity movements.	TTL counter InterCompanyTransfers30Days (Data Name GroupId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation where Payload.IsIntercompany (placeholder Boolean field) MatchIsTrue; the reading threshold of 10 is illustrative.	Matched = TTLCounter.InterCompanyTransfers30Days.MatchGreaterOrEqual(10)	Tag: Velocity · AML · Group · 30d
1.13-05	Urgent/same-day wires count	Many urgent wires requested.	TTL counter UrgentWires7Days (Data Name AccountId, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“UrgentWire”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.UrgentWires7Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 7d
1.13-06	User-permission changes velocity	Frequent changes to corporate user entitlements.	TTL counter PermissionChanges30Days (Data Name AccountId, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“PermissionChange”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.PermissionChanges30Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 30d
1.13-07	Approver self-approval count	Same user initiating and approving.	TTL counter SelfApprovals30Days (Data Name UserId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation on approvals where Payload.InitiatorId (placeholder) MatchEqual Payload.ApproverId (placeholder); the reading threshold of 1 is a judgement.	Matched = TTLCounter.SelfApprovals30Days.MatchGreaterOrEqual(1)	Tag: Velocity · Fraud · User · 30d
1.13-08	Expense reimbursement velocity per employee	Burst of expense claims.	TTL counter ExpenseClaims30Days (Data Name EmployeeId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“ExpenseClaim”); the reading threshold of 10 is illustrative.	Matched = TTLCounter.ExpenseClaims30Days.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Employee · 30d
1.13-09	Duplicate payment count	Same invoice paid more than once.	Abstraction Rule SameInvoiceCount90Days (Search Key AccountId, Search Interval 90 Days, Function Same Count on InvoiceId, a placeholder field) has a rule fragment on payment events; a count above one is the duplicate test.	Matched = Abstraction.SameInvoiceCount90Days.MatchGreater(1)	Tag: Velocity · Fraud · Account · 90d
1.13-10	Manual journal entries at period end	Spike of adjustments near close.	TTL counter ManualJournalsMonth (Data Name EntityId, a placeholder key, Interval Months / 1, Count) is incremented by an earlier-Priority activation on manual journals where Payload.PostedAt (placeholder) MatchIsEndOfMonth; calendar month end approximates period end, and a fiscal close calendar would be reference data. The reading threshold of 20 is illustrative.	Matched = TTLCounter.ManualJournalsMonth.MatchGreaterOrEqual(20)	Tag: Velocity · Fraud · Entity · period end

1.14 Remittance and money-service-business velocity

#	Example	Description	Jube construction	Fragment	Notes
1.14-01	Sends per sender per week	Frequent remittances.	TTL counter RemitSends7Days (Data Name SenderId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“RemittanceSend”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.RemitSends7Days.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Sender · 7d
1.14-02	Receives per beneficiary per week	One recipient receiving frequently.	TTL counter RemitReceives7Days (Data Name BeneficiaryId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“RemittanceReceive”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.RemitReceives7Days.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Beneficiary · 7d
1.14-03	Sends to a corridor from one agent	Agent concentration in one corridor.	TTL counter AgentCorridorSends7Days (Data Name AgentCorridorKey, a placeholder composite field carrying Agent and Corridor as one value, Interval Days / 7, Count) is incremented by an earlier-Priority activation on sends; a concentration share also needs a counter keyed on AgentId alone. The reading threshold of 20 is illustrative.	Matched = TTLCounter.AgentCorridorSends7Days.MatchGreaterOrEqual(20)	Tag: Velocity · AML · Agent · 7d
1.14-04	Cash pick-ups per receiver across locations	Receiver collects at many locations.	Abstraction Rule DistinctPickupLocations7Days (Search Key ReceiverId, a placeholder key, Search Interval 7 Days, Function Distinct Count on LocationId, a placeholder field) has a rule fragment matching Payload.TxnType.MatchEqual(“CashPickup”); the reading threshold of 3 is illustrative.	Matched = Abstraction.DistinctPickupLocations7Days.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Receiver · 7d
1.14-05	Prepaid card issuance per agent	Agent issues many cards.	TTL counter PrepaidCardsIssued7Days (Data Name AgentId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“PrepaidCardIssued”); the reading threshold of 20 is illustrative.	Matched = TTLCounter.PrepaidCardsIssued7Days.MatchGreaterOrEqual(20)	Tag: Velocity · AML · Agent · 7d
1.14-06	Cheque cashing count per person	Frequent third-party cheque cashing.	TTL counter ThirdPartyCheques30Days (Data Name PersonId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation on cheque cashing where Payload.ThirdPartyCheque (placeholder Boolean field) MatchIsTrue; the reading threshold of 3 is illustrative.	Matched = TTLCounter.ThirdPartyCheques30Days.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Person · 30d
1.14-07	Money order purchases count	Many money orders bought.	TTL counter MoneyOrders7Days (Data Name PersonId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“MoneyOrderPurchase”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.MoneyOrders7Days.MatchGreaterOrEqual(3)	Tag: Velocity · AML · Person · 7d
1.14-08	Currency exchange count per customer	Frequent FX at bureaux.	TTL counter CurrencyExchanges7Days (Data Name CustomerId, a placeholder key, Interval Days / 7, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“CurrencyExchange”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.CurrencyExchanges7Days.MatchGreaterOrEqual(5)	Tag: Velocity · AML · Customer · 7d
1.14-09	Agent-level after-hours transactions	Transactions outside agent opening hours.	This fragment is the incrementing activation: it matches transactions outside the agent’s hours, ticking TTL counter AfterHoursAgent24Hours (Data Name AgentId, a placeholder key, Interval Days / 1, Count), which a second activation reads at an illustrative 5. The zone and hours are fixed here only for illustration, because opening hours are per-agent reference data and belong in a Dictionary.	Matched = Payload.TransactionDate.MatchOutsideBusinessHoursInZone("Europe/London", 9, 17)	Tag: Velocity · Both · Agent · 24h

1.15 E-commerce and marketplace velocity

#	Example	Description	Jube construction	Fragment	Notes
1.15-01	Orders per account per day	Many orders in a day.	TTL counter OrdersAccount24h (Data Name AccountId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“Order”); the reading threshold of 10 is illustrative.	Matched = TTLCounter.OrdersAccount24h.MatchGreaterOrEqual(10)	Tag: Velocity · Fraud · Account · 24h
1.15-02	Orders per shipping address	Many orders delivered to one address.	TTL counter OrdersShippingAddress7Days (Data Name ShippingAddressKey, a placeholder field, Interval Days / 7, Count) is incremented on each order; the address must be normalised upstream, since TTL keys are raw payload fields. The reading threshold of 5 is illustrative.	Matched = TTLCounter.OrdersShippingAddress7Days.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Address · 7d
1.15-03	Orders per payment instrument	Many orders on one card/wallet.	TTL counter OrdersInstrument24h (Data Name CardId, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“Order”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.OrdersInstrument24h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Card · 24h
1.15-04	Account creation velocity per IP	Fake-account creation.	TTL counter AccountsCreatedIp1h (Data Name IP, Interval Hours / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“AccountCreated”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.AccountsCreatedIp1h.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · IP · 1h
1.15-05	Promo-code redemptions per device	Promo abuse.	TTL counter PromoRedemptions30Days (Data Name DeviceId, a placeholder key, Interval Days / 30, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“PromoRedemption”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.PromoRedemptions30Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Device · 30d
1.15-06	Return requests per account	Return abuse.	TTL counter ReturnRequests90Days (Data Name AccountId, Interval Days / 90, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“ReturnRequest”); the reading threshold of 5 is illustrative.	Matched = TTLCounter.ReturnRequests90Days.MatchGreaterOrEqual(5)	Tag: Velocity · Fraud · Account · 90d
1.15-07	Item-not-received claims per account	INR claim frequency.	TTL counter ItemNotReceivedClaims90Days (Data Name AccountId, Interval Days / 90, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“ItemNotReceivedClaim”); the reading threshold of 3 is illustrative.	Matched = TTLCounter.ItemNotReceivedClaims90Days.MatchGreaterOrEqual(3)	Tag: Velocity · Fraud · Account · 90d
1.15-08	Seller payout velocity	Seller withdrawing proceeds rapidly after sales.	Two TTL counters, SellerPayouts24h and SellerSales24h (Data Name SellerId, a placeholder key, Interval Days / 1, Sum on CurrencyAmount), are ticked by payout and sale activations. The reading activation takes the payout sum as a ratio of the sales sum and tests it at an illustrative 0.8; an undefined ratio with no sales fails closed.	Matched = TTLCounter.SellerPayouts24h.RatioOf(TTLCounter.SellerSales24h).MatchGreaterOrEqual(0.8)	Tag: Velocity · Both · Seller · 24h
1.15-09	Seller listing velocity	Burst of new listings (fake seller).	TTL counter SellerListings24h (Data Name SellerId, a placeholder key, Interval Days / 1, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“ListingCreated”); the reading threshold of 20 is illustrative.	Matched = TTLCounter.SellerListings24h.MatchGreaterOrEqual(20)	Tag: Velocity · Fraud · Seller · 24h
1.15-10	Cart abandonment with repeated payment attempts	Repeated checkout attempts with different cards.	Abstraction Rule DistinctCardsPerSession30Minutes (Search Key SessionId, a placeholder key, Search Interval 30 Minutes, Function Distinct Count on CardId) has a rule fragment on payment attempts; TTL counter PaymentAttempts30Minutes (Data Name SessionId, Interval Minutes / 30, Count) counts the attempts. The reading activation requires an illustrative 3 attempts and at least an illustrative 2 distinct cards.	Matched = TTLCounter.PaymentAttempts30Minutes.RequireGreaterOrEqual(3).Against(Abstraction.DistinctCardsPerSession30Minutes).MatchGreaterOrEqual(2)	Tag: Velocity · Fraud · Session · 30m
1.15-11	Gift-card balance checks	Many balance checks (gift card enumeration).	TTL counter GiftCardBalanceChecks15Minutes (Data Name IP, Interval Minutes / 15, Count) is incremented by an earlier-Priority activation on Payload.TxnType.MatchEqual(“GiftCardBalanceCheck”); the reading threshold of 20 is illustrative.	Matched = TTLCounter.GiftCardBalanceChecks15Minutes.MatchGreaterOrEqual(20)	Tag: Velocity · Fraud · IP · 15m
1.15-12	Loyalty-point redemptions velocity	Points cashed out rapidly (loyalty fraud).	TTL counter LoyaltyPointsRedeemed24h (Data Name AccountId, Interval Days / 1, Sum on PointsRedeemed, a placeholder Data Value field) is ticked by an earlier-Priority activation on loyalty redemptions; the reading threshold of 10000 points is illustrative.	Matched = TTLCounter.LoyaltyPointsRedeemed24h.MatchGreaterOrEqual(10000)	Tag: Velocity · Fraud · Account · 24h
1.15-13	Ride/delivery account trips velocity	Implausible number of trips/deliveries (collusion).	TTL counter TripsDriver24h (Data Name DriverId, a placeholder key, Interval Days / 1, Count) and Abstraction Rule DistinctPassengers24h (Search Key DriverId, Search Interval 24 Hours, Function Distinct Count on PassengerId, a placeholder field) are read together: many trips with few distinct passengers is the collusion pattern. The thresholds of 20 trips and 3 passengers are illustrative, and the direction of the passenger bound is a judgement.	Matched = TTLCounter.TripsDriver24h.RequireGreaterOrEqual(20).Against(Abstraction.DistinctPassengers24h).MatchLessOrEqual(3)	Tag: Velocity · Fraud · Driver · 24h