Real-Time Transaction Monitoring Rules

Full transcript of Real-Time Transaction Monitoring: Fraud Rules for Fiat and Crypto - Didit Academy video 7 of 10, 13:05. Watch on YouTube. Each paragraph links to the exact moment in the video.

​

What this video covers

00:04 In this video, you’ll see how Didit watches the money moving through your app and catches the transactions that should worry you. Checking who someone is when they sign up is one thing, but it doesn’t tell you what they’ll do once they start moving money around. That’s the job of transaction monitoring. It scores every payment the moment it lands, ties it back to the person who made it, and flags the things that actually matter. So, a sudden spike in activity, a payment that’s far too big, or a match against a sanction list. It works for regular money and for crypto, all against rules that you set yourself. 00:40 So, let’s open it up and walk through it. All right, so we can head over to the

​

The live transaction feed

00:45 transactions tab here on the left. And this is a live feed of every payment Didit is watching. So, it’s ranked by date, so the newest first, and each row is one economic event. So, we’re talking a deposit, a withdrawal, a transfer, a payment, a payout, or a bet. And every one of them gets scored and decisioned in real time as it arrives. So, the place that you’ll probably want

​

The review queue and filters

01:12 to head to first is this tab here, 100 transactions to be reviewed. We’ll click on that, and it’s going to automatically filter out the transactions that need to be reviewed by your team. And if you want to see everything, we can add the filter all statuses. We can refine this if we want, if we want to select a specific day in the last 7 days, for example. If you want to search for a specific transaction ID or a Didit ID. If we want to look in specific currencies, etc. 01:42 But for today, we’re just going to flip the status to in review, and these are the ones we’re going to walk through because these are going to be most important for you and for your own use cases. So, we

​

Every transaction tied to an identity

01:52 can see this transaction here is connected to a specific identity because nobody in your platform is going to be able to complete transactions without going through the KYC or KYB. We can see the type. This is crypto in this scenario. The amount, any tags that are involved, and the date that it was created. Now, one thing to note here is that we actually have the counterparty

​

Counterparty screening

02:15 here. They also get screened against sanctions and watch lists. The same AML engine that your identity checks already use. You can see we’ve got the score here. I’m going to jump into the transaction. I’m going to show you exactly what’s going on here. So, if we click on one of these, again, I will preface this by saying this is this is demo data. This is not a real transaction, but to show you how this works, I want to walk you through each of these tabs. So, if we scroll down, each of these tabs corresponds to a tab up top here. Just like in the KYC and KYB, we can change the status here, download as a PDF, we can add to a block

​

The overview tab and risk score

02:49 list. So, let’s take a look, right? So, in the overview section, we’ve got the risk score. So, this is medium. Uh it’s been flagged as in review. We can see all of the warnings here. So, in the crypto monitoring, cuz this is a crypto

​

Wallet risk and what the score bands mean

03:01 transaction, we see there’s a high wallet risk score. And we can read what this actually means. So, if the risk score sits between 70 and 89, it’s going to escalate it for review. So, wallets at this score have a meaningful exposure to illicit clusters, like mixers, darknet markets, and scams. So, these are all the things that we want to be looking out for when we’re reviewing this particular transaction. We could see it’s been flagged for a large single

​

Vendor data

03:28 transaction. Now, just like with the KYC and KYB, we’ve got the vendor data here. So, all of these transactions for this particular vendor data, so in this case we’re using an email, and it can be a unique identifier. So, this person will have gone through KYC. And all of the transactions that correspond to this vendor data will be

​

How the risk score is calculated

03:52 flagged underneath this particular user. So, you might be thinking, well, where does this score come from? You could see the risk score is 284, there’s three rules matched, eight rules evaluated, and one open alert. Like, what’s going on here? Well, every transaction is decisioned the moment it arrives, and each rule that matches adds to a cumulative risk score. And so, your thresholds decide when that

​

The four transaction statuses

04:17 score is high enough to send it to review or to decline it outright. So, in transactions, there are actually four statuses. We’ve got approved, meaning the transaction is clean, in review, like this particular example here, we’ve got declined, and then we also have awaiting user. So, when a rule needs a bit more assurance before it lets a payment through, the status flips to awaiting user. So, Didit quietly spins up a linked verification session, hands back a URL, and the user re-verifies themselves, and the transaction picks up where it left off.

​

Getting transactions into Didit

04:51 So, before we start digging through all of this information here, how do we actually get transactions into Didit? Well, we can import them from a CSV or a list. We can integrate, which is going to be the obvious option for for most of you watching this. You integrate with the SDK. And we can also create a manual transaction, and this really is only going to be for testing purposes. 05:15 It’s going to be a massive hassle to create a manual transaction every time a transaction runs through your company. So, if you click integrate, you can see we can just literally copy the prompt, select an API key, and then we can paste that into our cloud code or code X, and it will automatically set up the installation, so that your transaction monitoring is completely set up. Okay, so let’s work through some of these checks and tabs here, and let me explain what each of them mean. Now, there is a lot of information in in but the reason why this account was flagged is because of the rules, and we’ll get into the rules

​

Transaction details

05:49 section uh a little bit later on. But, we can see here this this is all of the transaction details that we’ve got here, crypto outbound, uh the country from Argentina to Netherlands, the transaction ID, the payment ID, payment details, and the vendor data, and the the currency amount. We’ve got the AML risk score. This just means the score that we get from the anti-money laundering module. 06:13 We can look at all of the specifics of the transaction, the chain, the wallet risk, in this case potential scam wallet risk, the beneficiary wallet, and the wallet score risk. We’ve got some alerts here, the simulated crypto exposure. This is demo crypto transaction flagged by synthetic monitoring metadata, and

​

The crypto exposure visualization

06:30 medium. We’ve got the crypto monitoring. This is really cool. Let’s click visualization, and you’re going to be able to see the visualization of the wallets, how they’re connected, the transactions. So, this can be really useful if you’re trying to spot scams, and mixers, things like this. So, we’ve got the whole transaction overview here. You can see we’ve got an analysis here from Merkle Science. This is a third-party tool that you can integrate here into Didit for crypto screening and transaction analysis. If we keep going down here, this is all part of the crypto

​

Counterparties

07:03 monitoring from Merkle Science, transaction summary, exposure table, and then we get to the counterparties. So, this is the person who is receiving the the funds in this particular transaction. We can see this person is not verified inside of the current system, so it’s going to check if this particular wallet is already inside your platform, and then this is the important part down here at the bottom. These are

​

Triggered rules

07:27 the triggered rules. So, we’re going to look at these rules in a moment and see how we can set these up for our transaction monitoring, but if you click on each one of these, you could see what each rule is all about. So, we’ve got the rule identity, the trigger, the conditions, the actions, deploy settings. I’m going to run you through these in just a moment. You see there’s related transactions down here. 07:48 Yeah, it’s a lot of information, but the the thing to focus on is the rules. So, let’s go ahead and create some rules,

​

Creating a rule

07:55 shall we? Now, there is a library of rules. These are defaults that you can set up when you start a brand new account. We’ve got the installed rules that you can set up manually. We can create the rules here, so rules are essentially filters. So, if this happens, then do this. That’s essentially what a rule is doing. So, we can give it a name. We’ll call it test. We can add a description if we want. We can add a specific category.

​

Triggers

08:18 So, let’s say we select geography and we move over to the trigger. Triggers on all transactions. We could specify by the channel, so crypto or fiat. Let’s do crypto.

​

Conditions

08:29 The entity type, we can specify by individual or company. I’m going to do individual. We go through to the conditions. We can look for, I don’t know, travel rule. Uh we can look for subjects. We can look for the country equals maybe if we put a high-risk country on there, somewhere in Africa, for example. We can add an additional condition here as well. So, if someone’s putting multiple transactions through in a short space of time from this country, then that’s what this rule is going to flag. And then we

​

Actions and scoring

09:01 can decide whether that’s going to decline the transaction or put them into review. So, you can see here, choose what happens on a match. We change the status, right? We could add points. Okay, so that’s what I was mentioning earlier. That’s how the score is calculated. So, we can say add maybe 50 points in here, for example. And then

​

Back-testing and deploy settings

09:24 we’ve got the deploy settings. We can back test the rule to see how many hits this rule is going to get. Now, this is important because if you have a very restrictive rule, that’s going to mean a lot more work for your team. So, you’ve got to evaluate the the risk versus reward of setting up these kinds of rules and how strict you want to be with this. Now, you can see on here, each rule shows you how often it fired and how much of that was sent to review or declined. For example, you got this percentage just here, and this is the data that you’re going to lean on to tune the rule. So, if setting up your own rules seems like a lot of work, you could just actually have a conversation with Claude and say, “We want to filter out these kinds of people or these kinds of transactions.

​

The rule library

10:07 We want to detect this kind of behavior from these countries.” You can also look in the library and we’ve got different categories here. We’ve got AML, nominee detection, crypto monitoring, device intelligence, finance for protection, responsible gaming, travel rules, and so there’s a library of different rules that you can pull from inside of there. So, there’s one condition in this rule

​

Velocity conditions

10:33 that I was working on earlier is the velocity condition. And this is pretty clever. So, instead of judging one payment in isolation, a rule can add up or average activity over a specific window of time. So, anywhere from an hour to 90 days, grouped by the user, the device, the IP, the payment method, or the counterparty. So, that’s how you’re going to catch structuring and sudden bursts that no single transaction would ever reveal. 10:59 So, we could hit velocity condition. So, we can do the count of transactions in the last 24 hours for the same user, and we can specify is greater than, let’s say, five, for example. So, that’s the velocity condition. I think that’s pretty clever. I’ve not seen this in any other platform. The idea being that AI can surface hidden patterns from your own history. Now, you could do this with Claude right now. You could hook up the MCP, ask Claude to analyze your data, and create rules

​

Turning on crypto monitoring

11:26 based on the patterns that it’s seeing. So, if you were wondering where to turn on crypto compliance and the crypto monitoring integration. You can see here in the transactions tab, we can go to settings. We can adjust the risk threshold and then we can select the crypto monitoring Merkle Science. We can turn that on 15 cents per check. You can bring your own key, that’s going to be happening sometime soon in the future. So, we can flip that on or off to your own needs. 11:54 So, one final thing on the dashboard,

​

Transaction analytics

11:56 again, we can adjust our analytics here to include transaction monitoring as well. So, if you click on add, we can come through to transactions. We can take a look at the volume, for example, the action breakdown, approved versus rejected, and then we can add that to our analytics dashboard. And you can see that’s going to appear down at the bottom here. And to move these tabs around, we just click edit, and we can let say we remove this one, and yeah, we can move these around like this. We can change whatever order we want them in.

​

Recap

12:34 So, that’s transaction monitoring end-to-end. Every payment scored the moment it lands. So, regular money and crypto, all through one engine, each one tied back to a verified person or business. And anything suspicious flagged for your team to review and act on. If you want to try it for yourself, you can head over to didit.me, sign up for free, and send your first transaction today.