In certain situations, you may need to compare a transaction or its parameter against several other transactions to find an anomaly in the applicant behavior that may be a sign of illicit activity.

For example, you may need to monitor transactions for signs of money laundering and unusual patterns, such as a sudden increase in transaction volume or value over a short period of time.

The aggregate function lets you do just that by summing up all the information about several transactions based on the specific criteria.

How aggregate function works

The aggregateis an expression attribute that may be used to create complex rule conditions based on the received data.

You can add aggregate to your condition chain and build a condition that sums up the transactions based on such parameters as type, time period, amount, and so on.

Create rules with expressions containing aggregate

Let’s build a simple rule that will put the transaction on hold if the sum of all outgoing transactions within 24 rolling hours from the first transaction in a day exceeds $10K (the default limit for many jurisdictions):

1. Create a new rule as described in this article and set the rule action to Put on hold. You can also add tags if needed to provide your compliance officers with additional information.
2. Create a condition checking if the transaction is outgoing (if you do not limit your rule to outbound transactions, it will be triggered by deposits as well):
   If
   ->
   Field
   ->
   data.info.direction
   ->
   equals
   ->
   Value
   ->
   OUT

3. Add an AND block to continue the condition chain and create a condition that calculates the sum of outgoing transactions in the rolling 24 hours from the first transaction in a day to compare it against the 10K threshold:
   If
   ->
   Field
   ->
   aggregate.txns.out.days1.amounts.sum
   ->
   greater than or equals
   ->
   Value
   ->
   10 000

The condition settings are explained in the table below:

Now, if your applicant makes 3 withdrawals in one day ($10K, $15K, $6K), the third transaction will trigger the rule and will be automatically put on hold.