Expression attributes help you build [custom rules](doc:create-custom-rules) based on the received applicant data. For example, you can create a rule that compares the applicant country extracted from the ID document with the country provided by the applicant or the country of the specified payment method, and so on. ### Note Mind the difference between the following expression attributes: - `data.applicant` is an object within a specific transaction, provided by the client during transaction submission. - `applicant` is an object that contains information from the existing applicant profile and their KYC data. For example, `data.applicant.address.country` represents the applicant’s country for the current transaction, while `applicant.info.address.country` refers to the country defined during the KYC process. # Root variables | Field | Type | | | :------------------------ | :------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `txn` | [Object](#txn) | Derived data of the current transaction for which the entire related context is created. This data includes the previous score of the transaction, review result, tags assigned, and so on. | | `data` | [Object](#data) | Transaction-related data submitted to Sumsub by the user. This data includes such details as transaction identifier, date and time when the transaction was initiated on the user side, financial information, transaction participants, and so on. | | `applicant` | [Object](#applicant) | Applicant data of the current transaction participant registered in the Sumsub system as an [applicant](doc:applicants). This data is taken from the existing applicant profile and not related to a specific transaction. | | `counterparty` | [Object](#counterparty) | The other party that participates in the financial transaction. | | `poi` | [Object](#poi) | Applicant's proof of identity. | | `poa` | [Object](#poa) | Applicant's proof of address. | | `remitter` | Object |

data.applicant — for outgoing transactions.
counterparty — for incoming transactions.

| | `beneficiary` | Object |

counterparty — for outgoing transactions.
data.applicant — for incoming transactions.

| | `questionnaires` | Map of Objects | Questionnaire item values are nested by questionnaire, section, and item id. For example, `questionnaire.myQuestionnaireId.mySectionId.myItemId`. | | `service` | [Object](#service) | Context from various services used to enrich transaction information (replaces the deprecated `preScoringContext` field).

⚠️ Use `service` for new rules; `preScoringContext` remains a fully working alias resolving to the same enriched-context object, so existing rules referencing `preScoringContext.*` keep working unchanged — no edits required. | | `applicantAction` | [Object](#applicantaction) | Allows to build logic upon applicant action check results. | | `currentScore` | Integer | Current score calculated in the rule matching process. | | `currentMatchedRuleNames` | List of Strings | List of rule names matched during the current rule-matching process. | | `currentRule` | [Object](#currentrule) | Current rule to be processed and calculated. | | `currentFailedRules` | List of Strings | List of rules failed during the current rule-matching process. | | `clientLists` | Map of Strings | [Client lists](doc:client-lists) based on key values. | | `txnFraudInfo` | [Object](#txnfraudinfo) | Contains information pertaining to Fraud Prevention. | | `checks` | [Object](#checks) | Background check results for the current transaction's applicant, taken from their most recent Business verification `COMPANY`) check. | # txn The `txn` object includes the derived data of the current transaction for which the entire related context is created. This data includes the previous score of the transaction, review result, tags assigned, and so on. | Field | Type | Description | | ---------------- | ---------------------------- | ------------------------------------------------------------------------ | | `externalUserId` | String | Unique user identifier on your side. | | `clientId` | String | Your identifier as our client in the Sumsub system. | | `review` | [Object](#review) | Transaction review. | | `createdAt` | Date | Date and time (UTC) when a transaction was created in the Sumsub system. | | `scoringResult` | [Object](#txnscoringresult) | Overall scoring result. | | `tags` | List of Strings | [Transaction tags](doc:use-transaction-tags). | | `travelRuleInfo` | [Object](#txntravelruleinfo) | Data used for information exchange under the Travel Rule. | # data The `data` object is a transaction-related data submitted to Sumsub by the user. This data includes such details as transaction identifier, date and time when the transaction was initiated on the user side, financial information, transaction participants, and so on. | Field | Type | Description | | ----------------------- | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `txnId` | String | Unique transaction identifier in your system (alphanum). | | `txnDate` | Date | Date and time (UTC) when a transaction was initiated on your side (format yyyy-MM-dd HH:mm:ss+XXXX , e.g. 2022-10-25 22:30:02+0000 ). | | `txnLocalDate` | LocalDateTime | Calculated value of the transaction creation date and time on your side if the transaction timezone is provided (if not provided, UTC is used by default). | | `applicant` | [Object](#dataapplicant) | Includes the data of the financial transaction participant registered in the Sumsub system as an applicant. This data is submitted to Sumsub within the transaction and may differ from the relevant applicant profile. | | `info` | [Object](#datainfo) | Transaction-related financial information. | | `props` | Map of Strings | Map of custom properties that are not supported by the API data model (for example, `dailyOutLimit`) and could be reused in rule conditions, for example, to compare the transaction amount (`data.info.amount`) to the `data.props.dailyOutLimit`. | | `sourceKey` | String | [Source key](doc:source-keys) assigned to the transaction. | | `userPlatformEventInfo` | [Object](#datauserplatformeventinfo) | Indicates the applicant platform event status. | | `iGamingSessionInfo` | [Object](#dataigamingsessioninfo) | iGaming session data associated with the transaction. | # data.applicant The `data.applicant` object includes the data of the financial transaction participant registered in the Sumsub system as an applicant. This data is submitted to Sumsub within the transaction and may differ from the relevant applicant profile. | Field | Type | Description | | :--------------------------- | :-------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `externalUserId` | String | Unique user identifier on your side. | | `firstName` | String | Participant first name. | | `lastName` | String | Participant last name. | | `fullName` | String | Full name. | | `nameType` | Enum | Name type: `aliasName`, `birthName`, `maidenName`, `legalName`, `shortName`, `tradingName`, `other`. | | `dob` | Date | Date of birth. | | `placeOfBirth` | String | Place of birth. | | `email` | String | Email address. | | `phone` | String | Phone number. | | `address` | [Object](#address) | Actual address (if provided). | | `type` | [Enum](#type) | Entity type: `individual` or `company`. | | `paymentMethod` | [Object](#paymentmethod) | Payment method used by an applicant. | | `paymentMethodExtractedInfo` | [Object](#paymentmethodextractedinfo) | Payment method information extracted from available data. | | `device` | [Object](#device) | Information regarding the device involved in executing the transaction. | | `institutionInfo` | [Object](#institutioninfo-institutionextractedinfo) | Information about the financial institution that facilitated the transaction. | | `institutionExtractedInfo` | [Object](#institutioninfo-institutionextractedinfo) | Information about the financial institution, extracted from available data. Represents the BIC country. | | `residenceCountry` | String | Country of residence (ISO 3166-1 alpha-3). | | `companyType` | String | Type of legal entity. For example, private company limited by shares, public limited company, state-owned enterprise, and so on. Applicable to the company type. | | `registrationNumber` | String | Primary identification number assigned to a legal entity during the registration process. Applicable to the company type. | | `licenseNumber` | String | Number of a license assigned for a time-bound term for a specific activity type, like banking or gambling. Applicable to the company type. | | `leiCode` | String | Refers to a Legal Entity Identifier (LEI) code—public identifier from the financial entities registry. Applicable to the company type. | | `idDoc` | [Object](#iddoc) | Information from the participant documents. | | `ceo` | [Object](#ceo) | Data related to the company's Chief Executive Officer. | # counterparty The `counterparty` object includes the data related to the other party that participates in the financial transaction. This data is submitted to Sumsub within the transaction. | Field | Type | Description | | :--------------------------- | :-------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `externalUserId` | String | Unique user identifier on your side. | | `firstName` | String | Participant first name. | | `lastName` | String | Participant last name. | | `fullName` | String | Full name. | | `nameType` | Enum | Name type: `aliasName`, `birthName`, `maidenName`, `legalName`, `shortName`, `tradingName`, `other`. | | `dob` | Date | Date of birth. | | `placeOfBirth` | String | Place of birth. | | `email` | String | Email address. | | `phone` | String | Phone number. | | `address` | [Object](#address) | Actual address (if provided). | | `type` | [Enum](#type) | Entity type: `individual` or `company`. | | `paymentMethod` | [Object](#paymentmethod) | Payment method used by an applicant. | | `paymentMethodExtractedInfo` | [Object](#paymentmethodextractedinfo) | Payment method information extracted from available data. | | `device` | [Object](#device) | Information regarding the device involved in executing the transaction. | | `institutionInfo` | [Object](#institutioninfo-institutionextractedinfo) | Information about the financial institution that facilitated the transaction. | | `institutionExtractedInfo` | [Object](#institutioninfo-institutionextractedinfo) | Information about the financial institution, extracted from available data. Represents the BIC country. | | `residenceCountry` | String | Country of residence (ISO 3166-1 alpha-3). | | `companyType` | String | Type of legal entity. For example, private company limited by shares, public limited company, state-owned enterprise, and so on. Applicable to the company type. | | `registrationNumber` | String | Primary identification number assigned to a legal entity during the registration process. Applicable to the company type. | | `licenseNumber` | String | Number of a license assigned for a time-bound term for a specific activity type, like banking or gambling. Applicable to the company type. | | `leiCode` | String | Refers to a Legal Entity Identifier (LEI) code—public identifier from the financial entities registry. Applicable to the company type. | | `idDoc` | [Object](#iddoc) | Information from the participant documents. | | `ceo` | [Object](#ceo) | Data related to the company's Chief Executive Officer. | # applicant The `applicant` object includes the applicant data of the current transaction participant registered in the Sumsub system as an [applicant](doc:applicants). This data is taken from the existing applicant profile and not related to a specific transaction. | Field | Type | Description | | ------------------ | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `id` | String | Unique applicant identifier. | | `externalUserId` | String | Unique user identifier on your side. | | `createdAt` | [Date](#date) | This field helps to build rules based on the applicant profiles' creation date. For example, to find the applicants with profiles created in past 90 days, and whose declared incoming or outgoing turnover has been exceeded. | | `fullName` | String | Full name. | | `country` | String | Applicant country (ISO 3166-1 alpha-3).

Individual applicants only. For companies, use `applicant.info.companyInfo.country` and `applicant.fixedInfo.companyInfo.country` fields that are described in [this section](ref:expression-attributes#applicantinfocompanyinfo-applicantfixedinfocompanyinfo). | | `countryOfBirth` | String | Applicant country of birth (ISO 3166-1 alpha-3). | | `info` | [Object](#applicantinfo-applicantfixedinfo) | Information extracted from the applicant documents. | | `fixedInfo` | [Object](#applicantinfo-applicantfixedinfo) | Basic information on an applicant provided to the Sumsub SDK/API. | | `review` | [Object](#review) | Applicant review. | | `sourceKey` | String | [Source key](doc:source-keys) assigned to an applicant. | | `derivatives` | [Object](ref:expression-attributes#applicantderivatives) | Various information derived from an applicant. | | `metadata` | Map of Strings | Applicant's metadata. | | `riskLabels` | [Object](#applicantrisklabels) | Applicant risk labels. | | `tags` | List of Strings | [Applicant tags](doc:add-applicant-tags). | | `assessment` | [Object](#applicantassessment) | Applicant assessment. | | `email` | String | Applicant's email. | | `phone` | [Object](#applicantphone-infophone-fixedinfophone) | Includes the details of the applicant's phone number. | | `emailDomain` | String | Applicant email's domain name. | | `type` | Enum | Applicant entity type: `individual` or `company`. | | `allMemberRoles` | List of Strings | Roles of the applicant (`shareholder`, `representative`, `director`, `ubo`). | | `registrationDate` | [Date](#date) | Date and time when the applicant was initially registered in your system. | | `lang` | String | Applicant language. | # applicantAction Data that allows to build logic upon applicant action check results. | Field | Type | Description | | :--------------- | :---------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ind` | Integer | Index of the added payment source action (excluding duplicates), e.g., the first added payment method has index 1, the second — 2 , etc.
The field has a value for `paymentMethodSummary` section only. | | `questionnaires` | Map of objects | Questionnaire item values are nested by questionnaire, section, and item id. For example, `questionnaire.myQuestionnaireId.mySectionId.myItemId`. | | `review` | [Object](#review) | Action review results. | # poi Data related to the applicant's proof of identity. | Field | Type | Description | | ------------------------ | ------------------------------------ | ------------------------------------------------------------------------------ | | `country` | String | ID document country (ISO 3166-1 alpha-3). | | `idDocType` | Object | ID document type (e.g., ID card, Passport, Driver's license, etc.). | | `number` | String | ID document number. | | `additionalNumber` | String | ID document additional number. | | `serialNumber` | String | ID document serial number. | | `dob` | [Date](#date) | Date of birth of the document owner. | | `gender` | String | Gender. | | `nationality` | String | Nationality of the document owner (ISO 3166-1 alpha-3). | | `placeOfBirth` | String | Place of birth of the document owner. | | `issuedDate` | [Date](#date) | Date when the document was issued. | | `issueAuthority` | String | Authority that issued the ID document. | | `issueAuthorityCode` | String | Unique code of the authority that issued the ID document. | | `validUntil` | [Date](#date) | Validity date of the ID document. | | `validityPeriod` | [Object](#poivalidityperiod) | Validity period of the ID document. | | `firstIssuedDate` | [Date](#date) | Date when the document was first issued. | | `dlCategoryBIssuedDate` | [Date](#date) | Issue date of driver's license category B. | | `dlCategoryAmIssuedDate` | [Date](#date) | Issue date of driver's license category AM. | | `entitlementDate` | [Date](#date) | Entitlement date of a driver's license document. | | `metadata` | Map of strings | Metadata related to a Proof of Identity. | | `address` | [Object](#address) | Address specified in the ID document. | | `category` | String | ID document category (for example, category of a driver's license). | | `nfc` | [Object](#poinfc) | Data retrieved from the NFC chip embedded in the identity document. | | `fullMrz` | String | Machine-readable zone (MRZ) lines, separated by the End of Line (`\n`) symbol. | | `crossCheckFullNameData` | [Object](#poicrosscheckfullnamedata) | Full-name data from the ID document used for cross-validation. | # poa Data related to the applicant's proof of address. | Field | Type | Description | | ------------------- | ------------------------------------------- | ----------------------------------------------------------------------- | | `country` | String | PoA (Proof of Address) document country (ISO 3166-1 alpha-3). | | `idDocType` | Object | PoA document type (e.g., Passport, Residence permit, etc.). | | `number` | String | PoA document number. | | `metadata` | Map of strings | PoA related metadata. | | `address` | [Object](ref:expression-attributes#address) | Address specified in the PoA document. | | `issuedDate` | [Date](#date) | Date when the PoA document was issued. | | `detectedLanguages` | List of Strings | List of detected languages, presented using 2-letter codes (ISO 639-1). | | `image` | [Object](#poaimage) | Technical details of the document image. | | `gender` | String | Gender. | # service Context from various services used to enrich transaction information (replaces the deprecated `preScoringContext` field). ### Note Use `service` for new rules; `preScoringContext` remains a fully working alias resolving to the same enriched-context object, so existing rules referencing `preScoringContext.*` keep working unchanged — no edits required. | Field | Type | Description | | ------------------------- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cryptoTxnInfo` | [Object](#servicecryptotxninfo) | Cryptotransaction-related information. | | `amlCaseReview` | [Object](#review) | AML case review result. | | `amlDetailsData` | [Object](#serviceamldetailsdata-serviceamlcounterpartybankdata) | AML screening summary for the transaction payment-details check. | | `amlCounterpartyBankData` | [Object](#serviceamldetailsdata-serviceamlcounterpartybankdata) | AML screening summary for the counterparty bank check. | | `paymentDetailsReview` | [Object](#paymentdetailsreview) | Payment details review result. | | `paymentMethodsSummary` | [Object](#paymentmethodssummary) | Payment methods statistics. | | `kytAnomalyStatsScore` | [Object](#servicekytanomalystatsscore) | Anomaly scores derived from daily statistical patterns, calculated by comparing the applicant's current-day activity against a fixed statistical baseline. | # currentRule Current rule to be processed and calculated. The same expression attribute applies to matched and failed rules. | Field | Type | Description | | ------------ | --------------- | ---------------------------------------------------------------------------------------------- | | `name` | String | Current short name of the rule. | | `id` | String | Current ID of the rule. | | `revision` | Integer | Current version of the rule's revision. | | `title` | String | Current full title of the rule. | | `score` | Integer | Score that can be assigned to a transaction by the current rule. | | `dryRun` | Boolean | Value determining whether a rule should be applied in the Test mode. | | `tags` | List of Strings | Tags that can be assigned to a transaction by the current rule if it is applied. | | `sourceKeys` | List of Strings | Rule is only applied if the transaction has one of the listed [source keys](#doc:source-keys). | # txnFraudInfo Contains information pertaining to Fraud Prevention. | Field | Type | Description | | ----------------- | --------------------------------- | -------------------------------------------------------------- | | `categorizations` | Map of `Double`-s | Categories identified by behavioral scoring model. | | `behavioral` | [Object](#txnfraudinfobehavioral) | Contains information pertaining to the user's behavioral data. | | `email` | [Object](#txnfraudinfoemail) | Contains information pertaining to the user's email data. | | `phone` | [Object](#txnfraudinfophone) | Contains information pertaining to the user's phone data. | | `ip` | [Object](#txnfraudinfoip) | Contains information pertaining to the user's IP address data. | | `device` | [Object](#txnfraudinfodevice) | Contains information pertaining to the user's device data. | # checks Background check results for the current transaction's applicant. This data is taken from the applicant's last Business verification `COMPANY`) check and is currently limited to company-registry data. | Field | Type | Description | | :-------- | :----------------------- | :---------------------------------------------------------------------- | | `company` | [Object](#checkscompany) | Company-registry data from the applicant's Business verification check. | # checks.company Company-registry data from the applicant's Business verification (`COMPANY`) check. | Field | Type | Description | | :----- | :--------------------------- | :------------------------------------------------------------------------------------------------------------ | | `info` | [Object](#checkscompanyinfo) | Company details returned by the Business verification check. Can be empty even when a `COMPANY` check exists. | # checks.company.info Company details returned by the applicant's last Business verification (`COMPANY`) check. | Field | Type | Description | | ------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `status` | String | Company status. The rule editor suggests values from the company-status list. | | `type` | String | Company type. | | `legalForm` | String | Legal form of the company (for example, Private limited company, Joint stock company). | | `industryCode` | Object | Industry classification. Includes `codes` (List of Strings) and `descriptions` (List of Strings). | | `employeesNumber` | Integer | Approximate number of employees. Converted from the provider's free-text value (see note below). | | `registeredCapitalAmount` | Number | Registered capital of the company. Converted from the provider's free-text value (see note below). | | `incorporatedOn` | [Date](#date) | Date of company incorporation. Supports standard date variables (see the [date](#date) section). | | `startDate` | [Date](#date) | Date the company started operations. Supports standard date variables (see the [date](#date) section). | | `licenseInfo` | Object | Company license information. Includes `issuedDate` and `validUntil` (Date; both support standard date variables — see the [date](#date) section). | # review Contains information about the review result of an applicant, transaction, action, or other entity. | Field | Type | Description | | -------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `attemptCnt` | Integer | Number of the current check attempt on the same verification level. | | `buttonIds` | Array of strings | List of button IDs that have been used for rejection.
Specific `buttonId` is automatically assigned to each rejection. For more details, see [Resubmission requested](ref:temporary-rejection) and [Rejected](ref:final-rejection) clarification. | | `decision` | [Object](#decision) | Review decision. | | `levelName` | String | Applicant [verification level](doc:verification-levels). | | `rejectLabels` | [List of Objects](#rejectlabels) | List of rejection labels. | | `reviewAnswer` | [Object](#riskscoreanswer) | Review answer. | # paymentDetailsReview Payment details review result. | Field | Type | Description | | :------------------------- | :------ | :--------------------------------------------------------------------------- | | `suspiciousPaymentDetails` | Boolean | Detects if there are risky words used in the transaction. `true` or `false`. | # paymentMethodsSummary Payment methods statistics. | Field | Type | Description | | :-------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------ | | `cnt` | Integer | Payment methods quantity. | | `duplicateAccountIds` | List of Strings | Duplicate `accountId`s used for payment methods by applicants within your same project. Includes the current transaction. | | `accounts` | Map of Objects | All payment methods used by the applicant of the current transaction. | # txn.scoringResult Transaction's overall scoring result. | Field | Type | Description | | --------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------- | | `score` | Integer | Calculated score of the transaction. | | `dryScore` | Integer | Calculated Test score of the transaction which would be assigned by the rules applied in the Test mode. | | `matchedRules` | [List of Objects](#currentrule) | All rules that matched during the scoring session. | | `failedRules` | [List of Objects](#currentrule) | All rules that failed during the scoring session. | | `ruleCnt` | Integer | Total number of the rules counted for a transaction. | | `dryRunRuleCnt` | Integer | Total number of the rules in the Test mode counted for a transaction. | # txn.travelRuleInfo Data used for information exchange under the Travel Rule.

Field	Type	Description
`protocolName`	[Enum](#txntravelruleinfoprotocolname)	Name of the protocol used during the information exchange.
`applicant`	[Object](#txntravelruleinfotravelruleparticipant)	Applicant data used during the information exchange.
`counterparty`	[Object](#txntravelruleinfotravelruleparticipant)	Counterparty information used during the information exchange.
`originator`	[Object](#txntravelruleinfotravelruleparticipant)	Transaction originator data used during the information exchange process: - `applicant` — for outgoing transactions. - `counterparty` — for incoming transactions.
`beneficiary`	[Object](#txntravelruleinfotravelruleparticipant)	Transaction beneficiary data used during the information exchange process: - `counterparty` — for outgoing transactions. - `applicant` — for incoming transactions.
`status`	[Enum](#txntravelruleinfostatus)	Current state of the information exchange.
`expiredAt`	Date	If the timer is set, the transaction will be re-scored after a certain period of time.
`applicantVaspId`	ObjectId	Stores information about the applicant VASP institution.
`counterpartyVaspId`	ObjectId	Stores information about the counterparty VASP institution.
`initiatedByCounterparty`	Boolean	Whether the counterparty initiated the Travel Rule information exchange. Available in aggregate expressions.

# txn.travelRuleInfo.(travelRuleParticipant) The following table contains information about the Travel Rule transaction participant (`applicant`, `counterparty`, `originator`, `beneficiary`). | Field | Type | Description | | -------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | `externalUserId` | String | Unique ID of the participant on your side. | | `fullName` | String | Participant full name. | | `firstName` | String | Participant first name. | | `lastName` | String | Participant last name. | | `nameType` | Enum | Name type: `aliasName`, `birthName`, `maidenName`, `legalName`, `shortName`, `tradingName`, `other`. | | `dob` | Date | Participant date of birthday. | | `placeOfBirth` | String | Participant place of birth. | | `email` | String | Participant email address. | | `phone` | String | Participant phone number. | | `address` | [Object](#address) | Participant actual address if provided. | | `type` | Enum | Participant type: `individual` or `company`. | | `idDoc` | [Object](#iddoc) | Information from the documents. | | `residenceCountry` | String | Country of residence. Presented as an alpha-3 code (for example, `DEU`, `GBR`, `ARG`. | | `leiCode` | String | Legal Entity Identifier (LEI) code. Refers to the public identifier from the financial entities registry. | | `licenseNumber` | String | Number of a license assigned for a time-bound term for a specific activity type, like banking or gambling. Applicable to the `company` type. | | `companyType` | String | Type of legal entity. For example, private company limited by shares, public limited company, state-owned enterprise, and so on. | | `ceo` | [Object](#ceo) | Data related to the company's Chief Executive Officer. | | `registrationNumber` | String | Primary identification number assigned to a legal entity during the registration process. Applicable to the company type. | # idDoc | Field | Type | Description | | ----------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `number` | String | Registration number of the document. | | `country` | String | Alpha-3 code (for example, `DEU`, `GBR`, `ARG`) of the country where the document was issued. | | `idDocType` | String | Type of document that is specified in the level to be provided for verification. For example, `PASSPORT`, `UTILITY_BILL`, `VEHICLE_REGISTRATION_CERTIFICATE`.
See the lists of [supported document types](ref:add-verification-documents#supported-document-types) and [supported company document types](ref:add-verification-documents#supported-company-document-types) for details. | | `registrationAuthority` | String | Official name of the authority that registered the document. | # ceo | Field | Type | Description | | ----------- | ------ | ---------------------------------------------------------------------------------------------------- | | `firstName` | String | First name. | | `lastName` | String | Last name. | | `nameType` | Enum | Name type: `aliasName`, `birthName`, `maidenName`, `legalName`, `shortName`, `tradingName`, `other`. | # txn.travelRuleInfo.protocolName Includes the names of the protocol used during the information exchange. | Value | Description | | :----- | :----------------------------------------------- | | `gtr` | [Global Travel Rule Protocol](doc:gtr-protocol). | | `sns` | [Sumsub protocol](doc:sumsub-protocol). | | `code` | [CODE protocol](doc:code-protocol). | # txn.travelRuleInfo.status Current state of the information exchange. | Value | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `counterpartyVaspNotReachable` | Data couldn't be sent since the second side of the transaction was not reachable. The response from the counterparty hasn’t been received. | | `counterpartyVaspNotFound` | Second side of the transaction was not found. | | `awaitingCounterparty` | Second side of the transaction was found and the data was sent. The response from the counterparty is awaited. | | `onHold` | Second side of the transaction was found and the data was sent. The transaction has been interrupted on the second side. | | `expired` | Second side of the transaction was found and the data was sent. There was no response received from the counterparty on time. | | `unconfirmedOwnership` | Second side of the transaction was found and the data was sent. Wallet ownership has not been confirmed. | | `counterpartyUnconfirmedOwnership` | Second side of the transaction was found and the data was sent. The negative response on wallet ownership has been received. | | `counterpartyMismatchedData` | Data has been sent, compared and there is a mismatch between both data sets. | | `counterpartyVaspGeneralDecline` | For inbound and outbound messages, the counterparty declines the transaction. Mostly applicable when dealing with counterparties on connected protocols. | | `notEnoughCounterpartyData` | Not enough information was found about the second side of the transaction. | | `completed` | Transaction is completed. | | `cancelled` | Counterparty was identified, and the data was sent. However, the counterparty decided to decline the transaction, be it by the rules or manually, and not to proceed with it. | | `finished` | Blockchain transaction ID has been updated in the `completed` transaction record. This status always follows the `completed` status. | # data.info Transaction-related financial information. | Field | Type | Description | | ------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `paymentTxnId` | String | Identifier from the payment processor: blockchain, bank. | | `type` | String | Transaction type: card, account, crypto. | | `direction` | String | It can be `out` (applicant sends to counterparty) or `in` (counterparty sends to applicant). | | `amount` | Double | Amount of funds sent within the transaction in the currency used by the applicant.
The round transaction amounts are detected: 10, 5000, 100000, and so on. For example, to detect transactions with 000 before the decimal point, use the following expression: "data.info.amount % 1000 equals 0". | | `currencyCode` | String | Code of the currency in which the transaction was made. | | `currencyType` | Enum | Type of the transaction currency: `fiat` or `crypto`. | | `amountInDefaultCurrency` | Double | Transaction amount in the default currency. | | `defaultCurrencyCode` | String | Code of the default currency. | | `paymentDetails` | String | Comment with payment details. | | `mcc` | String | 4-digit number representing Merchant Category Code (MCC). | # data.userPlatformEventInfo Indicates the applicant platform event status. | Field | Type | Description | | -------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` | Enum | User event type sent within the transaction: `login`, `failedLogin`, `signup`, `passwordReset`, `twoFaReset`, `general`. | | `passwordHash` | String | Hashed representation of the user’s password, used to detect and prevent fraud by identifying repeated use of the same password across multiple accounts. | # data.iGamingSessionInfo | Field | Type | Description | | ------------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | `gameName` | String | Name of the game played during the session. | | `betType` | Enum | Type of bet placed during the session: `slots`, `liveCasino`, `tableGames`, `matchBetting`, `poker`, `bingo`, `lottery`, `pvp`, `other`. | | `end` | Date | Date and time when the session ended. | | `durationMs` | Integer | Total duration of the session, in milliseconds. | | `lowestWagerInDefaultCurrency` | Float | Lowest single wager placed during the session, in default currency. | | `highestWagerInDefaultCurrency` | Float | Highest single wager placed during the session, in default currency. | | `averageWagerInDefaultCurrency` | Float | Average wager amount per bet during the session, in default currency. | | `count` | Integer | Total number of bets placed during the session. | | `wageredTotalInDefaultCurrency` | Float | Total amount wagered across all bets in the session, in default currency. | | `winLossInDefaultCurrency` | Float | Net result of the session in default currency. Positive values indicate a profit, negative values indicate a loss. | | `totalWinInDefaultCurrency` | Float | Total amount won during the session, in default currency. | | `totalLossInDefaultCurrency` | Float | Total amount lost during the session, in default currency. | | `bonusIds` | Array of strings | List of identifiers of bonuses applied during the session. | # service.kytAnomalyStatsScore Anomaly scores derived from daily statistical patterns, calculated by comparing the applicant's current-day activity against a fixed statistical baseline. | Field | Type | Description | | :------------------------------ | :----- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dailyTurnoverAnomalyRiskLevel` | Enum | Anomaly score based on the applicant's daily turnover. Shows how abnormally large the turnover is with respect to a fixed statistical baseline (the same for every applicant). Bucketed into `low` - `medium` - `high` level of abnormality. | | `dailyTurnoverEWMA` | Double | Exponentially weighted moving average used to calculate anomaly score for turnover. | | `dailyTxnCntAnomalyRiskLevel` | Enum | Anomaly score based on the applicant's daily number of transactions. Shows how abnormally large the number of transactions is with respect to a fixed statistical baseline (the same for every applicant). Bucketed into `low` - `medium` - `high` level of abnormality. | | `dailyTxnCntEWMA` | Double | Exponentially weighted moving average used to calculate anomaly score for number of transactions. | # address Includes address details. | Field | Type | Description | | ------------------ | ------ | ------------------------------------------ | | `country` | String | Country code (ISO 3166-1 alpha-3). | | `formattedAddress` | String | Address in an human-readable format. | | `state` | String | Name of the state or region if applicable. | | `town` | String | Town if applicable. | | `street` | String | Street if applicable. | | `subStreet` | String | Street (line 2) if applicable. | | `postCode` | String | Post code if applicable. | # type Applicant entity type. | Field | Description | | ------------ | --------------------- | | `individual` | Individual applicant. | | `company` | Company applicant. | # paymentMethod Contains information about the payment method used. | Field | Type | Description | | ---------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` | String (Enum) | Payment method type: `card`, `account`, `crypto`. | | `accountId` | String | Bank card number; bank account number; crypto address. | | `accountIdHash` | String | Hash of the account ID (bank card number, bank account number, or crypto address). Available in aggregate expressions, as with the other `paymentMethod` attributes. | | `issuingCountry` | String | Payment issuing country code in Alpha-3 format. | | `memo` | String | Optional field in blockchain transactions to attach metadata or messages for identification, routing, or compliance purposes. | # paymentMethodExtractedInfo Payment method information extracted from available data. | Field | Type | Description | | --------- | ------------------ | ------------------------------------------------------------- | | `binInfo` | [Object](#bininfo) | Bank-card BIN info returned by the payment-source BIN lookup. | | `type` | String (Enum) | Payment method type: `card`, `account`, `crypto`. | # binInfo Bank-card BIN info returned by the payment-source BIN lookup. | Field | Type | Description | | ------------ | ------- | --------------------------------------------------------------- | | `country` | String | Card issuing country. Available in aggregate expressions. | | `issuer` | String | Card issuer. | | `brand` | String | Card brand. | | `type` | String | Card type. | | `prepaid` | Boolean | `true` when the card is a prepaid card. | | `virtual` | Boolean | `true` when the card is a virtual card. | | `gift` | Boolean | `true` when the card is a gift card. | | `commercial` | Boolean | `true` when the card is a commercial (business/corporate) card. | # device Information regarding the device involved in executing the transaction. | Field | Type | Description | | -------------- | ------------------ | ------------------------------------------------------------------- | | `ipInfo` | [Object](#ipinfo) | Data about the IP address used. | | `userAgent` | String | Device user-agent. | | `sessionId` | String | ID of the transaction session. | | `sessionAgeMs` | Long | Session lifetime in milliseconds. | | `acceptLang` | String | Language of the browser used by a transaction participant, e.g. en. | | `platform` | String | Device platform, e.g., Mobile Android. | | `coords` | [Object](#coords) | Geographical coordinates. | | `address` | [Object](#address) | Address related to a device. | | `fingerprint` | String | Device fingerprint. | # institutionInfo, institutionExtractedInfo The following table explains the attributes of the `institutionInfo` and `institutionExtractedInfo` objects: - `institutionInfo` — Information regarding the financial institution through which a participant made a transaction. - `institutionExtractedInfo` — Financial institution information extracted from available data. For example, Sumsub can fill in the country code by the IBAN extracted from the applicant payment method, or by BIC from `institutionInfo`. | Field | Type | Description | | --------- | ------------------ | ------------------------------------------------------------------ | | `code` | String | Transaction institution code, e.g. BIC. | | `name` | String | Transaction institution name. | | `address` | [Object](#address) | Transaction institution address. | | `vasp` | [Object](#vasp) | Directory information about VASP (Virtual Asset Service Provider). | # vasp The following table explains the VASP (Virtual Asset Service Provider) directory information.

Field	Type	Description
`headquartersCountry`	String	Alpha-3 code of the country where the VASP is legally registered and where its headquarter is located (for example, `DEU`, `GBR`, `ARG`, and so on).
`countries`	List of Strings	List of all the registration countries for legal entities of the VASP. Presented as Alpha-3 code (e.g., `DEU`, `GBR`, `ARG`).
`regulationType`	Enum	⚠️ Deprecated — use `regulationStatus` instead, which mirrors the VASP List value without collapsing `licensed` and `regulated` into a single `authorized` value. Still populated for backward compatibility. Represents the type of regulation for VASP (Virtual Asset Service Provider). `authorized` — licensed or registered. `temporaryExemption` — registration process has already been initiated but has not yet been completed. `unauthorized` — unlicensed or unregistered.
`regulationStatus`	Enum	Regulation status exactly as shown in the VASP List Company regulations field. Unlike `regulationType`, `licensed` and `regulated` are kept as distinct values. - `regulated` — authorized under a regulatory regime (VASP List: Regulated). - `licensed` — holds a license (VASP List: Licensed). - `unlicensed` — no license or registration (VASP List: `Unlicensed`). - `temporaryExemption` — authorization process has started but is not yet completed (VASP List: Temporary exemption).
`essentialChecksStatus`	Enum	Status of the Essential Checks. `initiated` — the VASP has just been added and is yet to complete any checks. `essentialChecksDone` — the VASP for which Sumsub has only the information from blockchain analytics. `extendedEssentialChecksDone` — Extended Essential Checks (EEC) have been passed. `rejected` — the VASP is rejected due to a number of reasons.
`dueDiligenceStaus`	Enum	Status of the Due Diligence. `notStarted` — the Due Diligence process has not been yet begun. `inProgress` — the Due Diligence process is underway. `completed` — the VASP has passed Due Diligence. `rejected` — the VASP is rejected due to a number of reasons. Note that a VASP with Due Diligence `completed` will have either `essentialChecksDone` or `extendedEssentialChecksDone` status as well.
`riskScoreAnswer`	Enum	Refers to the VASP classification based on its type. `GREEN` — if the VASP type is `exchange_licensed`, `wallet`, `payment`. `YELLOW` — if the VASP type is `exchange_unlicensed`, `payment`, `other`, `atm`, `p2p_exchange_unlicensed`, `marketplace`, `liquidity_pools`, `transparent`. `ERROR` — no data received from the provider. `RED` — otherwise.
`supportsSnsProtocol`	Boolean	Indicates whether the VASP supports exchanging data via [SNS protocol](doc:sumsub-protocol) — `true`, or not — `false`.
`supportsGtrProtocol`	Boolean	Indicates whether the VASP supports exchanging data via [GTR protocol](doc:gtr-protocol) — `true`, or not — `false`.
`supportsCodeProtocol`	Boolean	Indicates whether the VASP supports exchanging data via [CODE protocol](doc:code-protocol) — `true`, or not — `false`.
`emailExists`	Boolean	VASP profile contains an associated email address.
`urlExists`	Boolean	VASP profile contains an associated website address.
`score`	Double	VASP profile includes a score derived from EEC (Extended Essential Checks) assessments.
`hidden`	Boolean	Used to differentiate VASPs to be added to your VASPs list. If set to `true`, the VASP is categorized as one of the following: internal, test, risky, or a duplicate of an existing VASP.

# applicant.info, applicant.fixedInfo The following table explains the attributes of the `applicant.info` and `applicant.fixedInfo` objects: - `applicant.fixedInfo` — Contains information submitted by the applicant via [Web](/docs/web-sdk) or [MobileSDK](/docs/mobile-sdk) or by you via [this API method](ref:create-applicants). This data is used to compare with the data we extract from the applicant documents. - `applicant.info` — Contains information recognized and extracted from the applicant documents by Sumsub. | Field | Type | Description | | ------------------------ | --------------------------------------------------------------------------------------- | --------------------------------------------------- | | `country` | String | Applicant country (ISO 3166-1 alpha-3). | | `countryOfBirth` | String | Applicant country of birth (ISO 3166-1 alpha-3). | | `firstname` | String | First name. | | `firstnameEn` | String | Transliterated first name. | | `middleName` | String | Middle name. | | `middleNameEn` | String | Transliterated middle name. | | `lastName` | String | Last name. | | `lastnameEn` | String | Transliterated last name. | | `gender` | String | Applicant gender (`M` or `F`). | | `nationality` | String | Nationality (ISO 3166-1 alpha-3 country code). | | `taxResidenceCountry` | String | Tax residence country (ISO 3166-1 alpha-3). | | `residenceCountry` | String | Residence country (ISO 3166-1 alpha-3). | | `age` | String | Applicant age. | | `address` | String | Applicant address. | | `companyInfo` | [Object](#applicantinfocompanyinfo-applicantfixedinfocompanyinfo) | Company information (KYB). | | `tin` | String | Tax identification number. | | `phone` | [Object](#applicantphone-infophone-fixedinfophone) | Includes the details of the applicant phone number. | | `crossCheckFullNameData` | [Object](#applicantinfocrosscheckfullnamedata-applicantfixedinfocrosscheckfullnamedata) | Data used for cross-validation. | # applicant.info.companyInfo, applicant.fixedInfo.companyInfo The following table explains the `companyInfo` attributes. | Field | Type | Description | | :------------------------ | :------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `country` | String | [Alpha-3 code](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-3) of the country where the company is legally registered (for example, `DEU`, `GBR`, and so on). | | `type` | String | Type of legal entity. For example, private company limited by shares, public limited company, state-owned enterprise, and so on. | | `companyName` | String | The name of the company. | | `registrationNumber` | String | Unique number that is assigned to the company when it was registered as a legal entity. | | `address` | [Object](#address) | Company address details. | | `legalAddress` | String | Address a legal entity uses to register with a legal authority. | | `postalAddress` | String | Company postal address. | | `registrationLocation` | String | City, town, or another location where the company was registered. | | `incorporatedOn` | Date | Date of company incorporation (format `YYYY-mm-dd`, e.g. `2001-09-25`). | | `incorporationDate` | [Date](#date) | Date of company incorporation in the broader spectrum. | | `email` | String | Company email address. | | `phone` | String | Company phone number. | | `taxId` | String | Taxpayer registration number/Code of taxpayer registration. | | `website` | String | Website URL of the company. | | `noUBOs` | Boolean | When set to `true`, a company is to be verified with no UBOs specified in the company profile. For example, in case when another legal entity that cannot be a UBO owns this company. | | `noShareholders` | Boolean | When set to `true`, a company is to be verified with no shareholders specified in the company profile. For example, in case when the verification level settings require a company to have three shareholders but the company has just one. | | `ownershipStructureDepth` | Integer |

Indicates the number of hierarchical tiers in the company ownership structure.

Mind the following:

Intermediate companies have their own ownershipStructureDepth values.
If a company has no associated parties, ownershipStructureDepth is null or empty.
ownershipStructureDepth is only calculated for KYB 2.0.

| | `beneficiaryStats` | [Object](#applicantinfocompanyinfobeneficiarystats-applicantfixedinfocompanyinfobeneficiarystats) | Aggregates across all company beneficiaries. | # applicant.info.companyInfo.beneficiaryStats, applicant.fixedInfo.companyInfo.beneficiaryStats Aggregates across all company beneficiaries. | Field | Type | Description | | :------------- | :------------------------------------------------------------------------------------------------------------ | :-------------------------------------------- | | `rejectLabels` | List of Strings | All reject labels of the beneficiaries. | | `counts` | [Object](#applicantinfocompanyinfobeneficiarystatscounts-applicantfixedinfocompanyinfobeneficiarystatscounts) | Number of company beneficiaries of each role. | # applicant.info.companyInfo.beneficiaryStats.counts, applicant.fixedInfo.companyInfo.beneficiaryStats.counts Per-role counts of the company's beneficiaries. Each field is the number of beneficiaries assigned that role. | Field | Type | Description | | ----------------------- | ------- | --------------------------------- | | `ubos` | Integer | Number of UBOs. | | `shareholders` | Integer | Number of shareholders. | | `representatives` | Integer | Number of representatives. | | `directors` | Integer | Number of directors. | | `companyOfficers` | Integer | Number of company officers. | | `investors` | Integer | Number of investors. | | `secretaries` | Integer | Number of secretaries. | | `founders` | Integer | Number of founders. | | `legalAdvisors` | Integer | Number of legal advisors. | | `authorizedSignatories` | Integer | Number of authorized signatories. | | `trusties` | Integer | Number of trustees. | | `trustBeneficiaries` | Integer | Number of trust beneficiaries. | | `trustSettlors` | Integer | Number of trust settlors. | | `trustProtectors` | Integer | Number of trust protectors. | | `managingPartners` | Integer | Number of managing partners. | | `equityPartners` | Integer | Number of equity partners. | | `fundInvestors` | Integer | Number of fund investors. | | `fundManagers` | Integer | Number of fund managers. | | `investmentManagers` | Integer | Number of investment managers. | | `investmentAdvisers` | Integer | Number of investment advisers. | | `fundAdministrators` | Integer | Number of fund administrators. | | `depositaries` | Integer | Number of depositaries. | | `custodians` | Integer | Number of custodians. | | `primeBrokers` | Integer | Number of prime brokers. | | `accountUsers` | Integer | Number of account users. | # applicant.phone, info.phone, fixedInfo.phone The following table explains the details of the applicant phone number. | Field | Type | Description | | ------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | country | String | Country code (ISO 3166-1 alpha-3). | | number | String | Applicant's phone number.
[In a rule](doc:create-custom-rules#build-conditions), it is important to add only digits without any extra symbols. For example, either 0035736208235 or 35736208235, or just 36208235. | # applicant.info.crossCheckFullNameData, applicant.fixedInfo.crossCheckFullNameData | Field | Type | Description | | :--------- | :----- | :----------------------------------------- | | `country` | String | Country value used for cross-validation. | | `fullName` | String | Full name value used for cross-validation. | # applicant.derivatives | Field | Type | Description | | -------------- | ------- | -------------------------- | | `estimatedAge` | Integer | Applicant's estimated age. | # applicant.riskLabels Includes the list of applicant risk labels. | Field | Type | Description | | ------------- | ------------------------------------------------- | ------------------------- | | `email` | [List of Objects](#applicantrisklabelsemail) | Email risk labels. | | `phone` | [List of Objects](#applicantrisklabelsphone) | Phone risk labels. | | `device` | [List of Objects](#applicantrisklabelsdevice) | Device risk labels. | | `deviceCheck` | [List of Objects]() | Device check risk labels. | | `crossCheck` | [List of Objects](#applicantrisklabelscrosscheck) | Cross-check risk labels. | | `selfie` | [List of Objects](#applicantrisklabelsselfie) | Selfie risk labels. | | `aml` | [List of Objects](#applicantrisklabelsaml) | AML risk labels. | | `person` | [List of Objects](#applicantrisklabelsperson) | Person risk labels. | | `company` | [List of Objects](#applicantrisklabelscompany) | Company risk labels. | # applicant.assessment | Field | Type | Description | | ------------ | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `riskLevel` | String | Label of the risk level assigned based on `totalScore`, matched against your configured Risk Levels settings (for example, `Low`, `Medium`, `High` — actual values are client-defined, not fixed). `null` if the applicant has not yet been assessed or scored. | | `scores` | Map of [objects](#applicantassessmentscores) | Each object includes the tag and score assigned to the applicant. | | `totalScore` | Integer | Total score calculated via [applicant scoring](doc:applicant-risk-scoring#step-3-set-up-applicant-scoring). | # date Information related to the specified date. | Field | Type | Description | | ------------ | ------- | ----------------------------------------------------------------- | | `ageInDays` | Integer | Time delta in days between this date and now. | | `ageInYears` | Integer | Time delta in years between this date and now. | | `dayOfMonth` | Integer | Day of the month (starts from 1). | | `month` | Integer | Month of the year (starts from 1). | | `timestamp` | Long | Unix timestamp in milliseconds. | | `year` | Integer | Year. | | `yyyymmdd` | Integer | Numeric day in the `YYYYMMDD` format, e.g. {@literal `20230123`}. | # poi.validityPeriod Detailed validity period of the ID document. | Field | Type | Description | | --------- | ---- | ----------------------- | | `millis` | long | Period in milliseconds. | | `days` | long | Period in days. | | `hours` | long | Period in hours. | | `minutes` | long | Period in minutes. | | `seconds` | long | Period in seconds. | # poi.nfc Data retrieved from the NFC chip embedded in the identity document. | Field | Type | Description | | --------- | ------ | --------------------------------- | | `fullMrz` | String | Full MRZ (machine-readable zone). | # poi.crossCheckFullNameData | Field | Type | Description | | :--------- | :----- | :----------------------------------------- | | `country` | String | Country value used for cross-validation. | | `fullName` | String | Full name value used for cross-validation. | # poa.image | Field | Type | Description | | :------------ | :----- | :-------------------------------------- | | `softwareTag` | String | Software used for the image processing. | # service.cryptoTxnInfo Cryptotransaction-related information. | Field | Type | Description | | ------------- | ------------------------------------------ | ---------------------------------------------------------- | | `chainalysis` | [Object](#servicecryptotxninfochainalysis) | Transaction monitoring data extracted from Chainalysis. | | `crystal` | [Object](#servicecryptotxninfocrystal) | Transaction monitoring data extracted from Crystal. | | `elliptic` | [Object](#servicecryptotxninfoelliptic) | Transaction monitoring data extracted from Elliptic. | | `merkle` | [Object](#servicecryptotxninfomerkle) | Transaction monitoring data extracted from Merkle Science. | | `trmlabs` | [Object](#servicecryptotxninfotrmlabs) | Transaction monitoring data extracted from TRM Labs. | | `nominis` | [Object](#servicecryptotxninfonominis) | Transaction monitoring data extracted from Nominis. | | `cipherOwl` | [Object](#servicecryptotxninfocipherowl) | Transaction monitoring data extracted from CipherOwl. | # service.cryptoTxnInfo.chainalysis Transaction monitoring data extracted from Chainalysis. | Field | Type | Description | | -------------- | -------------------------------------------------------- | --------------------------------------------------- | | `alerts` | Map of [objects](#servicecryptotxninfochainalysisalerts) | Alerts generated by Chainalysis. | | `addressAlert` | [Object](#servicecryptotxninfochainalysisaddressalert) | Address alerts generated by Chainalysis. | | `alertsAnswer` | String | Transaction risk severity according to Chainalysis. | # service.cryptoTxnInfo.chainalysis.alerts Alerts generated by Chainalysis. | Field | Type | Description | | ---------------- | ------ | ------------------------------------------------------------------------------------------------------- | | `riskScore` | Double | Transaction risk score. | | `red` | String | High and severe risk. | | `yellow` | String | Medium risk. | | `green` | String | Low risk. | | `["alert name"]` | String | This is the alert name triggered, for example, `terrorist financing`, `sanctioned entities`, and so on. | # service.cryptoTxnInfo.chainalysis.addressAlert Address alerts generated by Chainalysis. | Field | Type | Description | | :---------- | :----------------------- | :---------------------------------------------------------------------------- | | `riskLevel` | [Enum](#riskscoreanswer) | Alert risk level of the address. | | `exposures` | String | Name of the cluster the transaction is related to. E.g. `Direct`, `Indirect`. | | `triggers` | Double | Category that is responsible for the alert being generated. | | `category` | String | Classification of the cluster the address belongs to. E.g. `exchange`. | | `name` | String | Name of the entity itself e.g. `ChangeNOW`. | # service.cryptoTxnInfo.chainalysis.alerts\["alert name"] | Field | Type | Description | | :----------------------------- | :----- | :------------------------------------------------------------------------------------- | | `alertsLevel` | String | The level of severity classification that can be `Red`, `Yellow`, `Green`. | | `service` | String | Name of the cluster the transaction is related to. For example, `Binance`, `Duelbits`. | | `category` | String | This is the alert category. For exampler, `Exchange`, `Sanctioned Entity`. | | `alertAmountUsd` | Double | Alert amount in USD terms. | | `alertAmountInDefaultCurrency` | Double | Amount in the user's default currency settings. | | `exposureType` | String | This can be either `Direct`, or `Indirect`. | # service.cryptoTxnInfo.crystal Includes transaction monitoring data extracted from Crystal | Field | Type | Description | | :--------------------------------- | :-------------------------------------------- | :------------------------------------------------------------ | | `answer` | String | Transaction risk severity according to Crystal. | | `riskScore` | Double | Transaction risk score according to Crystal. | | `fiatInDefaultCurrency` | Double | Fiat extracted from Crystal in default currency. | | `riskyVolumeFiatInDefaultCurrency` | Double | Risky volume fiat extracted from Crystal in default currency. | | `signals` | [Object](#servicecryptotxninfocrystalsignals) | Possible entity types associated with the transaction. | # service.cryptoTxnInfo.elliptic | Field | Type | Description | | ------------------- | -------------------------------------------------------- | ------------------------------------------------------------------- | | `walletExposure` | [Object](#servicecryptotxninfoellipticwalletexposure) | Transaction monitoring data obtained from wallet exposure analysis. | | `transferScreening` | [Object](#servicecryptotxninfoelliptictransferscreening) | Transaction monitoring data extracted from transaction screening. | # service.cryptoTxnInfo.elliptic.walletExposure

Field	Type	Description
`riskScore`	Float	Aggregated risk score calculated from all triggered risk rules for wallet screening.
`assetTier`	Enum	Asset coverage tier indicating whether full analysis (`full`) or sanctions-only (`sanctions`) screening is available.
`triggeredRules`	Map of [Objects](#servicecryptotxninfoellipticwalletexposuretriggeredrules)	A map of triggered risk rules, including their types and names.
`blockchainInfo`	[Object](#servicecryptotxninfoellipticwalletexposureblockchaininfo)	Contains total transaction values to and from the wallet cluster.
`minNumberOfHopsByCategory`	[Object](#servicecryptotxninfoellipticwalletexposureminnumberofhopsbycategory)	Contains the minimum number of hops between the screened address and the nearest labeled entity by category. - Key is the Elliptic category name as Elliptic returns it, for example `["Mixer"]`. Case matters: `["mixer"]` does not match. - Old British spellings map to the American ones: `Criminal Organisation`, `Decentralised Exchange` and `Dark Market - Centralised` are available under `Criminal Organization`, `Decentralized Exchange` and `Dark Market - Centralized`. - `0` hops means the screened address (or a transaction address) itself belongs to the entity. Use `<= 1` to also match direct counterparties.
`maxExposurePercentageByCategory`	[Object](#servicecryptotxninfoellipticwalletexposuremaxexposurepercentagebycategory)	Maximum exposure percentage (0 to 100) to a category, by direction. Keys are the same as in `minNumberOfHopsByCategory`, for example `outgoing["Mixer"] > 50`. Maximum, not sum: two mixers at 23% and 28% give 28.

### Example rule: `service.cryptoTxnInfo.elliptic.walletExposure.maxExposurePercentageByCategory.outgoing["Mixer"] > 50 AND service.cryptoTxnInfo.elliptic.walletExposure.minNumberOfHopsByCategory.outgoing["Mixer"] <= 1` # service.cryptoTxnInfo.elliptic.transferScreening

Field	Type	Description
`riskScore`	Double	Aggregated risk score calculated from all triggered risk rules for transaction screening.
`blockchainInfo`	[Object](#servicecryptotxninfoelliptictransferscreeningblockchaininfo)	Contains blockchain-related information for the transaction.
`processStatus`	String	Screening process status (`running`, `complete`, or `error`).
`minNumberOfHopsByCategory`	Map of Integers	Contains the minimum number of hops between the screened transaction and the nearest labeled entity by category. - Key is the Elliptic category name as Elliptic returns it, for example `["Mixer"]`. Case matters: `["mixer"]` does not match. - Old British spellings map to the American ones: `Criminal Organisation`, `Decentralised Exchange` and `Dark Market - Centralised` are available under `Criminal Organization`, `Decentralized Exchange` and `Dark Market - Centralized`. - `0` hops means the screened address (or a transaction address) itself belongs to the entity. Use `<= 1` to also match direct counterparties.
`maxExposurePercentageByCategory`	Map of `Double`-s	Maximum exposure percentage (0 to 100) to a category. Keys are the same as in `minNumberOfHopsByCategory`, for example `["Mixer"] > 50`. Maximum, not sum. No direction split here.
`dustTransaction`	Boolean	Indicates whether the transfer is a dust transaction — its value is below the minimum amount Elliptic screens on this blockchain. When `true`, the transfer is not sent to Elliptic for screening.

# service.cryptoTxnInfo.elliptic.walletExposure.triggeredRules | Field | Type | Description | | ------ | ------ | -------------------------------------------------------------------- | | `type` | String | Type of the triggered risk rule (`exposure` or `behavior`). | | `name` | String | Name of the triggered risk rule as configured in Elliptic Navigator. | # service.cryptoTxnInfo.elliptic.walletExposure.blockchainInfo | Field | Type | Description | | --------------- | ------ | ------------------------------------------------------------- | | `incomingTotal` | Double | Total value of incoming transactions to the wallet cluster. | | `outgoingTotal` | Double | Total value of outgoing transactions from the wallet cluster. | # service.cryptoTxnInfo.elliptic.walletExposure.minNumberOfHopsByCategory | Field | Type | Description | | ---------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `incoming` | Map of Integers | Minimum number of hops between the screened address and the nearest labeled entity of the specified category in the source-of-funds direction. | | `outgoing` | Map of Integers | Minimum number of hops between the screened address and the nearest labeled entity of the specified category in the destination-of-funds direction. | # service.cryptoTxnInfo.elliptic.walletExposure.maxExposurePercentageByCategory | **Field** | **Type** | **Description** | | :--------- | :---------------- | ----------------------------------------------------------------------------------------- | | `incoming` | Map of `Double`-s | Maximum percentage per category for incoming exposure. Key is the Elliptic category name. | | `outgoing` | Map of `Double`-s | Maximum percentage per category for outgoing exposure. Key is the Elliptic category name. | # service.cryptoTxnInfo.elliptic.transferScreening.blockchainInfo | Field | Type | Description | | ------------- | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | `address` | [Object](#servicecryptotxninfoelliptictransferscreeningblockchaininfoaddress) | Indicates whether the screened address has sent or received any transactions on the blockchain. | | `transaction` | [Object](#servicecryptotxninfoelliptictransferscreeningblockchaininfotransaction) | Contains transaction-related data. | # service.cryptoTxnInfo.elliptic.transferScreening.blockchainInfo.address | Field | Type | Description | | ------------- | ------- | ----------------------------------------------------------------------------------------------------------------- | | `hasSent` | Boolean | Indicates whether the screened address has sent any transactions on the blockchain (`true`) or not (`false`). | | `hasReceived` | Boolean | Indicates whether the screened address has received any transactions on the blockchain (`true`) or not (`false`). | # service.cryptoTxnInfo.elliptic.transferScreening.blockchainInfo.transaction | Field | Type | Description | | ------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | `time` | String | ISO 8601 datetime timestamp indicating when the transaction was recorded on the blockchain. | | `value` | [Object](#servicecryptotxninfoelliptictransferscreeningblockchaininfotransactionvalue) | Contains the transaction amounts, including native asset units and USD equivalent. | # service.cryptoTxnInfo.elliptic.transferScreening.blockchainInfo.transaction.value | Field | Type | Description | | -------------- | ------ | ----------------------------------------------------------------------------------------------------------- | | `nativeAmount` | Double | Transaction value in the smallest native currency unit (for example, `satoshi` for `BTC`, `wei` for `ETH`). | | `nativeMajor` | Double | Transaction value in the major native currency unit (for example, `BTC`, `ETH`). | | `usd` | Double | Transaction value converted to USD at the time of the transaction. | # service.cryptoTxnInfo.merkle Includes transaction monitoring data extracted from Merkle Science. ### Note Case matters. Merkle Science values are passed to rules as they come, without changing the letter case. For example, `tags.owner.type == 'Gambling'` matches, but `tags.owner.type == 'gambling'` does not. | Field | Type | Description | | ------------------- | ------------------------------------------------------ | -------------------------------------------------------------------- | | `transferScreening` | [Object](#servicecryptotxninfomerkletransferscreening) | Transaction monitoring data extracted from transaction screening. | | `walletScreening` | [Object](#servicecryptotxninfomerklewalletscreening) | Transaction monitoring data extracted from wallet address screening. | # service.cryptoTxnInfo.merkle.transferScreening Includes transaction monitoring data extracted from transaction screening. | Field | Type | Description | | ------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `address` | String | The wallet address being screened. | | `assetSupported` | Boolean | Indicates whether the asset is supported by Merkle Science (`true` or `false`). | | `blockchain` | Integer | Numeric identifier of the blockchain (for example, `0` = Bitcoin). | | `blockchainVerbose` | String | The full name of the blockchain. For example, `Bitcoin`. | | `customerId` | String | The customer identifier that Sumsub sends to Merkle Science: the applicant’s `externalUserId`. If `externalUserId` is shorter than 5 characters, Sumsub sends the applicant ID instead. In this case, you find the user in Merkle Science by the applicant ID, not by your own ID. | | `exposure` | [Object](#servicecryptotxninfomerklewalletscreeningexposure-servicecryptotxninfomerkletransferscreeningexposure) | Merkle Science exposure breakdown for the screened transfer: USD totals per counterparty tag type, split by party (`originator`/`beneficiary`) and by `direct`/`indirect` exposure. | | `identifier` | String | The blockchain hash of the transaction being screened. | | `riskLevel` | Integer | Numeric risk level ranging from `0` (lowest) to `5` (highest). | | `riskLevelVerbose` | String | Human-readable risk level description from the following: `No Risk Detected`, `Info`, `Caution`, `Medium`, `High`, `Critical`. | # service.cryptoTxnInfo.merkle.walletScreening Includes transaction monitoring data extracted from wallet address screening. | Field | Type | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `assetSupported` | Boolean | Indicates whether the asset is supported by Merkle Science (`true` or `false`). | | `balance` | String | The blockchain balance of the screened wallet address. | | `blockchain` | Integer | Numeric identifier of the blockchain (for example, `0` = Bitcoin). | | `blockchainVerbose` | String | The full name of the blockchain. For example, `Bitcoin`. | | `customerId` | String | The customer identifier that Sumsub sends to Merkle Science: the applicant’s `externalUserId`. If `externalUserId` is shorter than 5 characters, Sumsub sends the applicant ID instead. In this case, you find the user in Merkle Science by the applicant ID, not by your own ID. | | `exposure` | [Object](#servicecryptotxninfomerklewalletscreeningexposure-servicecryptotxninfomerkletransferscreeningexposure) | Merkle Science exposure breakdown for the screened wallet: USD totals per counterparty tag type, split by party (`originator`/`beneficiary`) and by `direct`/`indirect` exposure. | | `identifier` | String | The wallet address being screened. | | `riskLevel` | Integer | Numeric risk level ranging from `0` (lowest) to `5` (highest). | | `riskLevelVerbose` | String | Human-readable risk level description from the following: `No Risk Detected`, `Info`, `Caution`, `Medium`, `High`, `Critical`. | | `totalIncomingValue` | String | Total value of all incoming transactions in crypto. | | `totalIncomingValueUsd` | String | Total value of all incoming transactions in USD. | | `totalOutgoingValue` | String | Total value of all outgoing transactions in crypto. | | `totalOutgoingValueUsd` | String | Total value of all outgoing transactions in USD. | | `tags` | [Object](#servicecryptotxninfomerklewalletscreeningtags) | Merkle Science `owner` and `user` tags identified for the screened wallet. | | `customTags` | Array of strings | Custom tags assigned to the screened wallet in Merkle Science. | # service.cryptoTxnInfo.merkle.walletScreening.exposure, service.cryptoTxnInfo.merkle.transferScreening.exposure Merkle Science exposure attributed to each party of the screened wallet or transfer. | Field | Type | Description | | :------------ | :------------------------------------------------------------------------------------------------------------------------------------ | :-------------------------------------------------------------------------------------------------- | | `originator` | [Object](#servicecryptotxninfomerklewalletscreeningexposureoriginator-servicecryptotxninfomerkletransferscreeningexposurebeneficiary) | Exposure attributed to the originator (sending party), broken down into `direct` and `indirect`. | | `beneficiary` | [Object](#servicecryptotxninfomerklewalletscreeningexposureoriginator-servicecryptotxninfomerkletransferscreeningexposurebeneficiary) | Exposure attributed to the beneficiary (receiving party), broken down into `direct` and `indirect`. | # service.cryptoTxnInfo.merkle.walletScreening.exposure.originator, service.cryptoTxnInfo.merkle.transferScreening.exposure.beneficiary Exposure for a single party, split by exposure directness. | Field | Type | Description | | :--------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------- | | `direct` | [Object](#servicecryptotxninfomerklewalletscreeningexposureoriginatordirect-servicecryptotxninfomerklewalletscreeningexposureoriginatorindirect-servicecryptotxninfomerkletransferscreeningexposurebeneficiarydirect-servicecryptotxninfomerkletransferscreeningexposurebeneficiaryindirect) | Direct exposure USD totals for this party, broken down by counterparty tag type. | | `indirect` | [Object](#servicecryptotxninfomerklewalletscreeningexposureoriginatordirect-servicecryptotxninfomerklewalletscreeningexposureoriginatorindirect-servicecryptotxninfomerkletransferscreeningexposurebeneficiarydirect-servicecryptotxninfomerkletransferscreeningexposurebeneficiaryindirect) | Indirect exposure USD totals for this party, broken down by counterparty tag type. | # service.cryptoTxnInfo.merkle.walletScreening.exposure.originator.direct, service.cryptoTxnInfo.merkle.walletScreening.exposure.originator.indirect, service.cryptoTxnInfo.merkle.transferScreening.exposure.beneficiary.direct, service.cryptoTxnInfo.merkle.transferScreening.exposure.beneficiary.indirect USD exposure totals broken down by Merkle Science counterparty tag type. The field names are lowercase `snake_case` (for example, `coin_mixer`), unlike the Title Case values of `tags.owner.type` (for example, `Coin Mixer`). | Field | Type | Description | | :------------------------ | :------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- | | `coin_mixer` | Double | Exposure USD total to coin mixers, centralized or decentralized (for example, Tornado Cash, Wasabi, ChipMixer). | | `darknet` | Double | Exposure USD total to darknet marketplaces, vendor shops, CSAM and narcotics vendors, stolen accounts and card shops. | | `defi` | Double | Exposure USD total to DeFi services: DEX (AMM and aggregators), bridges, lending, derivatives, yield aggregators, asset management, insurance. | | `donation` | Double | Exposure USD total to charities, project donations, and tip jars. | | `exchange` | Double | Exposure USD total to exchanges: mandatory KYC, optional KYC, P2P, OTC, DEX, inactive. | | `extortion` | Double | Exposure USD total to blackmail and sextortion. | | `gambling` | Double | Exposure USD total to crypto-only and fiat-and-crypto gambling. | | `high_risk_organization` | Double | Exposure USD total to terrorist and criminal organizations, high-risk exchanges and jurisdictions, frozen assets, and USDT/USDC blacklists. | | `law_enforcement` | Double | Exposure USD total to coins seized by law enforcement. | | `malware` | Double | Exposure USD total to ransomware and cryptojacking. | | `mining_pool` | Double | Exposure USD total to mining pools. | | `others` | Double | Exposure USD total to unattributed entities, mostly individual holders. | | `sanctions` | Double | Exposure USD total to OFAC listings and clusters, and entities from sanctioned countries. | | `scam` | Double | Exposure USD total to phishing, HYIP, exit scams, impersonation, fake services and ICOs, and spam. | | `service` | Double | Exposure USD total to services: custody, wallet providers, payment gateways, ATMs, financial services, shops, marketplaces. | | `smart_contract_platform` | Double | Exposure USD total to smart contract platforms: tokens, DApps, ICOs. | | `special_measures` | Double | Exposure USD total to FinCEN special measures. | | `theft` | Double | Exposure USD total to hacks and abuse of access. | | `subtype` | Map of Doubles | Exposure USD totals per Merkle Science "Entity Sub Type" in snake_case (for example, `darknet_marketplace` or `terrorist_organization`). | # service.cryptoTxnInfo.merkle.walletScreening.tags Merkle Science tags identified for the screened wallet. | Field | Type | Description | | :------ | :-------------------------------------------------------------------------------------------------------------- | :--------------------------------------- | | `owner` | [Object](#servicecryptotxninfomerklewalletscreeningtagsowner-servicecryptotxninfomerklewalletscreeningtagsuser) | Merkle Science tag for the wallet owner. | | `user` | [Object](#servicecryptotxninfomerklewalletscreeningtagsowner-servicecryptotxninfomerklewalletscreeningtagsuser) | Merkle Science tag for the wallet user. | # service.cryptoTxnInfo.merkle.walletScreening.tags.owner, service.cryptoTxnInfo.merkle.walletScreening.tags.user A single Merkle Science wallet tag. | Field | Type | Description | | :-------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` | String | Tag type as Merkle Science returns it, in Title Case. For example, `Exchange`, `Coin Mixer`, `Darknet`, `High Risk Organization`, `Sanctions`. Case matters: `exchange` does not match `Exchange`. | | `subtype` | String | Tag subtype as Merkle Science returns it, for finer categorization. For example, `Mandatory KYC and AML`, `Crypto only`. Case matters. | | `name` | String | Human-readable name of the tagged entity as Merkle Science returns it. Case matters. | # service.cryptoTxnInfo.trmlabs Includes transaction monitoring data extracted from TRM Labs. | Field | Type | Description | | :------------------ | :------------------------------------------------------ | :-------------------------------------------------- | | `walletScreening` | [Object](#servicecryptotxninfotrmlabswalletscreening) | Wallet screening data extracted from TRM Labs. | | `transferScreening` | [Object](#servicecryptotxninfotrmlabstransferscreening) | Transaction screening data extracted from TRM Labs. | # service.cryptoTxnInfo.trmlabs.walletScreening Includes wallet screening data extracted from TRM Labs. | Field | Type | Description | | :---------------------------------- | :---------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `assetSupported` | Boolean | Indicates if the asset is supported by TRM Labs API (`true`) or not (`false`). | | `addressIncomingVolumeUsd` | String | Represents the sum of all the incoming volumes on the given chain. | | `addressOutgoingVolumeUsd` | String | Represents the sum of all the outgoing volumes on the given chain. | | `addressHighestRiskScoreLevel` | Integer | The highest risk score level among all risk indicators for this address. Possible values: `null`, `0` (Unknown), `1` (Low), `5` (Medium), `10` (High), `15` (Severe). | | `addressHighestRiskScoreLevelLabel` | String | The label corresponding to the highest risk score level among all risk indicators for this wallet address. Possible values: `null`, `Unknown`, `Low`, `Medium`, `High`, `Severe`. | | `addressTotalVolumeUsd` | String | Represents the sum of all the incoming and outgoing volumes on the given chain. | | `chain` | String | Name of the chain. See the list of names on [this page](https://documentation.trmlabs.com/tag/Wallet-Screening#section/Supported-Blockchains). | | `entities` | Array of [Objects](#servicecryptotxninfotrmlabswalletscreeningentities) | List of attributed entities for the given wallet address and chain. | | `riskIndicators` | Array of [Objects](#servicecryptotxninfotrmlabswalletscreeningriskindicators) | Array of risk indicators associated with this wallet address. | # service.cryptoTxnInfo.trmlabs.walletScreening.entities Attributed entities for the given wallet address and chain. | Field | Type | Description | | :--------------------- | :------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `riskScoreLevel` | Integer | The highest risk score level for this entity. Possible values: `null`, `0` (Unknown), `1` (Low), `5` (Medium), `10` (High), `15` (Severe). | | `riskScoreLevelLabel` | String | The label corresponding to the highest risk score level among all risk indicators for this entity. Possible values: `null`, `Unknown`, `Low`, `Medium`, `High`, `Severe`. | | `category` | String | Name of the risk category. You can find the full list [here](https://documentation.trmlabs.com/tag/Supported-Categories). | | `categoryId` | Integer | Identifier of the risk category. You can find the full list [here](https://documentation.trmlabs.com/tag/Supported-Categories). | | `confidenceScoreLabel` | String | The label corresponding to the confidence score. Possible values (from most confident to least confident): `Near Certainty`, `High Confidence`, `High-moderate Confidence`, `Moderate Confidence`, `Low-moderate Confidence`, `Low Confidence`. | # service.cryptoTxnInfo.trmlabs.walletScreening.riskIndicators Risk indicators associated with the wallet address. | Field | Type | Description | | :----------------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------- | | `category` | String | Name of the risk category. You can find the full list of names on [this page](https://documentation.trmlabs.com/tag/Supported-Categories). | | `categoryRiskScoreLevel` | Integer | The highest risk score level for this category. Possible values: `null`, `0` (Unknown), `1` (Low), `5` (Medium), `10` (High), `15` (Severe). | | `riskType` | String | Indicates the risk type. Possible values: `COUNTERPARTY`, `INDIRECT`, `OWNERSHIP`. | # service.cryptoTxnInfo.trmlabs.transferScreening Includes transaction screening data extracted from TRM Labs. | Field | Type | Description | | :-------------------- | :---------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `asset` | String | Name of a supported asset. See [Supported Assets](https://documentation.trmlabs.com/tag/Transaction-Monitoring#section/Supported-Assets) for valid values. | | `assetSupported` | Boolean | Indicates if the asset is supported by TRM Labs API (`true`) or not (`false`). | | `chain` | String | Name of a supported blockchain. See [Supported Blockchains](https://documentation.trmlabs.com/tag/Transaction-Monitoring#section/Supported-Blockchains) for valid values. | | `destinationAddress` | String | Recipient address of the transfer, converted to TRM's normalized format. | | `riskScoreLevel` | Integer | The highest risk score level for this transaction. Possible values: `null`, `0` (Unknown), `1` (Low), `5` (Medium), `10` (High), `15` (Severe). | | `riskScoreLevelLabel` | String | The label corresponding to the highest risk score level among all risk indicators for this transaction. Possible values: `null`, `Unknown`, `Low`, `Medium`, `High`, `Severe`. | | `screenStatus` | String | Indicates the screening status. Possible values: `FAILED`, `PROCESSING`, `SUCCEEDED`. | | `alerts` | Array of [Objects](#servicecryptotxninfotrmlabstransferscreeningalerts) | Alerts generated by TRM based on the submitted transfers and configured rules. | # service.cryptoTxnInfo.trmlabs.transferScreening.alerts Includes the alerts generated by TRM based on the submitted transfers and configured rules. | Field | Type | Description | | :-------------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------ | | `uuid` | String | UUID (Universally Unique Identifier) of an alert, e.g., `567f7542-75c2-4b0c-a637-dff521c244e4`. | | `riskScoreLevel` | Integer | The highest risk score level. Possible values: `null`, `0` (Unknown), `1` (Low), `5` (Medium), `10` (High), `15` (Severe). | | `riskScoreLevelLabel` | String | The label corresponding to the highest risk score level. Possible values: `null`, `Unknown`, `Low`, `Medium`, `High`, `Severe`. | | `status` | String | Current status of the alert. Possible values: `CLOSED`, `IN_REVIEW`, `OPEN`. | | `closedReason` | String | Indicates the reason the user closed an alert. Possible values: `FLAGGED`, `DISMISSED`, `OTHER`, `null`. | | `closedAt` | String | Date and time when the alert was closed, in ISO 8601 UTC format (e.g., `2025-03-28T14:45:00Z`). | # service.cryptoTxnInfo.nominis Transaction monitoring data extracted from Nominis. | **Field** | **Type** | **Description** | | :------------------ | :------- | ---------------------------------------------------------- | | `walletScreening` | Object | Result of the counterparty wallet screening by Nominis. | | `transferScreening` | Object | Result of the transaction (transfer) screening by Nominis. | # service.cryptoTxnInfo.nominis.walletScreening

Field	Type	Description
`answer`	Enum	Sumsub verdict based on the Nominis risk score. Possible values: `GREEN`, `YELLOW`, `RED`, `ERROR`, `IGNORED`. Numeric score: - 70 and above gives `RED`. - 40 to 69 gives `YELLOW`. - Below 40 gives `GREEN`. - Text label: `critical`, `severe`, `high` give `RED`. - `medium`, `med`, `moderate` give `YELLOW`. - `low`, `minimal`, `none`, `info`, `clean` give `GREEN`. - Any other label gives `YELLOW`.
`chainSupported`	Boolean	`true` if Nominis supports the blockchain of the screened wallet. When `false`, the other fields are empty.
`chain`	String	Blockchain name as sent to Nominis.
`classification`	List of `String`-s	Entity classification labels that Nominis assigned to the wallet.
`riskScore`	Double	Numeric risk score from Nominis (0 to 100). `null` when Nominis returns a text label instead of a number.
`riskScoreLabel`	String	Text risk label from Nominis in lower case, for example `high`. `null` when Nominis returns a number.
`riskFactors`	List of `String`-s	Risk factors that Nominis reported for the wallet.
`riskCategories`	List of `String`-s	Classification of each risk category that Nominis found for the wallet, without duplicates.

# service.cryptoTxnInfo.nominis.transferScreening | **Field** | **Type** | **Description** | | :--------------------- | :----------------- | ---------------------------------------------------------------------------------------------------------------- | | `answer` | Enum | Sumsub verdict based on the Nominis risk score. Same values and same mapping as in `walletScreening.answer`. | | `chainSupported` | Boolean | `true` if Nominis supports the blockchain of the screened transaction. When `false`, the other fields are empty. | | `chain` | String | Blockchain name as sent to Nominis. | | `riskScore` | Double | Numeric risk score from Nominis (0 to 100). `null` when Nominis returns a text label instead of a number. | | `riskScoreLabel` | String | Text risk label from Nominis in lower case, for example `high`. `null` when Nominis returns a number. | | `usdValue` | Double | Value of the transfer in USD, as reported by Nominis. | | `behavioralIndicators` | List of `String`-s | Behavioral indicators that Nominis reported for the transaction. | | `riskCategories` | List of `String`-s | Classification of each risk category that Nominis found for the transaction, without duplicates. | ### Example rule: `service.cryptoTxnInfo.nominis.walletScreening.riskScore >= 40 AND service.cryptoTxnInfo.nominis.walletScreening.chainSupported == true` # service.cryptoTxnInfo.cipherOwl | Field | Type | Description | | ----------------- | ------------------------------------------------------- | ------------------------------------------------------- | | `walletScreening` | [Object](#servicecryptotxninfocipherowlwalletscreening) | Wallet-address screening data extracted from CipherOwl. | # service.cryptoTxnInfo.cipherOwl.walletScreening | Field | Type | Description | | :--------------------- | :--------------- | :------------------------------------------------------------------------------- | | `answer` | Enum | CipherOwl screening verdict: `GREEN`, `YELLOW`, `RED`, `ERROR`, or `IGNORED`. | | `chainSupported` | Boolean | `true` if CipherOwl supports wallet screening for the transaction's asset/chain. | | `chain` | String | Chain identifier the address was screened on. | | `foundRisk` | Boolean | `true` if CipherOwl identified risk for the address. | | `riskScore` | Number | Numeric risk score returned by CipherOwl. | | `riskBand` | String | Risk band (severity bucket) assigned to the score. | | `riskCategories` | List of String-s | All risk categories identified in the screening breakdown. | | `directRiskCategories` | List of String-s | Risk categories from direct (`DIRECT`) exposure only. | # service.amlDetailsData, service.amlCounterpartyBankData Both attributes resolve to the same AML screening-summary object. `amlDetailsData` carries the AML result of the payment-details check; `amlCounterpartyBankData` carries the AML result of the counterparty bank check. | Field | Type | Description | | ------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `riskLabels` | [Array of strings](#serviceamldetailsdatarisklabels-serviceamlcounterpartybankdatarisklabels) | AML risk labels found for the screened entity.

Usable with the `has(...)` function, for example `has(service.amlDetailsData.riskLabels, 'adverseMedia')`. | | `worstStatus` | String | Worst review status across the AML cases behind this check. One of `IGNORED`, `GREEN`, `YELLOW`, `RED`, `ERROR`. | # service.amlDetailsData.riskLabels, service.amlCounterpartyBankData.riskLabels AML risk-labels: API values used in rule expressions, dashboard label, and meaning. | API value | Dashboard label | Description | | ---------------- | ------------------- | ------------------------------------------------------------------------------- | | `pep` | PEP | Screened entity belongs to the **PEP** (Politically Exposed Person) category. | | `sanctions` | Sanctions | Screened entity was found in sanctions lists. | | `terrorism` | Terrorism | Screened entity is suspected of terrorism. | | `crime` | Crime | Screened entity is suspected of criminal activities. | | `adverseMedia` | Adverse Media | Compromising information related to the screened entity was found in the media. | | `fitnessProbity` | Fitness and Probity | Screened entity is found in the **Fitness and Probity** lists. | # txnFraudInfo.behavioral Contains information pertaining to the user's behavioral data. | Field | Type | Description | | ----------- | ------------------------ | ----------------------------------------------- | | `riskLevel` | [Enum](#riskscoreanswer) | Sumsub valuation of associated risk. | | `labels` | List of Strings | Labels identified by behavioral scoring model. | | `metrics` | Map of Doubles | Metrics identified by behavioral scoring model. | # txnFraudInfo.email Contains information pertaining to the user's email data. | Field | Type | Description | | ------------ | ------------------------ | ------------------------------------------------------------------------------------------------- | | `riskLevel` | [Enum](#riskscoreanswer) | Sumsub valuation of associated risk. | | `labels` | List of Strings | Labels identified by fraud model. | | `facts` | Map of Doubles | Information about the email, such as the number of breaches (public Enum `breachesCnt`). | | `domainType` | Enum | Classification of the applicant email's domain. Read in rules as `txnFraudInfo.email.domainType`. | # domainType Classification of an email address's domain. | Field | Description | | :------------ | :------------------------------------------------------------------------ | | `freeWebmail` | Free consumer provider. | | `gated` | Verified/restricted signup, for instance, corporate, university, or ISP. | | `disposable` | Temporary/throwaway service. | | `relay` | Private relay hiding the real address, for instance, Apple Hide My Email. | | `business` | Business or corporate domain | | `education` | Educational institution domain. | | `government` | Government domain. | | `typosquat` | Domain imitating a known brand (typosquatting). | | `unknown` | Domain could not be classified. | # txnFraudInfo.phone Contains information pertaining to the user's phone data. | Field | Type | Description | | ----------- | ------------------------ | ------------------------------------ | | `riskLevel` | [Enum](#riskscoreanswer) | Sumsub valuation of associated risk. | | `labels` | List of Strings | Labels identified by fraud model. | # txnFraudInfo.ip Contains information pertaining to the user's IP address data. | Field | Type | Description | | ----------- | ------------------------ | ------------------------------------ | | `riskLevel` | [Enum](#riskscoreanswer) | Sumsub valuation of associated risk. | | `labels` | List of Strings | Labels identified by fraud model. | # txnFraudInfo.device Contains information pertaining to the user's device data. | Field | Type | Description | | ----------- | ------------------------ | ------------------------------------ | | `riskLevel` | [Enum](#riskscoreanswer) | Sumsub valuation of associated risk. | | `labels` | List of Strings | Labels identified by fraud model. | # decision Contains details of the review decision. | Field | Description | | -------------- | ------------------------------------------------------------- | | `approved` | An item (`transaction`, `applicant`, `amlcase`) was approved. | | `rejected` | An item (`transaction`, `applicant`, `amlcase`) was rejected. | | `resubmission` | Resubmission requested. | # riskScoreAnswer Review answer based on the check result. | Field | Description | | --------- | ---------------------------------------------------------------- | | `GREEN` | Successful result of the verification and/or check. | | `YELLOW` | There are some warnings regarding the verification and/or check. | | `RED` | Violations were found. | | `IGNORED` | Check was skipped. | | `ERROR` | Error occured during the check. | # rejectLabels List of available reject labels. | Field | Description | | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ADDITIONAL_DOCUMENT_REQUIRED` | Additional documents are required to pass the check. | | `ADVERSE_MEDIA` | Applicant was found in the adverse media. | | `AGE_REQUIREMENT_MISMATCH` | The Age requirement is not met (e.g. can't rent a car to a person below 25yo). | | `APPLICANT_INTERRUPTED_INTERVIEW` | Applicant refused to finish the interview during the Video Ident call. | | `BACK_SIDE_MISSING` | Back side of the document is missing. | | `BAD_AVATAR` | Applicant's avatar doesn't meet the client's requirements. | | `BAD_FACE_MATCHING` | Face check between a document and a selfie was failed. | | `BAD_PROOF_OF_ADDRESS` | Applicant uploaded a poor quality proof of address. | | `BAD_PROOF_OF_IDENTITY` | Applicant uploaded a poor quality ID document. | | `BAD_PROOF_OF_PAYMENT` | Applicant uploaded a poor quality proof of payment. | | `BAD_SELFIE` | Applicant uploaded a selfie in poor quality. | | `BAD_VIDEO_SELFIE` | Applicant uploaded a video selfie in poor quality. | | `BLACK_AND_WHITE` | Applicant uploaded black and white photos of their documents. | | `BLACKLIST` | User is blocklisted by Sumsub. | | `BLOCKLIST` | User is blocklisted by you. | | `CHECK_UNAVAILABLE` | External database service is not available at the moment. | | `COMPANY_DATA_MISMATCH` | Company attributes like Name, Registration on the provided documents do not match the state company registry. | | `COMPANY_INACTIVE_ENTITY` | According to the publicly available state company registry, the entity is inactive, dissolved, or deregistered. | | `COMPANY_INCORRECT_DATA` | Provided company attributes like Name, Registration or Tax Number do not match the provided documents or the state company registry. | | `COMPANY_NOT_DEFINED_BENEFICIARIES` | The entity's beneficial owners weren't identified and duly verified. | | `COMPANY_NOT_DEFINED_OWNERSHIP_STRUCTURE` | Company ownership structure has not been specified or differs from the one declared by the corporate documents. | | `COMPANY_NOT_DEFINED_REPRESENTATIVES` | The entity's representatives weren't defined. | | `COMPANY_NOT_DEFINED_STRUCTURE` | The entity's control structure wasn't defined. | | `COMPANY_NOT_VALIDATED_BENEFICIARIES` | The entity's beneficial owners weren't validated. | | `COMPANY_NOT_VALIDATED_BENEFICIAL_OWNERS` | Not all beneficial owners have passed the KYC verification procedure. | | `COMPANY_NOT_VALIDATED_DIRECTORS` | Not all directors have passed the KYC verification procedure. | | `COMPANY_NOT_VALIDATED_REPRESENTATIVES` | The entity's representatives weren't validated. | | `COMPANY_PROBLEMATIC_STRUCTURE` | There are officials in the control and ownership structure who got rejected. | | `COMPROMISED_PERSONS` | Applicant doesn't correspond to Compromised Person Politics. | | `CONNECTION_INTERRUPTED` | Video Ident call connection was interrupted. | | `CRIMINAL` | Applicant is involved in the illegal actions. | | `DB_DATA_MISMATCH` | Input data/doc does not match the data from the external database. | | `DB_DATA_NOT_FOUND` | Data not found in the external database. | | `DB_NO_DATA_SOURCE` | Input data is not supported by any enabled source. | | `DIGITAL_DOCUMENT` | Applicant uploaded a digital version of the document. | | `DOCUMENT_DAMAGED` | Document is damaged. | | `DOCUMENT_DEPRIVED` | Applicant has been deprived of the document. | | `DOCUMENT_MISSING` | Applicant refused to show or didn't have required documents during the Video Ident call. | | `DOCUMENT_PAGE_MISSING` | Some pages of a document are missing (if applicable). | | `DOCUMENT_TEMPLATE` | Submitted documents are templates downloaded from the internet. | | `DUPLICATE` | Applicant has multiple accounts while duplicates aren't allowed by the regulations. | | `EXPERIENCE_REQUIREMENT_MISMATCH` | Applicant doesn't have enough experience (e.g. driving experience is not enough). | | `EXPIRATION_DATE` | Applicant uploaded an expired document. | | `FOREIGNER` | Rejection label associated with the applicants from an unsupported country or e.g. without a residence permit. | | `FORGERY` | Forgery attempt was recognized. | | `FRAUDULENT_LIVENESS` | There was an attempt to bypass liveness check. | | `FRAUDULENT_PATTERNS` | There was fraudulent behavior detected during the verification. | | `FRONT_SIDE_MISSING` | Front side of the document is missing. | | `GRAPHIC_EDITOR` | Document has been edited by a graphical editor. | | `GPS_AS_POA_SKIPPED` | When GpsAsPoa was skipped and no image uploaded. | | `ID_INVALID` | Document that identifies a person (like a passport or an ID card) is not valid. | | `INCOMPATIBLE_LANGUAGE` | Document's translation is required. | | `INCOMPLETE_DOCUMENT` | Some information is missing from the document, or it's partially visible. | | `INCONSISTENT_PROFILE` | Data or documents of different persons were uploaded to one applicant. | | `INCORRECT_SOCIAL_NUMBER` | Incorrect TIN/SSN was provided to perform the check. | | `LOW_QUALITY` | Documents have low-quality that doesn't allow definitive decisions to be made. | | `MORE_DOCUMENTS_REQUIRED` | Additional documents are required to pass the check for applicant review. | | `NOT_ALL_CHECKS_COMPLETED` | Not all of the checks were completed. | | `NOT_DOCUMENT` | Submitted documents aren't relevant for the verification procedure. | | `OK` | Custom reject label. | | `OTHER` | There is some unclassified reason of rejection. | | `OUTDATED_DOCUMENT_VERSION` | Based on the publicly available state company register, not the most recent version was provided. | | `PEP` | Applicant belongs to the PEP category. | | `PROBLEMATIC_APPLICANT_DATA` | Applicant data doesn't match the data in their documents. | | `REGULATIONS_VIOLATIONS` | Some violations of the regulations were found. | | `REQUESTED_DATA_MISMATCH` | Provided information doesn't match with the data recognized from a document. | | `RESTRICTED_PERSON` | Person is found in a restricted list (e.g., prohibited from betting). | | `SANCTIONS` | Applicant was found on the sanction lists. | | `SCAM_VICTIM` | Applicant stopped the verification after a scam warning and is suspected to be a scam victim. | | `SCREENSHOTS` | Applicant uploaded screenshots. | | `SELFIE_MISMATCH` | Applicant's photo (profile image) doesn't match a photo on the provided documents. | | `SELFIE_WITH_PAYMENT` | Special selfie is required (e.g. selfie with a piece of paper and date on it). | | `SPAM` | Applicant was created by mistake or is just a spam user (irrelevant images were supplied). | | `STOLEN_DOCS` | Sumsub ID account owner reported unauthorized use of their documents and requested to stop the verification process. | | `SUSPICIOUS_PATTERNS` | An obsolete label. The applicant may have previously received a “Rejected” status in the dashboard due to patterns potentially implying a non-genuine verification attempt (e.g., signs of artificially altered data, third-party involvement, etc). | | `THIRD_PARTY_INVOLVED` | Video Ident user is trying to pass verification to transfer the account to a third party. | | `UNFILLED_ID` | Applicant uploaded the document without signatures and stamps. | | `UNSATISFACTORY_PHOTOS` | There were problems with the photos during verification, like poor quality or masked information. | | `UNSUITABLE_DOCUMENT` | Document either does not fit the required type or lacks obligatory elements, like seal, apostille, or notary certification. | | `UNSUITABLE_ENV` | Applicant is either not alone or nor visible during the Video Ident call. | | `UNSUPPORTED_LANGUAGE` | Video Ident user does not speak the language common to the operator. | | `WRONG_ADDRESS` | Address from the applicant's documents doesn't match the address entered by them manually. | | `WRONG_USER_REGION` | Applicant from a region/country which is not allowed to be registered. | # ipInfo Data about the IP address used. | Field | Type | Description | | ---------- | ------- | ------------------------------------------------------------------------------------- | | `ip` | String | IP address. | | `country` | String | Country code (ISO 3166-1 Alpha-3). | | `city` | String | City the IP address belongs to. | | `zipCode` | String | ZIP code. | | `lat` | Double | Returns a Double value representing the latitude of the position in decimal degrees. | | `lon` | Double | Returns a Double value representing the longitude of the position in decimal degrees. | | `asn` | Integer | Autonomous System Number. | | `asnOrg` | String | ASN organization. | | `riskyAsn` | Boolean | A value determining whether ASN is risky or not. | # coords Geographical coordinates. | Field | Type | Description | | ---------- | ------ | --------------------------------------------------------------------------------------------------------------- | | `lat` | Double | Returns a Double value representing the latitude of the position in decimal degrees. | | `lon` | Double | Returns a Double value representing the longitude of the position in decimal degrees. | | `accuracy` | Double | Returns a Double value representing the accuracy of the latitude and longitude properties, expressed in meters. | # applicant.riskLabels.email Risk labels applied to the email address. | Field | Description | | -------------------- | ------------------------------------------------------------------------------------------------------------- | | `mediumRisk` | Medium-risk email address. | | `highRisk` | High-risk email address. | | `disposable` | Temporary email address which is provided by a disposable email service and usually expires in a few minutes. | | `noWebRegistrations` | Email registration was not detected. | | `noWebsiteExists` | Email domain does not exist. | | `nonDeliverable` | Messages fail to be delivered to this email address. | | `invalidEmail` | Email address is invalid. | | `freshEmail` | Email address first seen date is recent, indicating a short digital footprint history. | | `plusAddressing` | Email address contains a plus symbol. | | `excessiveDots` | Email address contains excessive dots. | # applicant.riskLabels.phone Risk labels applied to the phone number. | Field | Description | | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- | | `mediumRisk` | Medium-risk phone number. | | `highRisk` | High-risk phone number. | | `virtual` | Virtual phone number that allows a user to make calls through the internet and is not associated with a physical location. | | `disposable` | Temporary phone number. | | `noWebRegistrations` | Phone number registration wasn't detected. | | `freshPhone` | Phone number first seen date is recent, indicating a short digital footprint history. | | `phoneCountryVsIpCountryMismatch` | Phone number country does not match the IP address country. | | `phoneCountryVsEmailDomainCountryMismatch` | Phone number country does not match the country of the email domain. | | `phoneCountryVsAddressCountryMismatch` | Phone number country does not match the country of the applicant's physical address. | | `phoneCountryVsApplicantCountryMismatch` | Phone number country does not match the applicant's country. | | `phoneCountryVsCompanyCountryMismatch` | Phone number country does not match the company country. | # applicant.riskLabels.device Risk labels applied to the device used. | Field | Description | | :----------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `vpnUsage` | VPN usage is detected. | | `torUsage` | TOR usage is detected. | | `highRiskIp` | High risk of used IP addresses. | | `multipleDevices` | Multiple devices were used. | | `multipleMobileDevices` | Multiple mobile devices were used. | | `lengthySession` | Session is too long. | | `failedSessionContinuation` | Session was interrupted. | | `distantIpLocations` | Login from different and distant IP addresses for a short time interval. | | `thirdPartyLinkAccess` | The verification link was fetched by a messaging app (for example, WhatsApp or Telegram) — a sign the link was shared through a chat rather than opened directly on the applicant's device. | | `riskySessionContinuation` | Session continued from a risky IP after the link could not be opened or accessed via messenger. | | `proxyUsage` | Detects whether proxy is used. Triggered when the applicant's IP check shows **Using proxy**. | | `hostingProviderUsage` | Detects whether hosting provider is used. Triggered when the IP check shows **Hosting or data center IP**. | | `relayUsage` | Detects whether relay is used. Triggered when the IP check shows **Using relay**. | | `mediumRiskIp` | Indicates medium risk IP addresses. Triggered when the IP check shows **Medium risk**. | | `mediumChanceResidentialProxy` | Indicates a medium chance that the IP address is a residential proxy.

Triggered when the IP check shows **Medium chance of residential proxy**. | | `highChanceResidentialProxy` | Indicates a high chance that the IP address is a residential proxy.

Triggered when the IP check shows **High chance of residential proxy**. | | `antiDetectBrowser` | Indicates the use of anti-detect browser tools (such as AdsPower, DolphinAnty, OctoBrowser, GoLogin) commonly used by fraudsters to mask or spoof device fingerprints for managing multiple accounts and bypassing device identification. | # applicant.riskLabels.deviceCheck Risk labels applied due to the device check. | Label | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------- | | `adblock` | Detects whether the advertisement blocking software is used. | | `badBot` | Indicates the bot is an automated tool that does not have legitimate uses and assumes fraudulent activity. | | `clonedApp` | Indicates the request is from a cloned version of the user's app. | | `developerTools` | Informs whether developer tools were manually opened in Chrome or Firefox browsers. | | `emulator` | Indicates the user's app is running from within an Android emulator instead of a physical device. | | `fridaTool` | Indicates the user's app is being tampered with using Frida. | | `goodBot` | Indicates the bot is a well-known web crawler or other search engine bot. | | `incognito` | Detects whether incognito or private modes are being used. | | `jailbroken` | Indicates the user's app is running on a jailbroken iOS device. | | `locationSpoofing` | Indicates the mobile device is trying to spoof its location. | | `mitmAttack` | Indicates the request from the user's app is intercepted and potentially modified. | | `privacySettingsMode` | Privacy settings that have the ability to randomize and obfuscate signal output are enabled. | | `factoryReset` | The device has been recently factory reset, which may be used to erase previous activity or bypass fraud detection. | | `rooted` | Indicates the user's app is running on a rooted Android device. | | `tampering` | Indicates the usage of an anti-detect browser or tampering with the browser's default behavior. | | `virtualMachine` | Detects whether the browser is running inside a virtualization software by examining the browser configuration. | # applicant.riskLabels.crossCheck Cross-check risk labels. | Field | Description | | ---------------------------------------------- | ---------------------------------------------------------------------------------------------- | | `diverseIdDocCountries` | ID documents issued in different countries. | | `manyAccountDuplicates` | Lots of the account duplicates are created. | | `accountsInManyServices` | The same account is registered in different services. | | `addressCountryVsIpCountryMismatch` | Physical address in the country mismatches the country IP address. | | `idDocCountryVsIpCountryMismatch` | ID document country mismatches the country IP address. | | `exifCountryVsIdDocCountryOrIpCountryMismatch` | The country detected by EXIF mismatches either the document country or the country IP address. | # applicant.riskLabels.selfie Selfie risk labels. | Field | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------- | | `asleep` | Person in the selfie is asleep. | | `estimatedAgeMismatch` | Estimated age mismatches the age in the documents. | | `virtualCameraPresent` | Virtual (software-based) camera that simulates a physical camera is detected. | | `manyAttempts` | There are numerous attempts of passing the selfie check. | | `sameFaceWithDifferentData` | There is the same face on the documents with different data. | | `thirdPartyInvolved` | There are signs that another person may be assisting or present during the selfie or Liveness capture process. | | `phone` | There are indications that a phone or similar device may be used during the selfie or Liveness capture process. | # applicant.riskLabels.aml AML risk labels. | Field | Description | | ---------------- | ----------------------------------------------------------------------------------- | | `pep` | Applicant belongs to the PEP (Politically Exposed Person) category. | | `sanctions` | Applicant was found in sanctions lists. | | `terrorism` | Applicant is suspected of terrorism. | | `crime` | Applicant is suspected of criminal activity. | | `adverseMedia` | Compromising published information related to the applicant was found in the media. | | `fitnessProbity` | Applicant does not comply with Fitness and Probity regime. | # applicant.riskLabels.person Risk labels applied to a person. | Field | Description | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | `famousPerson` | Applicant is supposedly a famous person. | | `strangeName` | Applicant has a strange name that does not seem to be a real one. | | `noPhoneNamesFromWebServices` | No phone names are found in web services. | | `phoneNameMismatchFromWebServices` | There is a name mismatch with the names associated with the phone number. | | `noEmailNamesFromWebServices` | No emails are found in web services. | | `emailNameMismatchFromWebServices` | There is a name mismatch with the names associated with the email address. | | `manyUniquePersonsLinkedToContactData` | Applicant's contact data (email or phone) is linked to multiple distinct, unrelated identities across the web. | # applicant.riskLabels.company Risk labels applied to a company. | Field | Description | | :----------------------------------- | :------------------------------------------------------------------------------------------------------------------ | | `companyAdditionalDataNotFound` | Additional company fields are absent in the database. | | `companyExcessiveAssociatedParties` | Redundant company officials were declared, so the provided information does not completely match the registry data. | | `companyDataMismatch` | Mismatch of additional company fields in the database. | | `companyDocumentMissesRequiredField` | Required company fields are absent in the document. | | `companyDocumentDataMismatch` | Mismatch of additional company fields in the document. | # applicant.assessment.scores | Field | Type | Description | | ------- | ------ | ---------------- | | `tag` | String | Applicant tag. | | `score` | Float | Applicant score. | # service.cryptoTxnInfo.crystal.signals Possible entity types associated with the transaction (for example, Darknet Service, Online Marketplace). | Field | Type | Description | | ----------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | | `atm` | Double | Cryptocurrency ATM operator. | | `childExploitation` | Double | Organization which operates via darknets and is suspected of child abuse and exploitation. | | `dark_market` | Double | Online marketplace which operates via darknets and is used for trading illegal products for cryptocurrency. | | `dark_service` | Double | Organization which operates via darknets and offers illegal services for cryptocurrency. | | `enforcementAction` | Double | The entity is subject to legal proceedings. Jurisdiction will be annotated as a subtype. | | `exchangeFraudulent` | Double | Exchange that was involved in illegal activity. | | `exchangeLicensed` | Double | Organization that is licensed to provide exchange services. | | `exchangeUnlicensed` | Double | Organization that is not licensed to provide exchange services. | | `illegalService` | Double | Resource offering illegal services or engaged in illegal activities. | | `liquidityPools` | Double | The smart contracts where tokens are locked for the purpose of providing liquidity. | | `marketplace` | Double | Entity offering legal services/trading goods for cryptocurrency. | | `miner` | Double | Organization which utilizes its computing power for mining cryptocurrency blocks. | | `mixer` | Double | Service for mixing funds from different sources to make tracing them back harder or almost impossible. It is mostly used for money laundering. | | `p2pExchangeLicensed` | Double | Organization that is licensed to provide P2P exchange services. | | `p2pExchangeUnlicensed` | Double | Organization that is not licensed to provide P2P exchange services. | | `payment` | Double | Service which acts as an intermediary between customers and the company which provides services for making a payment. | | `ransom` | Double | The extortioners demanding payment in the form of cryptocurrency | | `sanctions` | Double | Organization that is found in sanctions lists. | | `scam` | Double | Entities that have scammed their customers and taken possession of their cryptocurrency. | | `seizedAssets` | Double | In the crypto seized by the government, the default Risk Score is 0%. | | `stolenCoins` | Double | Entities which have taken possession of someone else’s cryptocurrency by hacking. | | `terrorismFinancing` | Double | Organization which operates via darknets and involved in terrorism financing with cryptocurrency. | | `trustedExchange` | Double | Exchange that is reliable and can be trusted. | | `wallet` | Double | Service for storage and making payments with cryptocurrency. | | `other` | Double | None of the specified entities above. It may include a subtype. | # matchedRuleNames, matchedRuleNamesByTag Matched unique rules data. | Field | Type | Description | | -------------- | --------------- | -------------------------------- | | `cnt` | int | Total quantity of matched rules. | | `distinctCnt` | int | Quantity of unique rules. | | `distinctVals` | List of Strings | List of unique rules. | # amounts Numerical fields counted in the specific interval. | Field | Type | Description | | ------ | ------ | ------------------------------------------ | | `cnt` | long | Quantity of transactions in the aggregate. | | `min` | Double | Minimum amount. | | `max` | Double | Maximum amount. | | `mean` | Double | Arithmetic mean amount. | | `sum` | Double | Sum of all transactions per interval. |