Expression attributes

Extend your transaction monitoring rules with expression attributes.

Expression attributes help you build complex rule conditions based on the received applicant data.

For example, you can create a rule that compares the applicant country extracted from the ID document with the country provided by the applicant or the country of the specified payment method, and so on.

Root variables

FieldType
txnObjectDerived data of the current transaction for which the entire related context is created. This data includes the previous score of the transaction, review result, tags assigned, and so on.
dataObjectTransaction-related data submitted to Sumsub by the user. This data includes such details as transaction identifier, date and time when the transaction was initiated on the user side, financial information, transaction participants, and so on.
aggregateObjectAggregated information about transactions based on certain criteria.
applicantObjectApplicant data of the current transaction participant registered in the Sumsub system as an applicant. This data is taken from the existing applicant profile and not related to a specific transaction.
poiObjectAn applicant's proof of identity.
poaObjectAn applicant's proof of address.
remitterObjectA party that sends a remittance.

beneficiaryObjectA party that receives benefits as a result of the transaction.

questionnairesMapThe Questionnaire item values are nested by questionnaire, section, and item id. E.g. questionnaire["myQuestionnaireId"]["mySectionId"]["myItemId"].
propsMap of StringsThe map of transaction-related custom metadata sent by a user.
preScoringContextObjectPrescoring context that helps to enrich the information about a transaction.
clientListsMapThe client lists based on key values.
currentScoreIntegerThe current score calculated in the rule matching process.
currentRuleObjectThe current rule to be processed and calculated.
settingsObjectThe settings related to KYT.

txn

The txn object includes the derived data of the current transaction for which the entire related context is created. This data includes the previous score of the transaction, review result, tags assigned, and so on.

FieldTypeDescription
externalUserIdStringA unique user ID on the client side.
clientIdStringA client ID in the Sumsub system.
scoreIntegerA transaction score.
reviewObjectA transaction review.
createdAtDateThe date and time (UTC) when a transaction was created in the Sumsub system.
scoringResultObjectAn overall scoring result.
tagsList of StringsThe transaction tags.
indIntegerThe Index of the current transaction is calculated in relation to the scoring transaction, which has an index value of 0. This field is used to configure a projection with a specific number of transactions. E.g. projection with last ten transactions.
travelRuleInfoObjectThe Travel rule information exchange data.

data

The data object is a transaction-related data submitted to Sumsub by the user. This data includes such details as transaction identifier, date and time when the transaction was initiated on the user side, financial information, transaction participants, and so on.

FieldTypeDescription
txnIdStringTransaction ID
txnDateDateThe date and time (UTC) when a transaction was initiated on the client side (format yyyy-MM-dd HH:mm:ss+XXXX , e.g. 2022-10-25 22:30:02+0000 ).
txnLocalDateLocalDateTimeA calculated value of the transaction creation date and time on the client side if the transaction timezone is provided.
applicantObjectIncludes the data of the financial transaction participant registered in the Sumsub system as an applicant. This data is submitted to Sumsub within the transaction and may differ from the relevant applicant profile.
counterpartyObjectIncludes the data related to the other party that participates in the financial transaction. This data is submitted to Sumsub within the transaction.
infoObjectTransaction-related financial information.
propsMap of stringsThe map of transaction-related custom metadata sent by a user.
gamblingBetInfoObjectThe data related to the gambling bet type transaction made by an applicant. It includes such information as a bet type, transaction amount, transaction currency code, and so on.
gamblingLimitChangeInfoObjectExplains changes in gambling limits for the applicant. For example, the amount of the total loss, gambling activity period, and so on.
gamblingBonusChangeInfoObjectExplains changes in a gambling bonus given to the applicant.
sourceKeyStringA source key assigned to the transaction.

aggregate

FieldTypeDescription
txnsMap of ObjectsThe transactions-related data aggregated and mapped by certain criteria (e.g. in , out, all, rejected, same beneficiary , etc.).
currencyCodesList of StringsUnique currency codes (USD, GBP, BTC, etc.) of all non-rejected transactions.

data.applicant

The data.applicant object includes the data of the financial transaction participant registered in the Sumsub system as an applicant. This data is submitted to Sumsub within the transaction and may differ from the relevant applicant profile.

FieldTypeDescription
externalUserIdStringA unique user ID on the client side.
fullNameStringThe applicant's full name.
addressObjectThe applicant's actual address (if provided).
typeEnumThe applicant's entity type: individual or company.
paymentMethodObjectA payment method used by an applicant.
paymentMethodExtractedInfoObjectPayment method information extracted from available data.
deviceObjectA device used by a counterparty to complete a transaction.
institutionInfoObjectInformation regarding the financial institution through which an applicant made a transaction.
institutionExtractedInfoObjectFinancial institution information extracted from available data. Stands for BIC country.

data.counterparty

The data.counterparty object includes the data related to the other party that participates in the financial transaction. This data is submitted to Sumsub within the transaction.

FieldTypeDescription
externalUserIdStringA unique user ID on the client side.
fullNameStringThe counterparty's full name.
addressObjectThe counterparty's actual address (if provided).
typeEnumThe counterparty's entity type: individual or company.
paymentMethodObjectA payment method used by a counterparty.
paymentMethodExtractedInfoObjectPayment method information extracted from available data.
deviceObjectA device used by a counterparty to complete a transaction.
institutionInfoObjectInformation regarding the financial institution through which a counterparty made a transaction.
institutionExtractedInfoObjectFinancial institution information extracted from available data. Stands for BIC country.

applicant

The applicant object includes the applicant data of the current transaction participant registered in the Sumsub system as an applicant. This data is taken from the existing applicant profile and not related to a specific transaction.

FieldTypeDescription
idStringAn applicant ID.
createdAtObjectThis field helps to build rules based on the applicant profiles' creation date. For example, to find the applicants with profiles created in past 90 days, and whose declared incoming or outgoing turnover has been exceeded.
fullNameStringThe applicant's full name.
countryStringThe applicant's country (ISO 3166-1 alpha-3).
infoObjectThe information extracted from an applicant's documents.
fixedInfoObjectThe basic information on an applicant provided to the Sumsub SDK/API.
reviewObjectAn applicant review.
sourceKeyStringA source key of an applicant.
derivativesObjectVarious information derived from an applicant.
metadataMap of StringsThe applicant's metadata.
riskLabelsObjectThe applicant risk labels.
TagsList of StringsThe applicant tags.
assessmentObjectThe applicant assessment.
emailStringThe applicant's email.
emailDomainStringThe applicant email's domain name.
phoneObjectIncludes the applicant's telephone data.

applicant.createdAt

FieldTypeDescription
timestampLongA Unix timestamp in milliseconds.
yyyymmddIntegerA numeric day in the YYYYMMDD format, e.g. {@literal 20230123}.
yearIntegerA year.
monthIntegerA month of the year (starts from 1).
dayOfMonthIntegerA day of the month (starts from 1).
ageInYearsIntegerTime delta in years between this date and now.
ageInDaysIntegerTime delta in days between this date and now.

poi

FieldTypeDescription
countryStringAn ID Document country (ISO 3166-1 alpha-3).
idDocTypeIdDocTypeAn ID Document type.
numberStringAn ID Document number.
additionalnumberStringAn ID Document additional number.
dobDateThe date of birth of a document's owner.
nationalityStringThe nationality of a document's owner.
placeOfBirthStringThe place of birth of a document's owner.
issuedDateDateThe date of a document's issue.
issueAuthorityStringAn authority that issued an ID document.
issueAuthorityCodeStringA unique code of the authority that issued an ID document.
validUntilDateThe validity date of an ID document.
firtsIssuedDateDateThe date of a document's first issue.
metadataMap of StringsThe metadata related to a Proof of Identity.
addressObjectThe address specified in an ID document.
nfcObjectThe NFC information on an ID document.

poa

FieldTypeDescription
countryStringAn ID Document country (ISO 3166-1 alpha-3).
idDocTypeIdDocTypeAn ID Document type.
numberStringAn ID Document number.
metadataMap of StringsThe metadata related to a Proof of Address.
addressObjectThe address specified in an ID document.

preScoringContext

FieldTypeDescription
cryptoTxnInfoObjectCryptotransaction-related information.
amlCaseReviewObjectThe AML case review result.
paymentDetailsReviewObjectThe payment details review result.

currentRule

FieldTypeDescription
nameStringA current short name of the rule.
idStringA current ID of the rule.
revisionIntegerA current version of the rule's revision.
titleStringA current full title of the rule.
scoreIntegerA score that can be assigned to a transaction by the current rule.
dryRunBooleanA value determining whether a rule should be applied in the Test mode.
tagsList of StringsTags that can be assigned to a transaction by the current rule if it is applied.
sourceKeysList of StringsA rule is only applied if the transaction has one of the listed source keys.

settings

FieldTypeDescription
createKycTransactionsBooleanA value determining whether a transaction is created when running the identity verification.
onHoldThresholdIntegerA threshold value of the transaction score above which the transaction is put on hold.
rejectThresholdIntegerA threshold value of the transaction score above which the transaction is rejected.
defaultCurrencyCodeStringA default currency code.
travelRuleSettingsObjectThe travel rule settings.

review

FieldTypeDescription
levelNameStringAn applicant level.
decisionObjectReview of the decision.
reviewAnswerObjectReview of the answer.
rejectLabelsList of ObjectsThe list of rejection labels.

paymentDetailsReview

Fiels
suspiciousPaymentDetailsBooleanDetects if there are risky words used in the transaction. True or False.

txn.scoringResult

FieldTypeDescription
scoreIntegerThe calculated score of a transaction.
dryScoreIntegerThe calculated Test score of the transaction which would be assigned by the rules applied in the Test mode.
matchedRulesList of ObjectsAll rules matched during the scoring session.
failedRulesList of ObjectAll rules that failed during the scoring session.
ruleCntIntegerA total number of the rules counted for a transaction.
dryRunRuleCntIntegerA total number of the rules in Test mode counted for a transaction.

txn.travelRuleInfo

FieldTypeDescription
protocolNameEnumThe name of the protocol used during the information exchange.
applicantObjectApplicant information used during the information exchange.
counterpartyObjectCounterparty information used during the information exchange.
statusEnumThe current information exchange state.
expiredAtDateIf the timer is set, the transaction will be re-scored after a certain period of time.
applicantVaspIdObjectIdStores information about the counterparty VASP institution.
counterpartyVaspIdObjectIdStores information about the counterparty VASP institution.

txn.travelRuleInfo.protocolName

ValueDescription
snsSumsub protocol.
gtrGlobal Travel Rule Protocol.
trpTravel Rule Protocol.
vbaVASP By Address.
fallbackFallback notification.

txn.travelRuleInfo.status

ValueDescription
counterpartyVaspNotReachableThe data couldn't be sent since the second side of the transaction was not reachable. The response from the counterparty hasn’t been received.
counterpartyVaspNotFoundThe second side of the transaction was not found.
awaitingCounterpartyThe second side of the transaction was found and the data was sent. The response from the counterparty is awaited.
onHoldThe second side of the transaction was found and the data was sent. The transaction has been interrupted on the second side.
expiredThe second side of the transaction was found and the data was sent. There was no response received from the counterparty on time.
unconfirmedOwnershipThe second side of the transaction was found and the data was sent. Wallet ownership has not been confirmed.
counterpartyUnconfirmedOwnershipThe second side of the transaction was found and the data was sent. The negative response on wallet ownership has been received.
counterpartyMismatchedDataThe data has been sent, compared and there is a mismatch between both data sets.
completedTransaction is completed.
cancelledThe counterparty was identified, and the data was sent. However, the counterparty decided to decline the transaction, be it by the rules or manually, and not to proceed with it.
finishedThe blockchain transaction ID has been updated in the completed transaction record. This status always follows the completed status.

data.info

FieldTypeDescription
fingerprintStringA transaction fingerprint.
typeStringThe type of transaction: card, account, crypto.
directionStringThe out (applicant sends to counterparty) or in (counterparty sends to applicant) direction.
amountDoubleThe amount of funds sent within transaction (in a currency used by an applicant). The round transaction amounts are detected: 10, 5000, 100000, and so on. For example, to detect transactions with 000 before the decimal point, use the following expression: "data.info.amount % 1000 equals 0".
currencyCodeStringA code of the currency in which the transaction was made.
amountInDefaultCurrencyDoubleA transaction amount in the default currency.
defaultCurrencyCodeStringA code of the default currency.
paymentDetailsStringA comment with the details of payment.

gamblingBetInfo

The gamblingBetInfo object includes the data related to the gambling bet type transaction made by an applicant.

FieldTypeDescription
amountDoubleThe amount of funds used in the bet in a currency used by an applicant.
currencyCodeStringA code of the currency in which the transaction was made (USD, BTC, and so on).
amountInDefaultCurrencyDoubleA transaction amount in the default currency.
defaultCurrencyCodeStringA code of the default currency.
statusStringThe current state of a bet (pending, completed, or any other configured in your system).
resolutionDateDateThe date on which the bet must actually be played. For example, a bet on horse racing that takes place on the specified date.
resultAmountDoubleThe amount of funds won or lost as a result of the bet.
resultAmountInDefaultCurrencyDoubleThe amount of the bet result in the default currency set on your side.
diffAmountDoubleThe difference between the actual bet amount and resultAmount. For example, you bet 100, you win 150 which is the result amount, so diffAmount is 50.
resultDiffAmountInDefaultCurrencyDoubleThe difference between the actual bet amount and resultAmount in the default currency set on your side.
betTypeStringType of betting by game areas, as they are sorted out on your side. For example, sports, casino, and so on.
gameTypeStringMore specific area, a subtype of betType. For example, football, dice_bet, and so on.
bonusIdStringA unique identifier of the bonus given to the user, if any.

gamblingLimitChangeInfo

The gamblingLimitChangeInfo object includes the data that explains changes in gambling limits for the applicant.

FieldTypeDescription
typeEnumA type of limits that gambling projects offer:

  • deposit — allows players to set a maximum amount of money they can deposit into their account over a specified time period.
  • loss — allows players to set a maximum amount of money they can lose while playing games over a specified time period.
  • wager — allows players to set a maximum amount of money they can bet on a single game or during a specified time period.
  • sessionTime — allows players to set a maximum amount of time they can spend playing games during a single session.
  • selfExclusion — allows players to voluntarily exclude themselves from playing games for a specified time or permanently.
revertedBooleanSets true if a previously assigned limit is reverted.
amountDoubleLimit size value if the limit type is deposit, loss, or wager.
currencyCodeStringA code of the currency in which the transaction was made (USD, BTC, and so on). Specified if the limit type is deposit, loss, or wager.
periodEnumValidity period of the established limit: daily, weekly, monthly.
amountInDefaultCurrencyDoubleLimit size value in the default currency set on your side. Specified if the limit type is deposit, loss, or wager.
resolutionDateDateThe date on which the specified limit expires.
sessionLimitInMinsIntegerUser session duration limit in minutes.

gamblingBonusChangeInfo

The gamblingBonusChangeInfo object includes the data that explains changes in a gambling bonus for the applicant.

FieldTypeDescription
bonusIdStringA unique identifier of the bonus given to a user.
amountDoubleThe amount of bonus given to a user.
maxBonusAmountDoubleThe maximum bonus amount a user can get if all conditions of the party issuing the bonus are met.
maxBetAmountDoubleThe maximum bet a user can make to get the bonus.
wagerRequirementDoubleThe total amount of bets a user must make to get the bonus.
statusEnumBonus status that can be either of the following:

  • activated — the bonus is active and bonus funds appear on a player's balance. Wager requirements are active.
  • canceled — the player refused to receive the bonus. While the bonus is canceled all bonus funds will be nulled.
  • expired — each bonus has two different dates. The first one is the time to activate, the second is the time to wager. Example: time to activate — 3 days since the bonus is issued, time to wager — 7 days since the bonus is issued. While any of these time frames are passed, the bonus changes its status to expired. All bonus funds will be nulled.
  • lost — the bonus has been lost. The player lost his balance (real + bonus).
  • finished — the player has fulfilled the wager requirements, and the bonus has turned to personal funds on the balance.
currencyCodeStringA code of the bonus currency (USD, BTC, and so on).

aggregate.txns

FieldTypeDescription
minutes1ObjectOne minute from the moment a transaction is made.
minutes3ObjectThree minutes from the moment a transaction is made.
hours1ObjectOne hour from the moment a transaction is made.
hours3ObjectThree hour from the moment a transaction is made.
days1ObjectOne day from the moment a transaction is made.
days2ObjectTwo days from the moment a transaction is made.
days3ObjectThree days from the moment a transaction is made.
day7ObjectSeven days from the moment a transaction is made.
days14ObjectFourteen days from the moment a transaction is made.
days30ObjectThirty days from the moment a transaction is made.
days90ObjectNinety days from the moment a transaction is made.
months1ObjectOne month from the moment a transaction is made.
months3ObjectThree months from the moment a transaction is made.
months12ObjectTwelve months from the moment a transaction is made.
currentCalendarMonthObjectA current calendar month related to the date when a transaction is made.
previousCalendarMonthObjectA previous calendar month related to the date when a transaction is made.
allTimeObjectAn overall period of time from the date when a transaction is made.

aggregate.byIp

FieldTypeDescription
minutes1ObjectOne minute from the moment a transaction is made by a certain IP address.
minutes3ObjectThree minutes from the moment a transaction is made by a certain IP address.
hours1ObjectOne hour from the moment a transaction is made by a certain IP address.
hours3ObjectThree hour from the moment a transaction is made by a certain IP address.
days1ObjectOne day from the moment a transaction is made by a certain IP address.
days2ObjectTwo days from the moment a transaction is made by a certain IP address.
days3ObjectThree days from the moment a transaction is made by a certain IP address.
day7ObjectSeven days from the moment a transaction is made by a certain IP address.
days14ObjectFourteen days from the moment a transaction is made by a certain IP address.
days30ObjectThirty days from the moment a transaction is made by a certain IP address.
days90ObjectNinety days from the moment a transaction is made by a certain IP address.
months1ObjectOne month from the moment a transaction is made by a certain IP address.
months3ObjectThree months from the moment a transaction is made by a certain IP address.
months12ObjectTwelve months from the moment a transaction is made by a certain IP address.
currentCalendarMonthObjectA current calendar month related to the date when a transaction is made by a certain IP address.
previousCalendarMonthObjectA previous calendar month related to the date when a transaction is made by a certain IP address.

address

FieldTypeDescription
countryStringA country code (ISO 3166-1 alpha-3).
formattedAddressStringAddress in an human-readable format.
stateStringA name of the state or region if applicable.
townStringTown if applicable.
streetStringStreet if applicable.

type

FieldDescription
individualAn individual applicant.
companyA company applicant.

paymentMethod

FieldTypeDescription
typeStringThe type of a payment method: a card, account, crypto.
fingerprintStringRepresentation of the account ID: an account number, wallet address number, etc. The value can be hashed to hide the real value.

device

FieldTypeDescription
ipInfoObjectThe data about used IP address.
userAgentStringA device user-agent.
sessionIdStringAn ID of the transaction session.
sessionAgeMsLongThe session lifetime in milliseconds.
acceptLangStringA language of the browser used by a transaction participant, e.g. en.
platformStringA device platform, e.g. Mobile Android.
coordsObjectGeographical coordinates.
addressObjectThe address related to a device.
fingerprintStringA device fingerprint.

institutionInfo, institutionExtractedInfo

The following table explains the attributes of the institutionInfo and institutionExtractedInfo objects:

  • institutionInfo — Information regarding the financial institution through which a participant made a transaction.
  • institutionExtractedInfo — Financial institution information extracted from available data.

For example, Sumsub can fill in the country code by the IBAN extracted from the applicant payment method, or by BIC from institutionInfo.

FieldTypeDescription
codeStringA transaction institution code, e.g. BIC.
nameStringA transaction institution name.
addressObjectA transaction institution address.
vaspObjectDirectory information about VASP (Virtual Asset Service Provider).

vasp

The following table explains the VASP (Virtual Asset Service Provider) directory information.

FieldTypeDescription
countriesStringThe list of all the registration countries for legal entities of the VASP.
regulationTypeEnumRepresents the type of regulation (authorized / temporaryExemption / unauthorized) for VASP (Virtual Asset Service Provider).
essentialChecksStatusEnumIndicates the Essential Checks (EC) status:

  • initiated — the VASP has just been added and is yet to complete any checks.
  • essentialChecksDone — the VASP for which Sumsub has only the information from blockchain analytics.
  • extendedEssentialChecksDone — Extended Essential Checks (EEC) have been passed.
  • rejected — the VASP is rejected due to a number of reasons.
dueDiligenceStausEnumIndicates the status of the Due Diligence process:

  • notStarted — the Due Diligence process has not been yet begun.
  • inProgress — the Due Diligence process is underway.
  • completed — the VASP has passed Due Diligence.
  • rejected — the VASP is rejected due to a number of reasons.

Note that a VASP with Due Diligence completed will have either essentialChecksDone or extendedEssentialChecksDone status as well.
riskScoreAnswerEnumData based on the vendor information about VASP type:

  • GREEN — if the VASP type is exchange_licensed
  • YELLOW — if the VASP type is exchange_unlicensed, payment, other, atm, p2p_exchange_unlicensed, marketplace, liquidity_pools, transparent, gambling.
  • ERROR — no data received from the provider.
  • RED — otherwise.
emailExistsBooleanThere is an email address on the VASP profile.
urlExistsBooleanThere is a website address on the VASP profile.
scoreDoubleThere is a score on the VASP profile based on EEC (Extended Essential Checks).

applicant.info, applicant.fixedInfo

The following table explains the attributes of the applicant.info and applicant.fixedInfo objects:

  • applicant.fixedInfo — Contains information submitted by the applicant via Web or MobileSDK or by you via this API method. Used to compare the data that you provide to us with that we extract from the applicant documents.
  • applicant.info — Contains information recognized and extracted from the applicant documents by Sumsub.
FieldTypeDescription
countryStringAn applicant country (ISO 3166-1 alpha-3).
firstnameStringAn applicant's first name.
firstnameEnStringAn applicant's transliterated first name.
middleNameStringAn applicant's middle name.
lastNameStringAn applicant's last name.
lastnameEnStringAn applicant's transliterated last name.
genderStringAn applicant's gender (M or F).
nationalityStringAn applicant's nationality (ISO 3166-1 alpha-3).
taxResidenceCountryStringTax Residence Country (ISO 3166-1 alpha-3).
ageStringAn applicant's age.
addressStringAn applicant's address.
companyInfoStringThe information about a company.
phoneObjectIncludes the applicant's telephone data.

applicant.phone, info.phone, fixedInfo.phone

The following table explains the details of the applicant phone number.

FieldTypeDescription
countryStringA country code (ISO 3166-1 alpha-3).
numberStringThe applicant's phone number.
In a rule, it is important to add only digits without any extra symbols. For example, either 0035736208235 or 35736208235, or just 36208235.

applicant.derivatives

FieldTypeDescription
estimatedAgeIntegerAn applicant's estimated age.

applicant.riskLabels

FieldTypeDescription
emailList of ObjectsEmail risk labels.
phoneList of ObjectsPhone risk labels.
deviceList of ObjectsDevice risk labels.
crossCheckList of ObjectsCross-check risk labels.
selfieList of ObjectsSelfie risk labels.
amlList of ObjectsAML risk labels.
personList of ObjectsPerson risk labels.
companyList of ObjectsCompany risk labels.

applicant.assessment

FieldTypeDescription
scopesMap of ObjectsThe applicant assessment scores by scope.

date

FieldTypeDescription
timestampLongA Unix timestamp in milliseconds.
yyyymmddintA numeric day in the YYYYMMDD format, e.g. 20230123.
yearintA year.
monthintA months of the year (start from 1).
dayOfMonthintA day of the month (start from 1).
ageInYearsintA time delta in years between this date and now.
ageInDaysintA time delta in days between this date and now.

poi.nfc

FieldTypeDescription
fullMrzStringA full MRZ.

preScoringContext.cryptoTxnInfo

FieldTypeDescription
.answerStringTransaction risk severity according to Chainalysis.
riskScoreDoubleA transaction risk score.
signalsObjectA set of the entity types the transaction may belong to. For example, Darknet Service , Gambling , Online Marketplace , etc.

preScoringContext.cryptoTxnInfo.chainalysis.alerts

FieldTypeDescription
riskScoreDoubleA transaction risk score.
redStringHigh and severe risk.
yellowStringMedium risk.
greenStringLow risk.
["alert name"]StringThis is the alert name triggered, for example, terrorist financing, sanctioned entities, and so on.

preScoringContext.cryptoTxnInfo.chainalysis.addressAlert

FieldTypeDescription
exposuresStringName of the cluster the transaction is related to. E.g. Direct, Indirect.
riskLevelDoubleIndicates the risk level of the address. GREEN, YELLOW, RED, UNKNOWN.
triggersDoubleCategory that is responsible for the alert being generated.
categoryStringClassification of the cluster the address belongs to. E.g. exchange.
nameStringName of the entity itself e.g. ChangeNOW.

preScoringContext.cryptoTxnInfo.chainalysis.alerts["alert name"]

FieldTypeDescription
alertsLevelStringThe level of severity classification. Itthat can be Red, Yellow, Green.
serviceStringThe name of the cluster the transaction is related to. For example, Binance, Duelbits.
categoryStringThis is the alert category. For exampler, Gambling, Exchange, Sanctioned Entity.
alertAmountUsdDoubleThe alert amount in USD terms.
alertAmountInDefaultCurrencyDoubleThe amount in the user's default currency settings.
exposureTypeStringThis can be either Direct, or Indirect.

settings.travelRuleSettings

FieldTypeDescription
confirmationTimeoutInSecsIntegerA timeout in seconds before the transaction gets the approved status.

decision

FieldDescription
approvedAn item (transaction, applicant, amlcase) was approved.
rejectedAn item (transaction, applicant, amlcase) was rejected.

reviewAnswer, answer

FieldDescription
IGNOREDA check was skipped.
GREENSuccessful result of the verification and/or check.
YELLOWThere are some warnings regarding the verification and/or check.
REDThe violations were found.
ERRORAn error occured.

rejectLabels

FieldDescription
FORGERYA forgery attempt was recognized.
CRIMINALAn applicant is involved in the illegal actions.
DOCUMENT_TEMPLATEThe submitted documents are templates downloaded from the internet.
DIGITAL_DOCUMENTThe applicant uploaded a digital version of the document.
LOW_QUALITYDocuments have low-quality that doesn't allow definitive decisions to be made.
SPAMAn applicant was created by mistake or is just a spam user (irrelevant images were supplied).
NOT_DOCUMENTThe submitted documents aren't relevant for the verification procedure.
SELFIE_MISMATCHAn applicant's photo (profile image) doesn't match a photo on the provided documents.
ID_INVALIDA document that identifies a person (like a passport or an ID card) is not valid.
DOCUMENT_DEPRIVEDAn applicant has been deprived of the document.
FOREIGNERA rejection label associated with the applicants from an unsupported country or e.g. without a residence permit.
DUPLICATEAn applicant has multiple accounts while duplicates aren't allowed by the regulations.
BAD_AVATARAn applicant's avatar doesn't meet the client's requirements.
WRONG_USER_REGIONAn applicant from a region/country which is not allowed to be registered.
INCOMPLETE_DOCUMENTSome information is missing from the document, or it's partially visible.
BLACKLISTThe User is blocklisted by Sumsub.
BLOCKLISTThe User is blocklisted by a client.
WRONG_ADDRESSThe address from the applicant's documents doesn't match the address entered by them manually.
OTHERThere is some unclassified reason of rejection.
UNSATISFACTORY_PHOTOSThere were problems with the photos during verification, like poor quality or masked information.
GRAPHIC_EDITORThe document has been edited by a graphical editor.
DOCUMENT_PAGE_MISSINGSome pages of a document are missing (if applicable).
DOCUMENT_DAMAGEDA document is damaged.
REGULATIONS_VIOLATIONSSome violations of the regulations were found.
INCONSISTENT_PROFILEData or documents of different persons were uploaded to one applicant.
PROBLEMATIC_APPLICANT_DATAApplicant data doesn't match the data in their documents.
ADDITIONAL_DOCUMENT_REQUIREDAdditional documents are required to pass the check.
AGE_REQUIREMENT_MISMATCHThe Age requirement is not met (e.g. can't rent a car to a person below 25yo).
REQUESTED_DATA_MISMATCHProvided information doesn't match with the data recognized from a document.
EXPERIENCE_REQUIREMENT_MISMATCHAn applicant doesn't have enough experience (e.g. driving experience is not enough).
COMPROMISED_PERSONSAn applicant doesn't correspond to Compromised Person Politics.
PEPAn applicant belongs to the PEP category.
ADVERSE_MEDIAAn applicant was found in the adverse media.
FRAUDULENT_PATTERNSThere was fraudulent behavior detected during the verification.
SANCTIONSAn applicant was found on the sanction lists.
NOT_ALL_CHECKS_COMPLETEDNot all of the checks were completed.
FRONT_SIDE_MISSINGA front side of the document is missing.
BACK_SIDE_MISSINGA back side of the document is missing.
SCREENSHOTSAn applicant uploaded screenshots.
BLACK_AND_WHITEAn applicant uploaded black and white photos of their documents.
INCOMPATIBLE_LANGUAGEA document's translation is required.
EXPIRATION_DATEAn applicant uploaded an expired document.
UNFILLED_IDAn applicant uploaded the document without signatures and stamps.
BAD_SELFIEAn applicant uploaded a selfie in poor quality.
BAD_VIDEO_SELFIEAn applicant uploaded a video selfie in poor quality.
BAD_FACE_MATCHINGA face check between a document and a selfie was failed.
BAD_PROOF_OF_IDENTITYAn applicant uploaded a poor quality ID document.
BAD_PROOF_OF_ADDRESSAn applicant uploaded a poor quality proof of address.
BAD_PROOF_OF_PAYMENTAn applicant uploaded a poor quality proof of payment.
SELFIE_WITH_PAYMENTA special selfie is required (e.g. selfie with a piece of paper and date on it).
FRAUDULENT_LIVENESSThere was an attempt to bypass liveness check.
OKA custom reject label.
COMPANY_NOT_DEFINED_STRUCTUREThe entity's control structure wasn't defined.
COMPANY_NOT_DEFINED_BENEFICIARIESThe entity's beneficial owners weren't identified and duly verified.
COMPANY_NOT_VALIDATED_BENEFICIARIESThe entity's beneficial owners weren't validated.
COMPANY_NOT_DEFINED_REPRESENTATIVESThe entity's representatives weren't defined.
COMPANY_NOT_VALIDATED_REPRESENTATIVESThe entity's representatives weren't validated.
APPLICANT_INTERRUPTED_INTERVIEWAn applicant refused to finish the interview during the Video Ident call.
DOCUMENT_MISSINGAn applicant refused to show or didn't have required documents during the Video Ident call.
UNSUITABLE_ENVAn applicant is either not alone or nor visible during the Video Ident call.
CONNACTION_INTERRUPTEDThe Video Ident call connection was interrupted.

aggregate.txns.minutes1

FieldTypeDescription
cntintQuantity of the aggregated transactions.
matchedRulesObjectAll unique rules matched in this interval.
amountsObjectNumerical fields counted in this interval.
currencyCodesObjectUnique codes (USD, GBP, BTC, etc.) of the currencies used for this interval.
deviceFingerprintsObjectDevice fingerprints involved within this interval.
ipCountriesObjectIP addresses of the countries involved within this interval.

aggregate.byIp.minutes1

FieldTypeDescription
cntintQuantity of the aggregated transactions.
externalUserIdsObjectUser IDs aggregated on the client side.

ipInfo

FieldTypeDescription
ipStringIP address.
countryCode2StringCountry code (ISO 3166-1 alpha-2).
countryCode3StringCountry code (ISO 3166-1 alpha-3).
cityStringCity the IP address belongs to.
zipCodeStringZIP code.
latDoubleReturns a Double value representing the latitude of the position in decimal degrees.
lonDoubleReturns a Double value representing the longitude of the position in decimal degrees.
asnIntegerAutonomous System Number.
asnOrgStringASN organisation.
riskyAsnBooleanA value determining whether ASN is risky or not.

coords

FieldTypeDescription
latDoubleReturns a Double value representing the latitude of the position in decimal degrees.
lonDoubleReturns a Double value representing the longitude of the position in decimal degrees.
accuracyDoubleReturns a Double value representing the accuracy of the latitude and longitude properties, expressed in meters.

applicant.info.companyInfo, applicant.fixedInfo.companyInfo

FieldTypeDescription
countryStringCountry where the company is legally registered (ISO 3166-1 alpha-3).
typeStringType of business the company conducts.

applicant.riskLabels.email

FieldDescription
mediumRiskMedium-risk email address.
highRiskHigh-risk email address.
disposableTemporary email address which is provided by a disposable email service and usually expires in a few minutes.
noWebRegistrationsEmail registration was not detected.
noWebsiteExistsEmail domain does not exist.
nonDeliverableMessages fail to be delivered to this email address.
invalidEmailEmail address is invalid.

applicant.riskLabels.phone

FieldDescription
mediumRiskMedium-risk phone number.
highRiskHigh-risk phone number.
virtualVirtual phone number that allows a user to make calls through the internet and is not associated with a physical location.
disposableTemporary phone number.
noWebRegistrationsPhone number registration wasn't detected.

applicant.riskLabels.device

FieldDescription
vpnUsageDetects whether VPN connection is used.
torUsageDetects whether TOR connection is used.
highRiskIpIndicates high risk IP addresses.
multipleDevicesInforms about using multiple devices.
multipleMobileDevicesInforms about using multiple mobile devices.
lengthySessionThe session lasts too long.
failedSessionContinuationThe session was interrupted.
distantIpLocationsLogin from different and distant IP addresses (> 100 km).

applicant.riskLabels.crossCheck

FieldDescription
diverseIdDocCountriesThe ID documents issued in different countries.
manyAccountDuplicatesLots of the account duplicates are created.
accountsInManyServicesThe same account is registered in different services.
addressCountryVsIpCountryMismatchPhysical address in the country mismatches the country IP address.
idDocCountryVsIpCountryMismatchID document country mismatches the country IP address.
exifCountryVsIdDocCountryOrIpCountryMismatchThe country detected by EXIF mismatches either the document country or the country IP address.

applicant.riskLabels.selfie

FieldDescription
asleepThe person in the selfie is asleep.
forcedThe person is coerced into verification.
multipleFacesMultiple faces are present.
estimatedAgeMismatchThe estimated age mismatches the age in the documents.
virtualCameraPresentVirtual (software-based) camera that simulates a physical camera is detected.
manyAttemptsThere are numerous attempts of passing the selfie check.
sameFaceWithDifferentDataThere is the same face on the documents with different data.

applicant.riskLabels.aml

FieldDescription
pepApplicant belongs to the PEP (Politically Exposed Person) category.
sanctionsApplicant was found in sanctions lists.
terrorismApplicant is suspected of terrorism.
crimeApplicant is suspected of criminal activity.
adverseMediaCompromising published information related to the applicant was found in the media.
fitnessProbityApplicant does not comply with Fitness and Probity regime.

applicant.riskLabels.person

FieldDescription
famousPersonApplicant is supposedly a famous person.
strangeNameApplicant has a strange name that does not seem to be a real one.
noPhoneNamesFromWebServicesNo phone names are found in web services.
phoneNameMismatchFromWebServicesThere is a name mismatch with the names associated with the phone number.
noEmailNamesFromWebServicesNo emails are found in web services.
emailNameMismatchFromWebServicesThere is a name mismatch with the names associated with the email address.

applicant.riskLabels.company

FieldDescription
companyAdditionalDataNotFoundCompany data wast not found in the database.
companyDataMismatchCompany data does not match the data in the database.

applicant.assessment.scopes

FieldTypeDescription
resultObjectA score without a source key.
sourceKeysMap of ObjectsScores by a source key.

preScoringContext.cryptoTxnInfo.signals

FieldTypeDescription
atmDoubleCryptocurrency ATM operator.
childExploitationDoubleOrganization which operates via darknets and is suspected of child abuse and exploitation.
dark_marketDoubleOnline marketplace which operates via darknets and is used for trading illegal products for cryptocurrency.
dark_serviceDoubleOrganization which operates via darknets and offers illegal services for cryptocurrency.
enforcementActionDoubleThe entity is subject to legal proceedings. Jurisdiction will be annotated as a subtype.
exchangeFraudulentDoubleExchange that was involved in illegal activity.
exchangeLicensedDoubleOrganization that is licensed to provide exchange services.
exchangeUnlicensedDoubleOrganization that is not licensed to provide exchange services.
gamblingDoubleOnline resource offering gambling services using cryptocurrency.
illegalServiceDoubleResource offering illegal services or engaged in illegal activities.
liquidityPoolsDoubleThe smart contracts where tokens are locked for the purpose of providing liquidity.
marketplaceDoubleEntity offering legal services/trading goods for cryptocurrency.
minerDoubleOrganization which utilizes its computing power for mining cryptocurrency blocks.
mixerDoubleService for mixing funds from different sources to make tracing them back harder or almost impossible. It is mostly used for money laundering.
p2pExchangeLicensedDoubleOrganization that is licensed to provide P2P exchange services.
p2pExchangeUnlicensedDoubleOrganization that is not licensed to provide P2P exchange services.
paymentDoubleService which acts as an intermediary between customers and the company which provides services for making a payment.
ransomDoubleThe extortioners demanding payment in the form of cryptocurrency
sanctionsDoubleOrganization that is found in sanctions lists.
scamDoubleEntities that have scammed their customers and taken possession of their cryptocurrency.
seizedAssetsDoubleIn the crypto seized by the government, the default Risk Score is 0%.
stolenCoinsDoubleEntities which have taken possession of someone else’s cryptocurrency by hacking.
terrorismFinancingDoubleOrganization which operates via darknets and involved in terrorism financing with cryptocurrency.
trustedExchangeDoubleExchange that is reliable and can be trusted.
walletDoubleService for storage and making payments with cryptocurrency.
otherDoubleNone of the specified entities above. It may include a subtype.

matchedRules

FieldTypeDescription
cntintA total quantity of matched rules.
distinctCntintThe unique rules quantity.
distinctValsList of StringsA list of the unique rules.

amounts

FieldTypeDescription
cntlongA quantity of transactions in the aggregate.
minDoubleA minimum amount.
maxDoubleA maximum amount.
meanDoubleAn arithmetic mean amount.
sumDoubleThe sum of all transactions per interval.

applicant.assessment.scopes.result, Elements of applicant.assessment.scopes.sourceKeys

FieldTypeDescription
scoreDoubleAn applicant score.
answerObjectAn answer calculated by the provided score with respect to the threshold from KYT settings.