Conditions reference

This page is a reference for every building block available when defining rule conditions and actions. For a guided walkthrough of the Rule Builder, see Building rules.

Condition logic

Conditions are organized into a tree of groups:

all (AND) — Every condition in the group must match.
any (OR) — At least one condition in the group must match.

At the top level, a rule can have multiple paths connected with OR logic. If any path matches, the rule triggers. Within each path, you nest all / any groups to express complex boolean logic.

{
  "any": [
    {
      "all": [
        {
          "entity": "transaction",
          "property": "amount",
          "operator": "greaterThan",
          "value": 50000
        },
        {
          "entity": "client",
          "property": "riskTier",
          "operator": "equal",
          "value": "HIGH"
        }
      ]
    },
    {
      "all": [
        {
          "entity": "transaction",
          "property": "amount",
          "operator": "greaterThan",
          "value": 100000
        }
      ]
    }
  ]
}

This rule triggers if the transaction amount exceeds $50,000 **and** the client is high-risk, **or** if the amount exceeds $100,000 regardless of risk tier.

Entities

Each condition targets one of five entities:

Entity	Key	Description
Transaction	`transaction`	The transaction being evaluated — amount, type, currency, status, timestamps.
Client	`client`	The customer associated with the transaction — risk tier, country, KYC status.
Wallet	`wallet`	Blockchain wallets involved in the transaction — address, chain, labels.
Bank account	`bankAccount`	Fiat bank accounts involved — account number, bank country, routing info.
Device	`device`	The device from the transaction’s linked session (or the client’s latest session) — custom fields ingested via session device fingerprinting.

Custom fields

Entities that support custom fields expose them as customFields.<key> properties (for example, customFields.deviceRiskScore on the Device entity). Values are set during ingestion — for devices, include device.customFields on session create. A custom field’s type is inferred from its ingested values, and the type determines which operators it supports:

Type	Operators
Number	`equal`, `notEqual`, `greaterThan`, `greaterThanInclusive`, `lessThan`, `lessThanInclusive`, `in`, `notIn`, `between`
String	`equal`, `notEqual`, `in`, `notIn`
Boolean	`equal`, `notEqual`

Custom fields cannot be used in aggregations. Newly ingested fields become available in the rule builder after a short sync delay.

Entity relationships

For non-transaction entities, you can specify which participant the condition applies to:

Relationship	Description
`all`	Matches if the condition is true for any participant (sender or receiver).
`sender`	Only evaluate the sending party.
`receiver`	Only evaluate the receiving party.

Custom-field conditions on participant entities (Client, Wallet, Bank account, Device) must set entityRelationship to sender or receiver — all is not supported.

Operators

Comparison operators

Operator	Description	Example
`equal`	Exact match	`amount` equal to `10000`
`notEqual`	Not equal	`status` not equal to `COMPLETED`
`greaterThan`	Strictly greater	`amount` greater than `50000`
`greaterThanInclusive`	Greater or equal	`amount` greater than or equal to `50000`
`lessThan`	Strictly less	`amount` less than `100`
`lessThanInclusive`	Less or equal	`amount` less than or equal to `1000`

Array operators

Operator	Description	Example
`in`	Value is in the list	`country` in `["US", "GB", "DE"]`
`notIn`	Value is not in the list	`type` not in `["INTERNAL_TRANSFER"]`
`contains`	Array field contains the item, or string field contains the substring	`tags` contains `"high-risk"`
`doesNotContain`	Array field does not contain the item, or string field does not contain the substring	`tags` does not contain `"whitelisted"`

String operators

Prefix and suffix checks on text facts (referenceId, txHash, memos, string custom fields) and enum-like strings. Matching is case-insensitive, same as string contains. Missing, null, or undefined facts do not match.

Operator	UI label	Description	Example
`startsWith`	Starts with	Field begins with the value	`referenceId` starts with `"dep-"`
`endsWith`	Ends with	Field ends with the value	`txHash` ends with `"beef"`

{ "entity": "transaction", "property": "referenceId", "operator": "startsWith", "value": "dep-" }

"DEP-abc" matches startsWith "dep-" because comparison is case-insensitive. "xdep-abc" does not — the value must be a prefix, not a substring in the middle (that is contains).

Range operator

Operator	Description	Example
`between`	Value falls within a range (inclusive)	`amount` between `[1000, 50000]`

between is advertised on numeric facts (for example amount, balances, numeric custom fields) and on dates. The value is a two-element array [min, max]. Both bounds are inclusive. Numeric aggregation results (sum, count, avg, …) also accept between. A range of two conditions (>= AND <=) still works.

{ "entity": "transaction", "property": "amount", "operator": "between", "value": [1000, 50000] }

Null-check operators

Null-check operators test whether a field is set at all. They take no value — the condition is just entity + property + operator. In the Rule Builder they appear as is empty / is set.

Operator	UI label	Matches
`isNull`	is empty	The field is missing, `null`, `undefined`, or an empty string `""`
`isNotNull`	is set	The field has any present value

Flag deposits from clients whose KYC tier was never set:

{ "entity": "client", "entityRelationship": "receiver", "property": "kycLevel", "operator": "isNull" }

Notes:

Only the exact empty string "" counts as empty. A whitespace-only string like " " is a present value.
0 and false are present values — they match isNotNull, never isNull.
Available on custom fields (customFields.<key>) of any scalar type, and on static facts that can actually be empty. Not available on array fields, aggregation results, or aggregation filters (a null check on an aggregation filter is rejected when the rule is saved).
is empty / is set refer to the evaluated fact, not to whether the field was sent in the API payload. Some facts are stored with a default when not provided, so they are never empty and do not offer these operators:
- KYC Status (stored as account status, defaults to ACTIVE) — use KYC Level to test whether a KYC tier was set.
- Activity Status (defaults to UNKNOWN) and client Risk Score (defaults to 0).
- Built-in yes/no flags such as Is PEP and Is Sanctioned (default to false) — use PEP Score / Adverse Media Score isNull to test whether screening has run.
- Date of Birth is evaluated as a date filter rather than a value — use Age isNull to test whether a date of birth is on record.
Facts that behave as expected include nullable fields (Onboarded At, KYC Level, PEP Score, Partner Client ID) and text fields stored as empty text when not provided (Occupation, Gender, Source of Funds).
A missing participant counts as empty. isNull on a sender or receiver field also matches when the transaction has no such participant — for example, “sender client occupation is empty” matches a deposit that has no sender client at all. To match only when the participant exists but the field is empty, combine it with a condition that requires the participant, such as isNotNull on another of its fields.
These operators do not change notEqual / notIn behaviour: a notEqual condition on a missing custom field still does not match. Use isNotNull + notEqual together when a rule must only fire when the field is present and different.

Aggregation operators

Aggregation conditions compute a value over a set of historical transactions before comparing with the operator and value. This enables velocity checks, cumulative thresholds, and statistical analysis.

Operator	Description
`sum`	Total of the aggregated property.
`count`	Number of matching transactions.
`avg`	Average value.
`min`	Minimum value.
`max`	Maximum value.
`median`	Median value.
`stddev`	Standard deviation.
`percentile`	Value at a given percentile (requires `aggregationPercentile` field).
`countDistinct`	Number of distinct values for the aggregated property.

Aggregation fields

When using an aggregation, provide these additional fields on the condition:

Field	Required	Description
`aggregationOperator`	Yes	One of the operators above.
`aggregationProperty`	Yes	The field to aggregate (e.g., `amount`, `convertedAmount`).
`aggregationTimeType`	Yes	The time window type (see below).
`aggregationTimeValue`	Conditional	The numeric value for the window (required for `in_the_last`, `after`, `before`).
`aggregationTimePeriod`	Conditional	The time unit (required when `aggregationTimeValue` is set).
`aggregationFilters`	No	Array of sub-conditions to narrow which transactions are aggregated.
`aggregationPercentile`	Conditional	The percentile target (required when operator is `percentile`).

Time windows

Time windows define the lookback period for aggregation conditions.

Time types

Type	Description
`all_time`	All historical transactions with no time boundary.
`in_the_last`	Rolling window from now minus the specified period.
`after`	Transactions after a point in time.
`before`	Transactions before a point in time.
`between`	Transactions within a date range.

Time periods

Used with aggregationTimeValue to define the window length:

Period	Example
`minutes`	Last 30 minutes
`hours`	Last 24 hours
`days`	Last 7 days
`weeks`	Last 2 weeks
`months`	Last 3 months
`years`	Last 1 year

Example: velocity check

“Count of deposits in the last 24 hours exceeds 10”:

{
  "entity": "transaction",
  "aggregationOperator": "count",
  "aggregationProperty": "id",
  "aggregationTimeType": "in_the_last",
  "aggregationTimeValue": 24,
  "aggregationTimePeriod": "hours",
  "aggregationFilters": [
    { "property": "type", "operator": "equal", "value": "DEPOSIT" }
  ],
  "operator": "greaterThan",
  "value": 10
}

Aggregation filters

Filters narrow which transactions are included in the aggregation. Each filter is a simple condition with property, operator, and value — the same comparison operators listed above apply. Common filter patterns:

Filter by transaction type: { "property": "type", "operator": "equal", "value": "WITHDRAW" }
Filter by currency: { "property": "currency", "operator": "in", "value": ["USD", "EUR"] }
Filter by direction: { "property": "direction", "operator": "equal", "value": "OUTGOING" }

Actions

Actions define what happens when a rule matches. Each rule must have at least one action.

`CREATE_ALERT`

Creates a compliance alert for analyst review.

Config field	Required	Description
`category`	Yes	Alert category. Use `TRANSACTION_MONITORING` for TM rules.
`priority`	Yes	`LOW`, `MEDIUM`, or `HIGH`.
`status`	Yes	Initial alert status. Typically `NEW`.
`subCategory`	No	Alert sub-category for finer classification.
`assigneeId`	No	Corsa user ID to auto-assign the alert to.
`dueDateHours`	No	Hours from alert creation to set as the due date (e.g., `48` for a two-day SLA).
`description`	No	Custom alert description. Defaults to an auto-generated summary (e.g., `"Rule triggered: LARGE_DEPOSIT"`) if omitted.

{
  "type": "CREATE_ALERT",
  "config": {
    "category": "TRANSACTION_MONITORING",
    "priority": "HIGH",
    "status": "NEW",
    "subCategory": "STRUCTURING",
    "assigneeId": "user-uuid-123",
    "dueDateHours": 48
  }
}

`HALT_TRANSACTION`

Freezes the transaction until an analyst resolves the associated alert. Always used alongside CREATE_ALERT.

{
  "type": "HALT_TRANSACTION",
  "config": {}
}

A rule with HALT_TRANSACTION blocks settlement on every match. Reserve this for high-confidence patterns where false positives are rare.

Common rule patterns

Large transaction detection

Alert when a single transaction exceeds a threshold:

{
  "all": [
    {
      "entity": "transaction",
      "property": "amount",
      "operator": "greaterThanInclusive",
      "value": 100000
    }
  ]
}

Velocity check (structuring detection)

Alert when a customer makes more than 5 deposits under $10,000 in 24 hours:

{
  "all": [
    {
      "entity": "transaction",
      "aggregationOperator": "count",
      "aggregationProperty": "id",
      "aggregationTimeType": "in_the_last",
      "aggregationTimeValue": 24,
      "aggregationTimePeriod": "hours",
      "aggregationFilters": [
        { "property": "type", "operator": "equal", "value": "DEPOSIT" },
        { "property": "amount", "operator": "lessThan", "value": 10000 }
      ],
      "operator": "greaterThan",
      "value": 5
    }
  ]
}

High-risk customer with large withdrawal

Combine entity conditions for targeted detection:

{
  "all": [
    {
      "entity": "client",
      "property": "riskTier",
      "operator": "equal",
      "value": "HIGH"
    },
    {
      "entity": "transaction",
      "property": "type",
      "operator": "equal",
      "value": "WITHDRAW"
    },
    {
      "entity": "transaction",
      "property": "amount",
      "operator": "greaterThanInclusive",
      "value": 50000
    }
  ]
}

Device custom field

Alert when the destination client’s device has a high risk score. Corsa uses the device from the session linked to the transaction, or from the client’s most recent session when none is linked:

{
  "all": [
    {
      "entity": "device",
      "entityRelationship": "receiver",
      "property": "customFields.deviceRiskScore",
      "operator": "greaterThanInclusive",
      "value": 80
    },
    {
      "entity": "transaction",
      "property": "type",
      "operator": "equal",
      "value": "DEPOSIT"
    }
  ]
}

Cumulative threshold

Alert when total outgoing volume exceeds $200,000 in 30 days:

{
  "all": [
    {
      "entity": "transaction",
      "aggregationOperator": "sum",
      "aggregationProperty": "amount",
      "aggregationTimeType": "in_the_last",
      "aggregationTimeValue": 30,
      "aggregationTimePeriod": "days",
      "aggregationFilters": [
        { "property": "direction", "operator": "equal", "value": "OUTGOING" }
      ],
      "operator": "greaterThanInclusive",
      "value": 200000
    }
  ]
}

Transaction Monitoring

API

Intelligence Hub

Condition logic

Entities

Custom fields

Entity relationships

Operators

Comparison operators

Array operators

String operators

Range operator

Null-check operators

Aggregation operators

Aggregation fields

Time windows

Time types

Time periods

Example: velocity check

Aggregation filters

Actions

`CREATE_ALERT`

`HALT_TRANSACTION`

Common rule patterns

Large transaction detection

Velocity check (structuring detection)

High-risk customer with large withdrawal

Device custom field

Cumulative threshold

​Condition logic

​Entities

​Custom fields

​Entity relationships

​Operators

​Comparison operators

​Array operators

​String operators

​Range operator

​Null-check operators

​Aggregation operators

​Aggregation fields

​Time windows

​Time types

​Time periods

​Example: velocity check

​Aggregation filters

​Actions

​CREATE_ALERT

​HALT_TRANSACTION

​Common rule patterns

​Large transaction detection

​Velocity check (structuring detection)

​High-risk customer with large withdrawal

​Device custom field

​Cumulative threshold

Condition logic

Entities

Custom fields

Entity relationships

Operators

Comparison operators

Array operators

String operators

Range operator

Null-check operators

Aggregation operators

Aggregation fields

Time windows

Time types

Time periods

Example: velocity check

Aggregation filters

Actions

`CREATE_ALERT`

`HALT_TRANSACTION`

Common rule patterns

Large transaction detection

Velocity check (structuring detection)

High-risk customer with large withdrawal

Device custom field

Cumulative threshold