Loading the book.
Catalogue 2026.11
A rule publishes a new version when a threshold changes. Superseded versions stay in the catalogue so an old case can be reproduced. An indicator contributes points. It does not file a report.
Cash received for one conductor totalled CAD 10,000 or more in a single receipt or across a consecutive 24-hour window. This is a Large Cash Transaction Report observation. It is not, by itself, a ground for suspicion.
25 points · dedupe daily · window_hours 24 · threshold_cad 10000
International electronic funds transfers in one direction totalled CAD 10,000 or more in a single transfer or across 24 hours. Domestic wires are out of scope. This is an EFTR observation, not an indicator of suspicion.
25 points · dedupe daily · window_hours 24 · threshold_cad 10000
Two or more virtual-currency receipts related to the same conductor, beneficiary or third party totalled CAD 10,000 or more within a consecutive 24-hour window, or a single receipt reached the threshold. This is a reporting obligation, not by itself an indicator of suspicion.
25 points · dedupe daily
The customer, a beneficiary, a third party, or a travel-rule name on the transaction scores at or above the similarity line against the bundled fictional sanctions list. Token order and small spelling differences still match. This is not a legal designation.
55 points · dedupe daily · min_score 0.9
A party name scores at or above the similarity line against the bundled fictional politically-exposed-person list. A PEP match is a reason for enhanced review. It is not an indication that a report must be filed.
18 points · dedupe daily · min_score 0.9
A party name matches the bundled fictional terrorist-property sample. On a real listed-person match, a Terrorist Property Report would have to be considered for property in the reporting entity's possession or control. This sample hit does not create that duty and is not an STR indicator by itself.
30 points · dedupe daily · min_score 0.9
An international electronic funds transfer at or above CAD 1,000 does not carry the originator and beneficiary name, account, address, and beneficiary institution the travel rule expects. Domestic wires are out of scope. A gap is a record defect. It is not, by itself, suspicion.
40 points · dedupe daily · min_cad 1000 · required_fields originator_name/originator_account/originator_address/beneficiary_name/beneficiary_account/beneficiary_address/beneficiary_institution
A payment tagged with trade details has an invoice value that differs from the declared goods value by at least 25 percent, and the invoice is at least CAD 1,000. The pattern is the over- and under-invoicing form of trade-based laundering. It is an indicator, not a finding.
36 points · dedupe evidence · min_invoice_cad 1000 · min_discrepancy_ratio 0.25
A customer whose business is money services or remittance receives at least CAD 5,000 in cash and, within 24 hours, pays three or more distinct beneficiaries on a non-cash rail. Multiple third-party payouts are an MSB typology indicator.
44 points · dedupe daily · window_hours 24 · min_cash_cad 5000 · min_beneficiaries 3
Chips of at least CAD 3,000 are purchased and recorded gaming activity is at most 20 percent of that buy-in, and the value is redeemed to a third party or leaves by wire or virtual currency. Minimal play is a casino typology indicator, not a finding that the chips laundered funds.
44 points · dedupe evidence · min_chips_cad 3000 · max_play_ratio 0.2
Three or more cash receipts each stay under CAD 10,000 and at or above CAD 2,000, and together reach the threshold inside 48 hours. The pattern is an indicator that the amount may have been broken up. It is not proof of structuring, and a 24-hour total that itself crosses CAD 10,000 is also an LCTR under AML-FI-001.
22 points · dedupe daily · window_hours 48 · min_transactions 3 · min_single_cad 2000 · threshold_cad 10000
Three or more customers deliver cash below CAD 10,000 to the same beneficiary inside 24 hours, and the combined amount reaches the threshold. Each conductor may stay under the LCTR line. The pattern is the multi-party form of smurfing and is an indicator, not a finding of fact.
20 points · dedupe daily · window_hours 24 · min_customers 3 · threshold_cad 10000
Value arrives as cash or by electronic transfer and a substantial share leaves on a different rail — commonly virtual currency — within a few hours. Virtual-currency pass-through on a single rail remains AML-VC-003.
20 points · dedupe evidence · window_hours 6 · min_outflow_ratio 0.7 · min_cad 5000
Superseded by v2.1, which tightened the sender count from 8 to 5 after tuning against the Q1 alert population. Retained so that cases assessed before 2026-06-01 remain reproducible.
15 points · dedupe daily · window_minutes 60 · min_unique_senders 8 · min_transactions 8
Multiple incoming virtual-currency transfers from several distinct sending wallets within a short period.
18 points · dedupe daily · window_minutes 60 · min_unique_senders 5 · min_transactions 5
Value received is moved out again almost immediately, leaving little or no balance behind - consistent with the account being used as a conduit rather than for its stated purpose.
20 points · dedupe evidence · window_minutes 180 · min_outflow_ratio 0.8 · min_cad 2000
Superseded by v2.0. Retained so cases assessed before 2026-07-01 remain reproducible with the parameters that were in force.
18 points · dedupe daily · lookback_days 90 · min_multiple 5 · min_baseline_txns 5 · min_active_days 0 · min_window_cad 2000
Value received in the last 24 hours is a large multiple of the customer's average *active-day* volume. v1.0 compared against an all-days average, which is near zero for any low-frequency customer and made ordinary deposits look like 30x deviations; it alerted on roughly a third of the book. v2.0 also requires a minimum number of active days before the comparator is considered meaningful.
18 points · dedupe daily · lookback_days 90 · min_multiple 5 · min_baseline_txns 5 · min_active_days 3 · min_window_cad 5000
12 points · dedupe evidence · dormant_days 90 · min_cad 5000
Several receipts aggregate to a value approaching but not reaching the LVCTR threshold. Threshold proximity alone is not proof of structuring; it is one input within a holistic review.
18 points · dedupe daily · min_proximity 0.85 · min_transactions 3
Rolling 30-day received value materially exceeds the volume the customer declared at onboarding for their occupation or line of business.
14 points · dedupe daily · window_days 30 · min_multiple 3
15 points · dedupe daily · window_hours 24 · min_unique_senders 6
Value leaves the customer and returns through one or more intermediary addresses, with no apparent economic purpose.
20 points · dedupe evidence · window_hours 72 · max_hops 4
A sending or receiving counterparty address carries a high-risk classification from the configured blockchain-analytics source.
22 points · dedupe evidence · min_external_risk 70 · escalating_tags mixer/tumbler/darknet_market/sanctioned/ransomware/high_risk_exchange
The same external address transacts with more than one customer, which can indicate an undisclosed third party controlling the funds.
16 points · dedupe evidence · lookback_days 30 · min_customers 2
14 points · dedupe evidence · lookback_days 7 · min_customers 2
12 points · dedupe daily · window_hours 6 · min_distinct_assets 3
10 points · dedupe daily · window_hours 24 · new_wallet_age_days 7 · min_value_share 0.5 · min_window_cad 2000
Jurisdiction lists are deployment configuration. The placeholder list below is illustrative only and must be replaced with the reporting entity's own board-approved country-risk assessment.
12 points · dedupe evidence · jurisdictions KP/IR/MM/SY/AF