Reference
Catalogue
Every check, event type, policy template and risk indicator the product carries, with its status
Get started with the catalogue
LISTcataloguewith status
20 checks9 flow templates9 event types98 templates6 packs11 indicators
What the product carries today, including what the console shows as Draft or “Coming soon”. Names are as the console shows them; keys are the words the code and the API use.
Status words
| Status | Means |
|---|---|
| Live | The engine runs it, and a policy on it decides. |
| Live (sandbox simulate) | A verification check that runs and is judged today, with its result supplied by the sandbox’s simulate. Live keys are refused until an engine is connected. |
| In the product, engine not live | Named in the product and shown as Draft or “Coming soon”; it judges nothing yet. Each group quotes the product’s own words for what is missing. |
| Accepted, read by no policy | An event type the doors accept and keep, which no template reads. |
Verification checks
A hosted program’s flow is made of steps, one check each. Every check today concludes through the sandbox simulate path: a live key creating a session answers 403 engine_not_connected, and no check names a provider (the console reads “No provider connected”). Each check is judged by the policy template bound to its step, listed under Customer & identity. A flow holding a Draft step cannot open a session: the create refuses it with “Step ‘<id>’ attaches no policy, so a verification through this flow would not be judged there.”
For the Draft checks, the product’s own words: “these judge nothing until one is turned on”; in the console, “The conditions this check reports are recorded and route nothing yet — a draft judges no session until it is placed in service.”
Person
| Check | What it checks | Status |
|---|---|---|
| ID Verificationid-verification | The document supplied is genuine, readable and internally consistent. | Live (sandbox simulate) |
| NFC Verificationnfc-verification | The chip in the document was read and signed by the issuing authority. Browsers cannot read NFC, so it never runs on the web. | Live (sandbox simulate) |
| Face Matchface-match | The face captured is the face on the document supplied. It must follow ID Verification and a liveness step; both liveness checks are Draft, so a flow holding it cannot open a session today. | Live (sandbox simulate) |
| Age Estimationage-estimation | The party’s face puts their age within what the account accepts, with an ID check where the estimate alone cannot carry the decision. | Live (sandbox simulate) |
| Proof of addressproof-of-address | A document in the party’s name shows the address they gave. | Live (sandbox simulate) |
| Document AIdocument-ai | Every field asked for is on the document supplied, which is not a standard identity document. | Live (sandbox simulate) |
| Email Verificationemail-verification | The party controls the email address they gave. | Live (sandbox simulate) |
| Device & IP Analysisdevice-ip-analysis | The device and network the session came from carry no fraud signals. | Live (sandbox simulate) |
| Livenessliveness | A live person was present for the capture, not a photo, screen, mask or replay. | In the product, engine not live |
| Livenessliveness-biometric | The same check under Biometric Authentication’s own step. | In the product, engine not live |
| Face Matchface-match-biometric | The same check, compared against a face verified earlier. | In the product, engine not live |
| Questionnairequestionnaire | The party answered the questions this account asks. The console adds: “The builder is not built yet.” | In the product, engine not live |
| Phone Verificationphone-verification | The party controls the phone number they gave. | In the product, engine not live |
| Database Validationdatabase-validation | The details given match an official record held by a government or credit database. | In the product, engine not live |
| AML Screeningaml-screening | The party does not appear on the sanctions, PEP or watchlists this account screens against. Needs a full name and date of birth. | In the product, engine not live |
Business
| Check | What it checks | Status |
|---|---|---|
| KYB Registry Checkkyb-registry | The company exists on the register, is active, and its stated details match; VAT is validated. | Live (sandbox simulate) |
| KYB Key Peoplekyb-key-people | Every owner and officer the register names has been identified, and those who must verify have. | Live (sandbox simulate) |
| KYB Documentskyb-documents | The incorporation and ownership documents asked for are on file and readable. | Live (sandbox simulate) |
| Document AIdocument-ai-business | Every field asked for is on the document supplied, matched against the company name. | Live (sandbox simulate) |
| Company AML Screeningkyb-company-aml | The company does not appear on the lists this account screens against. | In the product, engine not live |
Flow templates
A hosted program starts from one of nine templates, then its flow is edited in the designer. A template whose default steps include a Draft check cannot open a session until those steps are removed.
| Template | Default steps | Opens a session from its defaults |
|---|---|---|
| KYC Verificationkyc | id-verification, nfc-verification, liveness, face-match, document-ai, aml-screening | No: remove liveness, face-match and aml-screening |
| KYB Verificationkyb | kyb-registry, kyb-company-aml, kyb-key-people | No: remove kyb-company-aml |
| Biometric Authenticationbiometric | liveness-biometric (required), face-match-biometric, device-ip-analysis | No: its required step is Draft |
| Address Verificationaddress | proof-of-address (required) | Yes, in the sandbox |
| Age Assuranceage | age-estimation (required), id-verification | Yes, in the sandbox |
| Questionnaire Verificationquestionnaire | questionnaire (required) | No: its required step is Draft |
| Email Verificationemail | email-verification (required) | Yes, in the sandbox |
| Phone Verificationphone | phone-verification (required) | No: its required step is Draft |
| Start blankblank | None | Yes, once Live steps are added |
Program areas
| Area | What it runs |
|---|---|
| Identity verificationhosted | “People walk a flow Hira hosts — consent, document, face and checks.” One hosted flow, from a template above; its policies come from its steps. Verification sessions open on it. |
| Transaction monitoringsubscribed | “Judges activity already flowing in — chain ingestion, events sent with track() and recorded transactions.” Subscribes to streams: each source app with any of the nine event types below, and the built-in Chain source with an enabled chain (ethereum, bitcoin, polygon, arbitrum, optimism, base, bnb, avalanche, solana). With no stream the program reads “Manual entry”. |
Transaction event types
The nine types POST /v1/events and POST /v1/check accept, and the Live templates that read each. A policy sees an event only when its program subscribes to that type’s stream. identity.check.result is retired from both doors; verification steps are recorded by Hira’s hosted page.
| Type | Read by | Status |
|---|---|---|
| mint | Unauthorised Mint, Sanctions Screening, High-Risk Entity Exposure, New Counterparty, High-Value Outbound Review (new destination and sanctions rules); the recorded side of Reconciliation Gap. | Live |
| burn | Unauthorised Mint, Large Outflow, Velocity Breach, Cumulative Daily Outflow, High-Value Outbound Review (value and 24h rules). | Live |
| transfer | Large Outflow, Sanctions Screening, High-Risk Entity Exposure, New Counterparty, Allowlist-Only Counterparties, Velocity Breach, Cumulative Daily Outflow, High-Value Outbound Review. | Live |
| payout | The same templates as transfer. | Live |
| redemption | Large Outflow, Sanctions Screening, High-Risk Entity Exposure, New Counterparty, Velocity Breach, Cumulative Daily Outflow, High-Value Outbound Review; never Allowlist-Only Counterparties. | Live |
| reserve.snapshot | Reserve Ratio. | Live |
| admin.action | Privileged Action, on pause, blacklist, upgrade, roleGrant and mintAuthChange. | Live |
| reserve.movement | None. | Accepted, read by no policy |
| kyc.updated | None. | Accepted, read by no policy |
| Chain transfersChain source | Large Outflow, Large Inflow, Dormant Wallet Reactivation, Velocity Breach, Cumulative Daily Outflow, New Counterparty, Sanctions Screening, High-Risk Entity Exposure, Allowlist-Only Counterparties (outbound), High-Value Outbound Review, Counterparty Structuring. Inbound mints from the zero address feed Reconciliation Gap; holdings on subscribed chains feed Asset Concentration and Stablecoin Depeg. | Live |
Packs
A program is created from packs, and each template it takes becomes one of its policies. The wizard lists Available packs; inside one, a Draft template shows “Coming soon” with “Not available yet — no measure is wired behind this policy.” For the 61 Draft templates with no rules, the product’s own words: “the concern is named and the rules are not written”. Money limits default to AUD; a rule with no route set routes to No action.
| Pack | Pack status | Templates |
|---|---|---|
| Transaction Monitoring | Available | 21: 9 Live, 12 engine not live. |
| Sanctions Screening | Available | 11: 3 Live, 8 engine not live. |
| Concern bundles | Available | 19: 6 Live, 13 engine not live. |
| Customer & identity | Draft | 31: the 12 Live check templates and New Counterparty, 18 engine not live. Not listed in the wizard; its check templates attach through a hosted flow’s steps. |
| Travel rule | Draft | 6, all engine not live. |
| Fraud | Draft | 12, all engine not live. |
New Counterparty and Allowlist-Only Counterparties each sit in two packs; 98 templates in all.
Transaction Monitoring
| Template | Does and reads | Parameters (defaults) | Status |
|---|---|---|---|
| Large Outflowlarge_outflow | Flags unusually large outbound transfers: outbound chain transfers, and recorded events going out. | threshold on amount_usd, AUD, at or above: soft 100,000, hard 500,000 | Live |
| Large Inflowlarge_inflow | Flags unusually large inbound transfers; inbound chain transfers only. | threshold on inflow_usd, AUD: soft 100,000, hard 500,000 | Live |
| New Counterpartynew_counterparty | Flags a counterparty not seen before, in either direction. Also in Customer & identity. | binary first_seen_counterparty, Soft breach, scope program | Live |
| Allowlist-Only Counterpartiescounterparty_allowlist | Flags an outbound transfer or payout to a destination not on the approved list. Also in Sanctions Screening. | binary counterparty_allowlist, Hard breach, outbound | Live |
| Velocity Breachvelocity_breach | Flags unusually frequent outbound transactions. | velocity, count over 60 minutes: soft 10, hard 25; outbound unless set | Live |
| Cumulative Daily Outflow (per wallet)cumulative_outflow | Flags a wallet whose 24-hour outbound total passes a limit. | velocity, sum over 1,440 minutes, AUD: soft 500,000, hard 1,000,000 | Live |
| Dormant Wallet Reactivationdormant_reactivation | Flags a wallet active again after a long dormancy; chain transfers only. | threshold on dormancy_days: soft 30, hard 90 days | Live |
| High-Value Outbound Reviewhigh_value_outbound_review | Judges single value, 24-hour total, new destination and sanctions together on one outbound transfer. | four rules: value 100,000 / 500,000 AUD routed In review; 24h sum 500,000 / 1,000,000 AUD routed In review; new destination, Soft breach; sanctions list, Hard breach routed Decline (Final) | Live |
| Counterparty Structuringcounterparty_structuring | Flags repeated sizeable outbound transfers to one counterparty within an hour; chain transfers only. | measure: count of outbound transfers over 10,000 per counterparty in 60 minutes: soft 3, hard 5 | Live |
| Structuringstructuring_pattern | Repeated movements deliberately under a reporting threshold. | None written | In the product, engine not live |
| Unusual Activityunusual_activity | Behaviour outside the party’s own pattern. | None written | In the product, engine not live |
| Pass-Throughpass_through | Value in and fully out in a short window. | None written | In the product, engine not live |
| Round-Amount Clusteringround_amount_clustering | Repeated suspiciously round values. | None written | In the product, engine not live |
| Rapid In-and-Outrapid_in_out | Hold time below a floor across many movements. | None written | In the product, engine not live |
| Counterparty Monitoringcounterparty_monitoring | Concentration and repetition against one party. | None written | In the product, engine not live |
| Layering Detectionlayering_detection | Multi-hop chains designed to obscure origin. | None written | In the product, engine not live |
| Fan-In / Fan-Outfan_in_fan_out | Many-to-one, then one-to-many, over a short period. | None written | In the product, engine not live |
| Mule Network Detectionmule_network | Accounts behaving as a coordinated group. | None written | In the product, engine not live |
| Circular Flowcircular_flow | Value returning to origin through intermediaries. | None written | In the product, engine not live |
| Suspicious Mattersuspicious_matter_report | The disposition that produces a regulatory report. | None written | In the product, engine not live |
| Threshold Transaction Reportthreshold_transaction_report | Automatic capture of movements meeting a statutory reporting floor. | None written | In the product, engine not live |
Sanctions Screening
The lists are the ones the account maintains; no external sanctions or watchlist source is connected.
| Template | Does and reads | Parameters (defaults) | Status |
|---|---|---|---|
| Sanctions Screeningsanctions_screening | Matches the counterparty of chain transfers and of recorded events against the account’s sanctions list. | list_match, exact match Hard breach routed Decline (Final); the route can change to In review only | Live |
| High-Risk Entity Exposurewatchlist_proximity | The same, against the high_risk_entities list. | list_match, exact match Hard breach | Live |
| Allowlist-Only Counterpartiescounterparty_allowlist | As under Transaction Monitoring. | As above | Live |
| PEP Screeningpep_screening | Politically exposed persons, associates and family. | None written | In the product, engine not live |
| Adverse Mediaadverse_media | Negative news matched to the party, with relevance scoring. | None written | In the product, engine not live |
| Internal Deny & Allow Listsinternal_lists | The account’s own blocked and pre-approved parties, versioned. | None written | In the product, engine not live |
| Wallet Screeningwallet_screening | Address checked against designated and attributed wallets before transacting. | None written | In the product, engine not live |
| Mixer & Bridge Exposuremixer_bridge_exposure | Funds traced through a mixer or high-risk bridge. | None written | In the product, engine not live |
| List-Change Rescreenlist_change_rescreen | A list update re-screens the whole book. | None written | In the product, engine not live |
| Designation Provenancedesignation_provenance | Effective date against record date, so a backdated listing is not read as clean. | None written | In the product, engine not live |
| Fuzzy Name Matching Thresholdsfuzzy_match_threshold | Match-confidence bands with a review lane for the middle. | None written | In the product, engine not live |
Concern bundles
For the 13 bundle templates, the product’s own words: they are drafts “because the grouping mechanism itself is not built”.
| Template | Does and reads | Parameters (defaults) | Status |
|---|---|---|---|
| Asset Concentrationasset_concentration | Flags one asset passing a share of monitored holdings, at most once per asset per day; a holdings sweep every 60 seconds over wallets on subscribed chains. | ratio, asset value ÷ monitored holdings: soft 0.25, hard 0.40 | Live |
| Stablecoin Depegstablecoin_depeg | Flags a held stablecoin drifting from its $1 peg; the same holdings sweep. | threshold on peg_deviation: soft 0.005, hard 0.02 | Live |
| Reserve Ratioreserve_ratio | Flags circulating supply exceeding attested reserves, on each reserve.snapshot. | ratio, circulating supply ÷ reserve balance: soft 0.98, hard 1.00 | Live |
| Unauthorised Mintunauthorized_mint | Flags a mint or burn signed by a key not on the approved-minters list. | binary, Hard breach | Live |
| Privileged Actionprivileged_action | Flags pause, blacklist, upgrade, role grant or mint-authority change sent as admin.action. | binary, Soft breach | Live |
| Reconciliation Gapreconciliation_gap | Flags an onchain mint with no recorded mint of the same transaction hash; a sweep every 90 seconds. | binary, Hard breach | Live |
| Structuring & Splittingbundle_structuring | Staying under a threshold, for one party or across counterparties. | None written | In the product, engine not live |
| Layering & Obfuscationbundle_layering | Multi-hop chains, circular flow, mixer and bridge exposure. | None written | In the product, engine not live |
| Pass-Through & Conduitbundle_pass_through | Value in and fully out; the account holds nothing. | None written | In the product, engine not live |
| Prohibited Counterpartybundle_prohibited_party | Sanctions, designated wallets, deny lists, jurisdiction blocks. | None written | In the product, engine not live |
| Concentrationbundle_concentration | Too much in one wallet, chain, asset, issuer or counterparty. | None written | In the product, engine not live |
| Corridor & Jurisdictionbundle_corridor | Where value may go, and on what terms. | None written | In the product, engine not live |
| Authorisation Integritybundle_authorisation | Whether the actor or key had the right to act. | None written | In the product, engine not live |
| Instruction Versus Outcomebundle_instruction | Intended against settled: reconciliation, settlement, redemption. | None written | In the product, engine not live |
| Backing & Coveragebundle_backing | Reserves against supply, float against obligations, liquidity against outflows. | None written | In the product, engine not live |
| Data Completenessbundle_data_completeness | Required fields present before value moves. | None written | In the product, engine not live |
| Behaviour Changebundle_behaviour_change | Dormancy, reactivation, velocity shift, off-pattern activity. | None written | In the product, engine not live |
| Account Compromisebundle_account_compromise | Device, session or location change before a movement. | None written | In the product, engine not live |
| Price & Peg Instabilitybundle_price_peg | Depeg, NAV deviation, oracle divergence, volatility bands. | None written | In the product, engine not live |
Customer & identity
The pack is Draft and is not listed in the wizard. Its check templates are bound to a verification step and attach when that step is placed in a hosted flow; each rule records a condition and routes it to No action, In review or Decline (Final). Identity rules fail closed. New Counterparty also sits here.
| Template | Step and conditions (default route) | Status |
|---|---|---|
| Document Verificationdocument_verification | id-verification. In review: MRZ not valid, inconsistent data, invalid validation, number format mismatch, expected details mismatch. Scores below soft / hard: portrait replacement 71 / 35, printed copy 78 / 35, screen capture 71 / 30 (In review / Decline). Recorded only: duplicated users, QR or barcode, expiration date, address not processed, name match. | Live (sandbox simulate) |
| NFC Chip Verificationnfc_chip_verification | nfc-verification. In review: chip not verified. | Live (sandbox simulate) |
| Face Matchface_match | face-match. In review: match not computed. Face comparison score below 61 / 23 (In review / Decline). | Live (sandbox simulate) |
| Age Estimationage_estimation | age-estimation. Liveness score below 61 / 30 (In review / Decline). In review: duplicated face with a different name. Recorded only: duplicated face, multiple faces. | Live (sandbox simulate) |
| Proof of Addressproof_of_address | proof-of-address. Decline (Final): unsupported type, unsupported language. In review: exceeded attempts, details mismatch, poor quality, manipulation, issuer not identified, issue date not detected, address not processed. Recorded only: name match. | Live (sandbox simulate) |
| Document AIdocument_ai | document-ai. Decline (Final): tampering. In review: unreadable, missing fields, unsupported file, exceeded attempts. Recorded only: name mismatch, name match. | Live (sandbox simulate) |
| Business Document AIbusiness_document_ai | document-ai-business. Decline (Final): tampering. In review: unreadable, missing fields, unsupported file, exceeded attempts. Recorded only: company name mismatch, company name match. | Live (sandbox simulate) |
| Email Verificationemail_verification | email-verification. Recorded only: breached, disposable or duplicated email. | Live (sandbox simulate) |
| Device and IP Analysisdevice_ip_analysis | device-ip-analysis. Recorded only: IP mismatch, privacy tools, expected IP mismatch, duplicated IP, duplicated device, recovered device, multiple devices. | Live (sandbox simulate) |
| KYB Registry Checkkyb_registry | kyb-registry. In review: VAT invalid. Recorded only: VAT not validated. | Live (sandbox simulate) |
| KYB Key Peoplekyb_key_people | kyb-key-people. In review: people document mismatch. | Live (sandbox simulate) |
| KYB Documentskyb_documents | kyb-documents. Decline (Final): tampering, critical mismatch. In review: non-critical mismatch, too old, attempts exceeded. | Live (sandbox simulate) |
| Livenessliveness_detection | liveness. Liveness score below 61 / 30; liveness not determined. | In the product, engine not live |
| Biometric Livenessliveness_biometric | liveness-biometric. As Liveness. | In the product, engine not live |
| Biometric Face Matchface_match_biometric | face-match-biometric. As Face Match. | In the product, engine not live |
| Questionnairequestionnaire | questionnaire. Not completed. | In the product, engine not live |
| Phone Verificationphone_verification | phone-verification. Code not confirmed, code not delivered. | In the product, engine not live |
| Database Validationdatabase_validation | database-validation. No record found, details mismatch, source unavailable. | In the product, engine not live |
| AML Screeningaml_screening | aml-screening. Risk score and match score against sanctions, watchlist and PEP lists. | In the product, engine not live |
| Company AML Screeningkyb_company_aml | kyb-company-aml. As AML Screening, for the company. | In the product, engine not live |
| Liveness & Face Matchliveness_face_match | Presentation-attack detection on the selfie. | In the product, engine not live |
| Government Register Matchregister_match | Document validity against an authoritative source. | In the product, engine not live |
| Source of Wealth & Fundssource_of_wealth | Declared origin, evidence and plausibility against observed activity. | In the product, engine not live |
| Age & Jurisdiction Eligibilityage_jurisdiction | Minimum age and prohibited-jurisdiction blocks. | In the product, engine not live |
| Directors & Officerskyb_directors | Named officers verified individually against the register. | In the product, engine not live |
| Beneficial Ownershipkyb_beneficial_owners | Ownership chain to 25%, with a reasonable-steps record when it cannot be established. | In the product, engine not live |
| Authority to Actkyb_authority_to_act | The representative signing up holds delegated authority. | In the product, engine not live |
| Customer Risk Ratingcustomer_risk_rating | A rating that moves with behaviour, recalculated on material events. | In the product, engine not live |
| Periodic Re-verificationperiodic_reverification | Refresh cadence by risk band (12, 24 or 36 months). | In the product, engine not live |
| Document Expiry Watchdocument_expiry_watch | An expiring or expired document triggers re-collection. | In the product, engine not live |
Travel rule
| Template | Does | Status |
|---|---|---|
| Travel Rule Compliancetravel_rule_compliance | Required payer and payee fields present on qualifying transfers. | In the product, engine not live |
| Missing Originator Datamissing_originator | Above-threshold transfer with no originator details. | In the product, engine not live |
| Missing Beneficiary Datamissing_beneficiary | The receiving side of the same obligation. | In the product, engine not live |
| Threshold Applicabilitytravel_rule_threshold | Which transfers qualify, by jurisdiction and value. | In the product, engine not live |
| Unhosted Wallet Transfersunhosted_wallet_transfer | Self-hosted destinations flagged for enhanced treatment. | In the product, engine not live |
| Counterparty VASP Due Diligencevasp_due_diligence | Whether the receiving institution is registered and in a permitted jurisdiction. | In the product, engine not live |
Fraud
The product’s own words: fraud is “a signals business — none of it runs on movements alone”.
| Template | Does | Status |
|---|---|---|
| Account Takeoveraccount_takeover | Device, location or behaviour change before a movement. | In the product, engine not live |
| Device Intelligencedevice_intelligence | Fingerprint reuse, emulators, device farms. | In the product, engine not live |
| Behavioural Biometricsbehavioural_biometrics | Typing cadence, hesitation, copy-paste on sensitive fields. | In the product, engine not live |
| Impossible Travelimpossible_travel | Two sessions too far apart in geography for the time between them. | In the product, engine not live |
| New Device, High Valuenew_device_high_value | First movement from an unknown device above a floor. | In the product, engine not live |
| Card Testingcard_testing | Rapid low-value attempts against a payment instrument. | In the product, engine not live |
| Chargeback Patternchargeback_pattern | Dispute rate by cohort, merchant or corridor. | In the product, engine not live |
| Duplicate Paymentduplicate_payment | Same amount, party and window: a likely double-send. | In the product, engine not live |
| Scam & Social Engineeringscam_social_engineering | Coerced transfers: hesitation, session length, first-time high-value payee. | In the product, engine not live |
| Synthetic Identitysynthetic_identity | An assembled identity that passes each check but fails as a whole. | In the product, engine not live |
| Velocity of Applicationsapplication_velocity | Many signups sharing an attribute in a short window. | In the product, engine not live |
| First-Party Fraudfirst_party_fraud | The customer is the fraudster: returns, refunds or credit abuse. | In the product, engine not live |
Risk indicators
A reference list, shown under Administration › Library › Risk indicators, that a template can name. Nothing computes an indicator’s value: a policy measures with its own rules. Three indicators are named by a template.
| Indicator | Describes | Domain · type · unit · evaluation | Named by |
|---|---|---|---|
| Outflow Amountoutflow_amount | Value of a single outbound transfer from a monitored wallet. | Transaction Monitoring · Amount · USD · Real Time | Large Outflow |
| Transaction Velocitytransaction_velocity | Count of outbound transactions in a rolling window. | Transaction Monitoring · Rate · txns/window · Real Time | Velocity Breach |
| New Counterpartynew_counterparty | Transfer to a destination not seen before in the monitored group. | Transaction Monitoring · Boolean · — · Real Time | New Counterparty |
| Single Wallet Concentrationsingle_wallet_concentration | Share of total holdings in one wallet. | Concentration Risk · Ratio · percent · Scheduled | None |
| Single Chain Exposuresingle_chain_exposure | Share of total holdings on one chain. | Concentration Risk · Ratio · percent · Scheduled | None |
| Stablecoin Concentrationstablecoin_concentration | Share of holdings in stablecoins against volatile assets. | Concentration Risk · Ratio · percent · Scheduled | None |
| Travel Rule Compliancetravel_rule_compliance | Transfer to an unverified self-hosted wallet above the travel-rule threshold. | Compliance & Regulatory · Boolean · — · Real Time | None |
| CDD Expirycdd_expiry | Customer due diligence documentation expired or close to expiry. | Compliance & Regulatory · Duration · days · Scheduled | None |
| Signer Changesigner_change | Signer or threshold change on a multisig. | Operational Control · Boolean · — · On Change | None |
| Wallet Inactivitywallet_inactivity | No transactions for an extended period. | Operational Control · Duration · days · Scheduled | None |
| Hot Wallet Balancehot_wallet_balance | Hot wallet balance above the approved limit. | Operational Control · Amount · USD · Scheduled | None |