Skip to main content

​
Risk Monitoring

Amrood monitors every transaction for suspicious patterns using both real-time rule-based scoring and periodic graph analysis.

​
Real-Time Risk Scoring

Every transaction is scored against these signals:
SignalScoreTrigger
Velocity spike+20More than 10 transactions in 5 minutes
New counterparty+10First payment to this recipient
Near-limit amount+10Amount exceeds 90% of per-tx limit
Circular payment+40Recipient recently paid this agent
Micro-transaction burst+30More than 20 transactions in 5 minutes
Near-threshold+15Amount between 90-100% of approval threshold

​
Score Thresholds

Score RangeAction
0–29Pass — transaction proceeds
30–59Flag — transaction proceeds, alert created
60–79Hold — requires manual review
80+Block — transaction denied

​
Risk Alerts

Flagged transactions generate alerts in the admin review queue: 
{
  "id": "rsk_abc123",
  "agent_id": "agt_xxx",
  "alert_type": "circular_payment",
  "risk_score": 80,
  "details": {
    "circular_payment": true,
    "velocity_spike": true,
    "velocity_count": 15
  },
  "status": "open"
}
Alert statuses: open → reviewed / dismissed / escalated

​
Graph Analysis

Every 6 hours, a background worker analyzes the full transaction graph for patterns that individual-transaction scoring can’t catch:

​
Cycle Detection

Finds circular payment paths (A → B → C → A) using depth-first search. Catches coordinated laundering across multiple agents.

​
Hub-and-Spoke

Flags agents sending to more than 10 unique recipients in 24 hours — potential cash-out behavior.

​
Layering Detection

Identifies agents that receive funds and immediately forward them (within 5 minutes) to another agent. Catches money layering when this happens repeatedly.

​
Micro-Flood

Detects agents with high transaction volume (50+) but low average amount (under ₹100) — a common technique to stay below monitoring thresholds.

​
Containment Actions

When suspicious activity is detected:
  1. Flag — alert created, admin notified
  2. Quarantine — agent can receive but cannot send (prevents further dispersal)
  3. Freeze — all transactions blocked, owner notified
  4. Owner freeze — all agents under an owner frozen simultaneously
See Kill Switches for containment operations.