example.json

{
  "model": "aml",
  "state": {
    "institution": "Meridian Crypto Exchange is a crypto exchange based in Italy. It serves these customer groups: private crypto investor, business accepting crypto payments. Clear means the review is closed with a short note; investigate means an analyst opens a case and reviews the customer's documents; escalate means the case goes to the money-laundering reporting officer, who decides on a report to the authorities; block means the payment is stopped and the account frozen until compliance decides.\n\nMonitoring rules (all amounts in euro):\nEach review covers one customer's last 30 days. Transfers between the customer's own accounts and wallets (listed in the customer profile) are ignored by every rule.\nWarning signs:\nW1 Structuring: 3 or more deposits made with cash vouchers bought at partner kiosks each from 2,400.00 up to just under the reporting threshold of 3,000.00.\nW2 Rapid pass-through: the incoming money totals at least 1,000.00 and at least 90% of it is sent out again (by any payment or cash withdrawal) within 72 hours of arriving.\nW3 Many senders: money comes from more different senders than the customer profile expects per month.\nW4 Many recipients: money goes to more different recipients than the customer profile expects per month.\nW8 High-risk country: a payment to or from a country on the high-risk list that the customer profile does not list as an expected country.\nHigh-risk countries: Algeria, Bulgaria, Cameroon, Lebanon, Mali, Nigeria, Philippines, South Sudan, Venezuela.\nBlocked countries: Belarus, North Korea, Syria.\nBlocked parties: Field Summit EOOD (Bulgaria); Ember Nova Company (Bolivia); Coral Alder Ltd (Malta).\nActions (exactly one applies):\nblock: any payment to or from a blocked country or a blocked party, whatever else the activity shows.\nescalate: two or more different warning signs, or W2 (Rapid pass-through) even on its own.\ninvestigate: exactly one warning sign, other than W2.\nclear: no warning sign and no blocked country or party.",
    "customer": "Customer: Kenji Okafor (individual), customer since November 2019.\nSegment: private crypto investor. Occupation or business: shop owner investing in crypto.\nExpected incoming: about 620.00 a month.\nExpected senders: up to 8 different senders a month. Expected recipients: up to 6 different recipients a month.\nExpected countries: Italy, Lebanon.\nOwn accounts and wallets: bank account ending 5014 at another bank; own hardware wallet 0xb84f...182c.",
    "activity": "Review period: 1 June 2026 to 30 June 2026 (30 days). Amounts in euro.\nPayments:\n01 Jun 09:12 received 46.76 by crypto deposit from wallet 0x576b...5f0d at FalconCoin (Italy)\n10 Jun 17:34 sent 376.32 by crypto withdrawal to wallet 0x3292...217b (private wallet, owner and country unknown)\n14 Jun 14:23 received 478.54 by crypto deposit from wallet 0x576b...5f0d at FalconCoin (Italy)\nSummary (transfers between own accounts left out):\n- incoming: 2 payments, total 525.30, from 1 different senders\n- outgoing: 1 payments, total 376.32, to 1 different recipients\n- share of incoming money sent out again within 72 hours: 0%\n- counterparty countries: Italy"
  },
  "questions": {
    "action": {
      "type": "choice",
      "instructions": "A compliance analyst at the institution described above reviews this customer's last 30 days of activity. Which action does the institution's monitoring policy require?",
      "criteria": {
        "block": "Block: at least one payment goes to or comes from a blocked country or a blocked party, whatever else.",
        "investigate": "Investigate: exactly one warning sign applies, and the policy does not say to escalate that one alone.",
        "escalate": "Escalate: two or more different warning signs apply, or a sign that the policy says to escalate alone.",
        "clear": "Clear: no warning sign applies at all, and no payment involves a blocked country or any blocked party."
      }
    }
  }
}