Anti-money laundering monitoring method, device and system

Abstract

The present invention relates to an anti-money laundering monitoring method, device and system, the method comprising: pre-creating multiple anti-money laundering models; obtaining current fund transaction information, the information comprising: a customer subject, current fund transaction behavior information and a transaction object subject, and taking the customer subject and the transaction object subject as target customers; based on the user identification of the target user, calling the target user's account history information, the account history information comprising: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information; generating multiple monitoring data groups according to the current fund transaction information and / or the account history information; inputting the data to be monitored into the corresponding anti-money laundering model, and outputting marking information used to characterize whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model; and determining whether the target customer is a high-risk customer according to the marking information output on all anti-money laundering models.

Description

Technical Field

[0001] The present invention relates to the technical field of suspicious fund transaction monitoring, and in particular to an anti-money laundering monitoring method, device and system. Background Art

[0002] In the current context of economic globalization, internationalization of capital and rapid development of information technology, money laundering activities undermine the foundation of social credit and threaten financial and economic security.

[0003] At present, financial institutions face the following difficulties in anti-money laundering work:

[0004] 1. Transaction monitoring and false alarm rates remain high for a long time:

[0005] (1) Rule-based suspicious transaction identification leads to a high false alarm rate, and it is difficult to determine the threshold for suspicious transactions;

[0006] (2) List monitoring, scattered customer and transaction data, and uneven data quality require anti-money laundering staff to spend a lot of time collecting, organizing, and checking data;

[0007] (3) Identification of customer identity information is the key to anti-money laundering. However, the rampant black industry in recent years has led to the concealment and forgery of identity information, which has also increased the difficulty of anti-money laundering.

[0008] 2. Limited due diligence, investigation clues and tools:

[0009] (1) The increase in transaction volume and the expansion of financial payment scenarios have increased the cost pressure brought by manual review;

[0010] (2) Manual investigation is too inefficient, and the high false positive rate prevents investigators from investing their limited energy into more valuable clues;

[0011] (3) The quality of suspicious transaction review is unstable due to different levels of manual review, different understanding of business, and different standards for identifying suspicious transactions. Summary of the invention

[0012] The object of the present invention is to provide an anti-money laundering monitoring method, device and system to solve the problems raised in the above background technology.

[0013] To achieve the above object, the technical solution adopted by the present invention is:

[0014] In a first aspect, an anti-money laundering monitoring method is provided, the method comprising:

[0015] Pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule;

[0016] Acquire current fund transaction information, the current fund transaction information including: client subject, current fund transaction behavior information and transaction object subject, and use the client subject and the transaction object subject as target users;

[0017] Based on the user identification of the target user, calling the target user's account history information, the account history information includes: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information;

[0018] Generate multiple monitoring data groups according to the current fund transaction information and / or the account history information, each of the monitoring data groups including at least one data to be monitored;

[0019] Input the data to be monitored into the corresponding anti-money laundering model, and output marking information for indicating whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model;

[0020] Determine whether the target user is a high-risk customer based on the tag information output by all anti-money laundering models.

[0021] As a further improvement of the present invention, the multiple monitoring data groups are generated according to the current fund transaction information and / or the account history information, each of the monitoring data groups includes at least one data to be monitored, including:

[0022] Generate a first monitoring data group according to the total number of historical transactions, wherein the first monitoring data group includes a total number of transactions;

[0023] Generate a second monitoring data group according to the historical card replacement times, wherein the second monitoring data group includes the historical card replacement times value;

[0024] A third monitoring data group is generated according to the plurality of historical account opening dates, wherein the third monitoring data group includes a plurality of historical account opening date data.

[0025] As a further improvement of the present invention, the step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes:

[0026] The total number of transactions is input into a first anti-money laundering model, and the first anti-money laundering model is used to output first marking information indicating whether the total number of transactions hits a rule database set on the first anti-money laundering model according to the difference between the total number of transactions and a preset transaction number threshold;

[0027] The historical card replacement times value is input into a second anti-money laundering model, and the second anti-money laundering model is used to output second marking information indicating whether the historical card replacement times value hits a rule database set on the second anti-money laundering model according to the magnitude of the historical card replacement times value and a preset card replacement times threshold value;

[0028] The plurality of historical account opening date data are input into a third anti-money laundering model, and the third anti-money laundering model is used to output third marking information indicating whether the plurality of historical account opening date data hits a rule database set on the third anti-money laundering model, based on whether the time interval between any two historical account opening dates is less than one week.

[0029] As a further improvement of the present invention, the current fund transaction behavior information includes: the current transaction date, the number of current transaction object entities, and the current transaction summary;

[0030] Generate a fourth monitoring data group according to the current transaction date and the plurality of historical account opening dates, the fourth monitoring data group including current transaction date data and a plurality of historical account opening date data;

[0031] generating a fifth monitoring data group according to the number of the current transaction object entities, wherein the fifth monitoring data group includes the number value of the current transaction object entities;

[0032] A sixth monitoring data group is generated according to the current transaction summary, wherein the sixth monitoring data group includes current transaction summary data.

[0033] As a further improvement of the present invention, the step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes:

[0034] Inputting the current transaction date data and the multiple historical account opening date data into a fourth anti-money laundering model, the fourth anti-money laundering model being used to output fourth marking information indicating whether the current transaction date data and the multiple historical account opening date data hit a rule database set on the fourth anti-money laundering model, according to whether the time interval between the current transaction date and any one of the historical account opening dates is greater than one day;

[0035] Inputting the quantity value of the current transaction object subject into a fifth anti-money laundering model, the fifth anti-money laundering model being used to output fifth marking information indicating that the quantity value of the current transaction object subject hits a rule database set on the fifth anti-money laundering model according to the magnitude between the quantity of the current transaction object subject and a preset transaction object quantity threshold;

[0036] The current transaction summary data is input into a sixth anti-money laundering model, and the sixth anti-money laundering model is used to output sixth marking information indicating whether the current transaction summary data hits a rule database set on the sixth anti-money laundering model according to whether an abnormality occurs in the current transaction summary.

[0037] As a further improvement of the present invention, the current fund transaction behavior information also includes: current login IP address, current transaction time and current transaction amount;

[0038] Each set of historical fund transaction behavior information includes: historical transaction date, historical transaction time, historical transaction amount, historical login IP address, and historical transaction form, and the historical transaction form includes: any one of withdrawal, transfer, and deposit;

[0039] The generating of a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group including at least one data to be monitored, includes:

[0040] Generate a seventh monitoring data group according to the current IP address and all historical login IP addresses, wherein the seventh monitoring data group includes a plurality of IP address data;

[0041] generating an eighth monitoring data group according to the current transaction amount and all historical transaction amounts, wherein the eighth monitoring data group includes a plurality of transaction amount data;

[0042] Generate a ninth monitoring data group according to the current transaction time and all historical transaction times, wherein the ninth monitoring data group includes a plurality of transaction time data;

[0043] Generate a tenth monitoring data group according to the multiple historical account opening dates and all historical transaction dates, the tenth monitoring data group including multiple historical account opening date data and multiple historical transaction date data;

[0044] The eleventh monitoring data group is generated according to the historical transaction amount and historical transaction form in each group of the historical fund transaction behavior information, and the eleventh monitoring data group includes multiple historical transaction amount data and historical transaction form data, and each historical transaction amount data corresponds to one historical transaction form data.

[0045] As a further improvement of the present invention, the step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes:

[0046] Input the plurality of IP address data into a seventh anti-money laundering model, the seventh anti-money laundering model being used to output seventh marking information indicating whether the plurality of IP address data hits a rule database set on the seventh anti-money laundering model according to the number of times that the IP address is consistent with an IP address from a preset high-risk country and a preset IP number threshold;

[0047] Inputting the plurality of transaction amount data into an eighth anti-money laundering model, the eighth anti-money laundering model being used to output eighth marking information indicating whether the plurality of transaction amount data hits a rule database set on the eighth anti-money laundering model, according to the probability that the transaction amounts among the plurality of transaction amounts are consistent and the first amount probability threshold, or according to the probability that the transaction amounts among the plurality of transaction amounts are lower than the transaction amount threshold and the second amount probability threshold, or according to whether the transaction amounts among the plurality of transaction amounts contain a preset amount value;

[0048] Inputting the plurality of transaction time data into a ninth anti-money laundering model, the ninth anti-money laundering model being used to output ninth marking information indicating whether the plurality of transaction time data hits a rule database set on the ninth anti-money laundering model according to the probability that the transaction time is within a preset time period and the probability threshold of the number of times;

[0049] Inputting the plurality of historical account opening date data and the plurality of historical transaction date data into a tenth anti-money laundering model, the tenth anti-money laundering model being used to output tenth marking information indicating whether the plurality of historical account opening date data and the plurality of historical transaction date data hit a rule database set on the tenth anti-money laundering model according to whether the period between any account opening date and the historical transaction date exceeds 3 months;

[0050] Multiple historical transaction amount data and historical transaction form data are input into the eleventh anti-money laundering model, and the eleventh anti-money laundering model is used to output eleventh marking information indicating whether the multiple historical transaction amount data and historical transaction form data hit the rule database set on the eleventh anti-money laundering model based on the probability that the average daily cash withdrawal historical amount is less than a preset cash withdrawal amount threshold and the preset cash withdrawal probability.

[0051] As a further improvement of the present invention, the step of determining whether the current fund transaction information is a suspicious warning transaction according to the mark information outputted by all anti-money laundering models includes:

[0052] When it is determined that any one of the anti-money laundering models outputs marking information indicating that the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model, the target user is determined to be a high-risk customer.

[0053] In a second aspect, an anti-money laundering monitoring device is provided, the device comprising:

[0054] A creation module, which is used to pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule;

[0055] A fund transaction information acquisition module is used to acquire current fund transaction information, wherein the current fund transaction information includes: a client subject, current fund transaction behavior information and a transaction object subject, and the client subject and the transaction object subject are used as target users;

[0056] A calling module, which is used to call the target user's account history information based on the target user's user identification, the account history information including: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information;

[0057] A monitoring data group generating module, which is used to generate a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each of which includes at least one data to be monitored;

[0058] An input module, which is used to input the data to be monitored into the corresponding anti-money laundering model, and output marking information used to characterize whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model;

[0059] The determination module is used to determine whether the target user is a high-risk customer based on the tag information output by all anti-money laundering models.

[0060] In a third aspect, an anti-money laundering monitoring system is provided, which comprises: a user information confirmation device, the anti-money laundering monitoring device described in the second aspect, and a display device;

[0061] The user information confirmation device is used to confirm the identity information of the system administrator to prevent the leakage of highly sensitive user and account information;

[0062] The display device is connected to the anti-money laundering monitoring device, and is used to display the target users corresponding to the high-risk customers.

[0063] The beneficial effects of adopting the above technical solution are:

[0064] The anti-money laundering monitoring method provided by the present invention pre-creates multiple anti-money laundering models; obtains current fund transaction information, which includes: a customer subject, current fund transaction behavior information and a transaction object subject, and takes the customer subject and the transaction object subject as target users; based on the user identification of the target user, calls the target user's account history information, and the account history information includes: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information; generates multiple monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group includes at least one data to be monitored; inputs the data to be monitored into the corresponding anti-money laundering model, and outputs marking information for characterizing whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model; and determines whether the target user is a high-risk customer according to the marking information output on all anti-money laundering models.

[0065] In addition, after determining that the target user is a high-risk customer, the administrator can recall the transactions of the target user's corresponding account. Therefore, the anti-money laundering monitoring method provided by the embodiment of the present invention not only has the advantages of high recognition rate and high recall rate. At the same time, it can automatically monitor the existing cardholders in the database, greatly reducing the cost of manual detection. It can effectively solve the risk control and management problems currently encountered by banking and financial institutions and promote the stable development of the economy. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 The present invention provides an anti-money laundering monitoring method.

[0068] Figure 2 It is a structural schematic diagram of an anti-money laundering monitoring device provided by an embodiment of the present invention.

[0069] Figure 3 It is a structural diagram of an anti-money laundering monitoring system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is clearly and completely described below in conjunction with specific embodiments.

[0071] The present invention provides an anti-money laundering monitoring method, which can be applied to a variety of system platforms, and the execution subject can be a bank anti-money laundering system running on a computer, such as Figure 1 As shown, the method includes:

[0072] Step S1: Pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule.

[0073] The establishment of an anti-money laundering model is specifically to have the system administrator preset the anti-money laundering model judgment rules. The information in each rule includes:

[0074] (1) Rule name: Rule a, Rule b, Rule c, etc.;

[0075] (2) Indicator type: indicator threshold type indicator;

[0076] (3) Indicator name: such as total number of transactions;

[0077] (4) Rule comparison: greater than, less than, equal to, etc.;

[0078] (5) Comparison value: the corresponding judgment standard for each indicator.

[0079] The system administrator generates multiple anti-money laundering models that correspond to each preset rule. The anti-money laundering model information includes:

[0080] (1) Model name: such as model A, model B, model C, etc.;

[0081] (2) Contained rules: For example, model A includes rule a; model B includes rule b; model C includes rule c, etc.;

[0082] (3) Determine the result.

[0083] In the present invention, a plurality of pre-created anti-money laundering models are pre-stored in the system for subsequent use.

[0084] Step S2: Obtain current fund transaction information.

[0085] The current fund transaction information includes: the client subject, the current fund transaction behavior information and the transaction object subject, with the client subject and the transaction object subject as the target users; the client subject and the transaction object subject can both be natural persons or legal persons.

[0086] Step S3: Based on the user ID of the target user, call the target user's account history information.

[0087] The user ID corresponds to the target user one by one. If the target user is a natural person, the target user's ID can be an ID number. If the target user is a legal person, the target user's ID can be a social credit code.

[0088] After obtaining the user ID, the account history information pre-stored in the system can be called according to the user ID. The account history information includes: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information.

[0089] Step S4: Generate multiple monitoring data groups according to the current fund transaction information and / or account history information, each monitoring data group includes at least one data to be monitored.

[0090] Method 1: The monitoring data group is generated based only on the account history information, which includes steps S401 to S403.

[0091] Step S401, generating a first monitoring data group according to the total number of historical transactions, the first monitoring data group including the total number of transactions;

[0092] Step S402: Generate a second monitoring data set according to the historical card replacement times, the second monitoring data set including the historical card replacement times;

[0093] Step S403: Generate a third monitoring data group according to multiple historical account opening dates, where the third monitoring data group includes multiple historical account opening date data.

[0094] Method 2: The monitoring data group is generated only based on the current fund transaction information. The current fund transaction behavior information includes: the current transaction date, the number of current transaction object entities, and the current transaction summary. Step S4 includes steps S404-S406.

[0095] Step S404: Generate a fourth monitoring data group according to the current transaction date and multiple historical account opening dates, the fourth monitoring data group including current transaction date data and multiple historical account opening date data;

[0096] Step S405: Generate a fifth monitoring data group according to the number of current transaction object entities, the fifth monitoring data group including the number values ​​of the current transaction object entities;

[0097] Step S406: Generate a sixth monitoring data group according to the current transaction summary, where the sixth monitoring data group includes the current transaction summary data.

[0098] Method 3: The monitoring data group is generated based on the current fund transaction information and the account history information. In addition to the information described in Method 2, the current fund transaction behavior information also includes: the current login IP address, the current transaction time and the current transaction amount; each group of historical fund transaction behavior information in the account history information includes: historical transaction date, historical transaction time, historical transaction amount, historical login IP address, and historical transaction form. The historical transaction form includes: any one of withdrawal, transfer, and deposit. Step S4 includes steps S407-S411.

[0099] Step S407: Generate a seventh monitoring data group according to the current IP address and all historical login IP addresses, the seventh monitoring data group including multiple IP address data;

[0100] Step S408: Generate an eighth monitoring data group according to the current transaction amount and all historical transaction amounts, the eighth monitoring data group including a plurality of transaction amount data;

[0101] Step S409: Generate a ninth monitoring data group according to the current transaction time and all historical transaction times, the ninth monitoring data group including a plurality of transaction time data;

[0102] Step S410: Generate a tenth monitoring data group according to the multiple historical account opening dates and all historical transaction dates, the tenth monitoring data group including multiple historical account opening date data and multiple historical transaction date data;

[0103] Step S411, generating an eleventh monitoring data group according to the historical transaction amount and historical transaction form in each group of historical fund transaction behavior information, the eleventh monitoring data group includes multiple historical transaction amount data and historical transaction form data, and each historical transaction amount data corresponds to one historical transaction form data.

[0104] It should be noted that the execution entity may generate multiple monitoring data groups in sequence according to the above steps, or may not generate multiple monitoring data groups according to the above steps, as long as the above multiple detection data groups can be generated, and the embodiment of the present invention does not make specific limitations on this.

[0105] Step S5: input the data to be monitored into the corresponding anti-money laundering model, and output marking information for indicating whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model.

[0106] In the embodiment of the present invention, when the data to be monitored hits the anti-money laundering model judgment rule, the anti-money laundering model outputs "1", and when it does not hit, the anti-money laundering model outputs "0". The tag information carries the identifier of the anti-money laundering model, so that the tag information corresponds to the anti-money laundering model one by one, for example: 11 represents information that the first anti-money laundering model output hits the anti-money laundering model judgment rule above; 10 represents information that the first anti-money laundering model output does not hit the anti-money laundering model judgment rule above.

[0107] According to the different data to be monitored generated in step S4, step S5 includes steps: S501 to step S511, which correspond one-to-one to steps S401 to step S411 respectively.

[0108] Step S501: input the total number of transactions into a first anti-money laundering model. The first anti-money laundering model outputs first marking information indicating whether the total number of transactions hits a rule database set on the first anti-money laundering model based on the total number of transactions and a preset transaction number threshold.

[0109] Taking into account that money laundering activities involve a large number of transactions, the first anti-money laundering model outputs first tag information indicating a hit, such as 11, when determining that the total number of transactions is greater than or equal to a preset transaction number threshold; and outputs first tag information indicating a miss, such as 10, when the total number of transactions is less than the preset transaction number threshold.

[0110] Step S502: input the historical card replacement times value into the second anti-money laundering model, and the second anti-money laundering model is used to output second marking information indicating whether the historical card replacement times value hits the rule database set on the second anti-money laundering model based on the size of the historical card replacement times value and the preset card replacement times threshold.

[0111] Taking into account that money laundering activities require multiple card changes, the second anti-money laundering model outputs second tag information indicating a hit when it determines that the historical number of card changes is greater than or equal to the preset card change number threshold, for example: 21; and when the historical number of card changes is less than the historical number of card changes, it outputs second tag information indicating a miss, such as: 20.

[0112] Further, to improve its accuracy, in a possible implementation, the account history information further includes a plurality of historical card replacement dates, each of which corresponds to a card replacement behavior, and step S401 includes: generating a second monitoring data group according to the historical card replacement times and the plurality of historical card replacement dates, the second monitoring data group including the historical card replacement times and the plurality of historical card replacement date data;

[0113] In step S501, the second anti-money laundering model compares the historical card replacement times within a predetermined period (such as within one year) with the preset card replacement times threshold to determine and output second marking information indicating whether the historical card replacement times and multiple historical card replacement date data match.

[0114] Step S503: input multiple historical account opening date data into the third anti-money laundering model. The third anti-money laundering model is used to output third marking information indicating whether the multiple historical account opening date data hits the rule database set on the third anti-money laundering model according to whether the time interval between any two historical account opening dates is less than one week.

[0115] Taking into account that money laundering activities require frequent account opening, the third anti-money laundering model outputs the third tag information indicating a hit, such as 31, when it is determined that the time interval between any two historical account opening dates is less than one week; and when the time interval between any two historical account opening dates is not less than one week (greater than or equal to one week), the second tag information indicating a miss is output, such as 30.

[0116] Step S504: input the current transaction date data and multiple historical account opening date data into the fourth anti-money laundering model. The fourth anti-money laundering model is used to output fourth marking information indicating whether the current transaction date data and multiple historical account opening date data hit the rule database set on the fourth anti-money laundering model according to whether the time interval between the current transaction date and any historical account opening date is greater than one day.

[0117] Similarly, when the fourth anti-money laundering model determines that it is less than or equal to one day, it outputs fourth marking information 41 indicating a hit, and when it determines that it is greater than one day, it outputs fourth marking information 40 indicating a miss.

[0118] Step S505: input the quantity value of the current transaction object subject into the fifth anti-money laundering model, and the fifth anti-money laundering model is used to output fifth marking information indicating whether the quantity value of the current transaction object subject hits the rule database set on the fifth anti-money laundering model based on the size of the current transaction object subject quantity and the preset transaction subject quantity threshold.

[0119] The fifth anti-money laundering model outputs fifth marking information 51 indicating a hit when determining that the number is greater than or equal to a preset transaction subject number threshold, and outputs fifth marking information 50 indicating a miss when determining that the number is less than the preset transaction subject number threshold.

[0120] Step S506: input the current transaction summary data into the sixth anti-money laundering model, and the sixth anti-money laundering model is used to output sixth marking information indicating whether the current transaction summary data hits the rule database set on the sixth anti-money laundering model according to whether an abnormality occurs in the current transaction summary.

[0121] When the sixth anti-money laundering model determines that an abnormality occurs in the current transaction summary, it outputs sixth marking information 61 indicating a hit, and when it determines that no abnormality occurs in the current transaction summary, it outputs sixth marking information 60 indicating a miss.

[0122] Step S507: input multiple IP address data into the seventh anti-money laundering model. The seventh anti-money laundering model is used to output seventh marking information indicating whether the multiple IP address data hits the rule database set on the seventh anti-money laundering model based on the number of times that the IP address is consistent with the IP address of a preset high-risk country and the preset IP number threshold.

[0123] The seventh anti-money laundering model outputs seventh marking information 71 indicating a hit when it is determined to be greater than or equal to a preset IP number threshold, and outputs seventh marking information 70 indicating a miss when it is determined to be less than the preset IP number threshold.

[0124] Step S508: input multiple transaction amount data into an eighth anti-money laundering model, and the eighth anti-money laundering model is used to output eighth marking information indicating whether the multiple transaction amount data hits the rule database set on the eighth anti-money laundering model according to the probability that the transaction amounts in the multiple transaction amounts are consistent and the first amount probability threshold, or according to the probability that the transaction amounts in the multiple transaction amounts are lower than the transaction amount threshold and the second amount probability threshold, or according to whether the transaction amounts in the multiple transaction amounts contain a preset amount value;

[0125] When the eighth anti-money laundering model determines that the probability that the transaction amounts among multiple transaction amounts are consistent is greater than or equal to the first amount probability threshold, or determines that the probability that the transaction amounts among multiple transaction amounts are lower than the transaction amount threshold is equal to the second amount probability threshold, or determines that the transaction amounts among multiple transaction amounts contain a preset amount value, the eighth marking information 81 indicating a hit is output; when it is determined that the above conditions are not met, the eighth marking information 80 indicating a miss is output.

[0126] Step S509: input multiple transaction time data into the ninth anti-money laundering model, and the ninth anti-money laundering model is used to output ninth marking information indicating whether the multiple transaction time data hits the rule database set in the ninth anti-money laundering model according to the probability of the transaction time being within the preset time period and the number probability threshold;

[0127] When the ninth anti-money laundering model determines that the probability of the transaction time being within the preset time period is greater than or equal to the probability threshold of the number of times, it outputs the ninth marking information 91 indicating a hit; when it is less than the probability threshold of the number of times, it outputs the ninth marking information 90 indicating a miss.

[0128] The preset time period may be a time period representing nighttime trading, for example, the time period is 0:00-4:00, 20:00-24:00 every day.

[0129] Step S510: input multiple historical account opening date data and multiple historical transaction date data into the tenth anti-money laundering model, and the tenth anti-money laundering model is used to output tenth marking information indicating whether the multiple historical account opening date data and multiple historical transaction date data hit the rule database set on the tenth anti-money laundering model according to whether the period between any account opening date and the historical transaction date exceeds 3 months;

[0130] The tenth anti-money laundering model outputs the tenth marking information 101 indicating a hit when it is determined that the condition is more than three months, and outputs the tenth marking information 100 indicating a miss when it is determined that the above condition is not met.

[0131] Step S511, input multiple historical transaction amount data and historical transaction form data into the eleventh anti-money laundering model, the eleventh anti-money laundering model is used to output the eleventh marking information indicating whether the multiple historical transaction amount data and historical transaction form data hit the rule database set on the eleventh anti-money laundering model based on the probability that the average daily cash withdrawal amount is less than the preset cash withdrawal amount threshold and the preset cash withdrawal probability.

[0132] When the eleventh anti-money laundering model determines that the probability that the average daily cash withdrawal amount is less than the preset cash withdrawal amount threshold is greater than the preset probability of cash withdrawal (frequent cash withdrawals according to the standard cash withdrawal limit occur frequently), the eleventh marking information 111 indicating a hit is output; when it is determined that the above conditions are not met, the eleventh marking information 110 indicating a miss is output.

[0133] Of course, the current transaction amount also includes the current debit amount or current credit amount of the target user. The historical transaction amount of each group of historical fund transactions also includes the historical debit amount and historical credit amount of the target user. The monitoring data can determine whether the above rules are hit through all debit amounts and credit amounts.

[0134] In a possible implementation, the aforementioned step S4 may also include S412: generating a twelfth monitoring data group based on the current transaction date, the current transaction amount, the historical transaction date and the historical transaction amount, the twelfth monitoring data group including the current transaction date data, the current transaction amount data, multiple historical transaction date data and multiple historical transaction amount data, and each historical transaction amount data corresponds one-to-one to a historical transaction date data.

[0135] Step S5 also includes: inputting the current transaction date data, the current transaction amount data, the multiple historical transaction date data, and the multiple historical transaction amount data into a twelfth anti-money laundering model, and the twelfth anti-money laundering model is used to output twelfth marking information indicating whether the current transaction date data, the current transaction amount data, the multiple historical transaction date data, and the multiple historical transaction amount data hit the rule database set on the twelfth anti-money laundering model according to whether the number of times the current transaction date data, the current transaction amount data, the multiple historical transaction date data, and the multiple historical transaction amount data satisfy the following formula reaches 5 times;

[0136] ||Debit amount of the day ÷ Credit amount of the day|-1|<5%;

[0137] When it is determined that the debit amount and the local currency amount of the target user in any day satisfy the above formula for 5 times or more, the twelfth mark information 121 indicating a hit is output; when it is determined that the above condition is not satisfied, the twelfth mark information 120 indicating a miss is output.

[0138] Step S6: Determine whether the target user is a high-risk customer based on the tag information output by all anti-money laundering models.

[0139] The methods for determining whether a transaction is a suspicious warning transaction include but are not limited to the following two:

[0140] The first method is to determine that the target user is a high-risk customer when it is determined that any anti-money laundering model outputs the tag information indicating that the monitored data hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model. That is, it is only necessary to determine that the tag information output by any anti-money laundering model contains "anti-money laundering model identifier + 0" to determine that the target user is a high-risk customer.

[0141] The second method is to use the logistic regression method to train the weight of each anti-money laundering model, and determine whether the current fund transaction information is a suspicious warning transaction based on the label information output by each anti-money laundering model.

[0142] It includes the following steps:

[0143] Step S601: Use the logistic regression method to train the weights of the anti-money laundering model. For example, the weight of the first anti-money laundering model is 0.1, the weight of the second anti-money laundering model is 0.05, ..., and the sum of the weights of all anti-money laundering models is 1.

[0144] Among them, the logistic regression method is used to train the weights of the anti-money laundering model, including: 2w real anti-money laundering user data and 2w user data that have been detected as not being anti-money laundering users, a total of 4w data constitute the training set for logistic regression model training; 5000 data are used for verification, and finally an accuracy of 81.6% is achieved.

[0145] Step S602: for each piece of tag information, a weight corresponding to the piece of tag information is obtained according to the identifier of the anti-money laundering model carried by the tag information, and the weight is multiplied by the value in the tag information used to indicate whether the piece of tag information is matched, to obtain a value;

[0146] For example: for the tag information of "10", "0" is the value indicating whether it is a hit, and the weight "0.1" corresponding to the first anti-money laundering model is obtained according to "1", and the value is obtained according to "0.1" and "0": 0.1*0=0.

[0147] Step S603: sum up the values ​​of each tag information, and when the sum is greater than 0.5, determine that the target user is a high-risk customer.

[0148] The anti-money laundering monitoring method provided by the present invention pre-creates multiple anti-money laundering models; obtains current fund transaction information, which includes: a customer subject, current fund transaction behavior information and a transaction object subject, and takes the customer subject and the transaction object subject as target users; based on the user identification of the target user, calls the target user's account history information, and the account history information includes: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information; generates multiple monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group includes at least one data to be monitored; inputs the data to be monitored into the corresponding anti-money laundering model, and outputs marking information for characterizing whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model; and determines whether the target user is a high-risk customer according to the marking information output on all anti-money laundering models.

[0149] In addition, after determining that the target user is a high-risk customer, the administrator can recall the transactions of the target user's corresponding account. Therefore, the anti-money laundering monitoring method provided by the embodiment of the present invention not only has the advantages of high recognition rate and high recall rate. At the same time, it can automatically monitor the existing cardholders in the database, greatly reducing the cost of manual detection. It can effectively solve the risk control and management problems currently encountered by banking and financial institutions and promote the stable development of the economy.

[0150] In addition, the embodiment of the present invention further provides an anti-money laundering monitoring device 200, such as Figure 2 As shown, the device comprises:

[0151] A creation module 210, which is used to pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule;

[0152] The fund transaction information acquisition module 220 is used to acquire the current fund transaction information, which includes: the client subject, the current fund transaction behavior information and the transaction object subject, and the client subject and the transaction object subject are used as the target users;

[0153] A calling module 230 is used to call the target user's account history information based on the target user's user identification, the account history information including: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information;

[0154] A monitoring data group generating module 240, which is used to generate multiple monitoring data groups according to current fund transaction information and / or account history information, each monitoring data group includes at least one data to be monitored;

[0155] An input module 250, which is used to input the data to be monitored into the corresponding anti-money laundering model, and output a marking information used to characterize whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model;

[0156] The determination module 260 is used to determine whether the target user is a high-risk customer based on the marking information output by all anti-money laundering models.

[0157] In addition, the embodiment of the present invention also provides an anti-money laundering monitoring system, such as Figure 3 As shown, the system includes: a user information confirmation device 310, the anti-money laundering monitoring device 200 as described above, and a display device 320;

[0158] The user information confirmation device 310 is used to confirm the identity information of the system administrator to prevent the leakage of highly sensitive user and account information;

[0159] The display device 320 is connected to the anti-money laundering monitoring device 200 and is used to display target users corresponding to high-risk customers so that the administrator can make further analysis.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An anti-money laundering monitoring method, characterized in that: The method comprises: Pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule; Acquire current fund transaction information, the current fund transaction information including: client subject, current fund transaction behavior information and transaction object subject, and use the client subject and the transaction object subject as target users; Based on the user identification of the target user, calling the target user's account history information, the account history information includes: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information; Generate multiple monitoring data groups according to the current fund transaction information and / or the account history information, each of the monitoring data groups including at least one data to be monitored; Input the data to be monitored into the corresponding anti-money laundering model, and output marking information for indicating whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model; Determine whether the target user is a high-risk customer based on the tag information output by all anti-money laundering models; The current fund transaction behavior information includes: the current transaction date, the number of current transaction object entities, and the current transaction summary; Generate a fourth monitoring data group according to the current transaction date and the plurality of historical account opening dates, the fourth monitoring data group including current transaction date data and a plurality of historical account opening date data; generating a fifth monitoring data group according to the number of the current transaction object entities, wherein the fifth monitoring data group includes the number value of the current transaction object entities; generating a sixth monitoring data group according to the current transaction summary, wherein the sixth monitoring data group includes current transaction summary data; The current fund transaction behavior information also includes: the current login IP address, the current transaction time and the current transaction amount; Each set of historical fund transaction behavior information includes: historical transaction date, historical transaction time, historical transaction amount, historical login IP address, and historical transaction form, and the historical transaction form includes: any one of withdrawal, transfer, and deposit; The generating of a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group including at least one data to be monitored, includes: Generate a seventh monitoring data group according to the current IP address and all historical login IP addresses, wherein the seventh monitoring data group includes a plurality of IP address data; generating an eighth monitoring data group according to the current transaction amount and all historical transaction amounts, wherein the eighth monitoring data group includes a plurality of transaction amount data; Generate a ninth monitoring data group according to the current transaction time and all historical transaction times, wherein the ninth monitoring data group includes a plurality of transaction time data; Generate a tenth monitoring data group according to the multiple historical account opening dates and all historical transaction dates, the tenth monitoring data group including multiple historical account opening date data and multiple historical transaction date data; Generate an eleventh monitoring data group according to the historical transaction amount and the historical transaction form in each group of the historical fund transaction behavior information, wherein the eleventh monitoring data group includes a plurality of historical transaction amount data and historical transaction form data, and each historical transaction amount data corresponds to one historical transaction form data; The step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes: Input the plurality of IP address data into a seventh anti-money laundering model, the seventh anti-money laundering model being used to output seventh marking information indicating whether the plurality of IP address data hits a rule database set on the seventh anti-money laundering model according to the number of times that the IP address is consistent with an IP address of a preset high-risk country and a preset IP number threshold; Inputting the plurality of transaction amount data into an eighth anti-money laundering model, the eighth anti-money laundering model being used to output eighth marking information indicating whether the plurality of transaction amount data hits a rule database set on the eighth anti-money laundering model, according to the probability that the transaction amounts among the plurality of transaction amounts are consistent and the first amount probability threshold, or according to the probability that the transaction amounts among the plurality of transaction amounts are lower than the transaction amount threshold and the second amount probability threshold, or according to whether the plurality of transaction amounts contain a preset amount value; Inputting the plurality of transaction time data into a ninth anti-money laundering model, the ninth anti-money laundering model being used to output ninth marking information indicating whether the plurality of transaction time data hits a rule database set on the ninth anti-money laundering model according to the probability that the transaction time is within a preset time period and the probability threshold of the number of times; Inputting the plurality of historical account opening date data and the plurality of historical transaction date data into a tenth anti-money laundering model, the tenth anti-money laundering model being used to output tenth marking information indicating whether the plurality of historical account opening date data and the plurality of historical transaction date data hit a rule database set on the tenth anti-money laundering model according to whether the period between any account opening date and the historical transaction date exceeds 3 months; Multiple historical transaction amount data and historical transaction form data are input into the eleventh anti-money laundering model, and the eleventh anti-money laundering model is used to output eleventh marking information indicating whether the multiple historical transaction amount data and historical transaction form data hit the rule database set on the eleventh anti-money laundering model based on the probability that the average daily cash withdrawal historical amount is less than a preset cash withdrawal amount threshold and the preset cash withdrawal probability.

2. The anti-money laundering monitoring method according to claim 1, characterized in that: The generating of a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group including at least one data to be monitored, includes: Generate a first monitoring data group according to the total number of historical transactions, wherein the first monitoring data group includes a total number of transactions; Generate a second monitoring data group according to the historical card replacement times, wherein the second monitoring data group includes the historical card replacement times value; A third monitoring data group is generated according to the plurality of historical account opening dates, wherein the third monitoring data group includes a plurality of historical account opening date data.

3. The anti-money laundering monitoring method according to claim 2, characterized in that: The step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes: The total number of transactions is input into a first anti-money laundering model, and the first anti-money laundering model is used to output first marking information indicating whether the total number of transactions hits a rule database set on the first anti-money laundering model according to the difference between the total number of transactions and a preset transaction number threshold; The historical card replacement times value is input into a second anti-money laundering model, and the second anti-money laundering model is used to output second marking information indicating whether the historical card replacement times value hits a rule database set on the second anti-money laundering model according to the magnitude of the historical card replacement times value and a preset card replacement times threshold value; The plurality of historical account opening date data are input into a third anti-money laundering model, and the third anti-money laundering model is used to output third marking information indicating whether the plurality of historical account opening date data hits a rule database set on the third anti-money laundering model, based on whether the time interval between any two historical account opening dates is less than one week.

4. The anti-money laundering monitoring method according to claim 1, characterized in that: The step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes: Inputting the current transaction date data and the multiple historical account opening date data into a fourth anti-money laundering model, the fourth anti-money laundering model being used to output fourth marking information indicating whether the current transaction date data and the multiple historical account opening date data hit a rule database set on the fourth anti-money laundering model, according to whether the time interval between the current transaction date and any one of the historical account opening dates is greater than one day; Inputting the quantity value of the current transaction object subject into a fifth anti-money laundering model, the fifth anti-money laundering model being used to output fifth marking information indicating that the quantity value of the current transaction object subject hits a rule database set on the fifth anti-money laundering model according to the magnitude between the quantity of the current transaction object subject and a preset transaction object quantity threshold; The current transaction summary data is input into a sixth anti-money laundering model, and the sixth anti-money laundering model is used to output sixth marking information indicating whether the current transaction summary data hits a rule database set on the sixth anti-money laundering model according to whether an abnormality occurs in the current transaction summary.

5. The anti-money laundering monitoring method according to claim 1, characterized in that: Determining whether the current fund transaction information is a suspicious warning transaction based on the mark information output by all anti-money laundering models includes: When it is determined that any one of the anti-money laundering models outputs marking information indicating that the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model, the target customer is determined to be a high-risk customer. 6.An anti-money laundering monitoring device, characterized in that: The device comprises: A creation module, which is used to pre-create multiple anti-money laundering models, each of which includes an anti-money laundering model judgment rule; A fund transaction information acquisition module is used to acquire current fund transaction information, wherein the current fund transaction information includes: a client subject, current fund transaction behavior information and a transaction object subject, and the client subject and the transaction object subject are used as target clients; A calling module, which is used to call the target user's account history information based on the target user's user identification, the account history information including: the total number of historical transactions, the number of historical card changes, multiple historical account opening dates, and multiple groups of historical fund transaction behavior information; A monitoring data group generating module, which is used to generate a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each of which includes at least one data to be monitored; An input module, which is used to input the data to be monitored into the corresponding anti-money laundering model, and output marking information used to characterize whether the data to be monitored hits the anti-money laundering model judgment rule set on the corresponding anti-money laundering model; A determination module, which is used to determine whether the target user is a high-risk customer based on the tag information output by all anti-money laundering models; The current fund transaction behavior information includes: the current transaction date, the number of current transaction object entities, and the current transaction summary; Generate a fourth monitoring data group according to the current transaction date and the plurality of historical account opening dates, the fourth monitoring data group including current transaction date data and a plurality of historical account opening date data; generating a fifth monitoring data group according to the number of the current transaction object entities, wherein the fifth monitoring data group includes the number value of the current transaction object entities; generating a sixth monitoring data group according to the current transaction summary, wherein the sixth monitoring data group includes current transaction summary data; The current fund transaction behavior information also includes: the current login IP address, the current transaction time and the current transaction amount; Each set of historical fund transaction behavior information includes: historical transaction date, historical transaction time, historical transaction amount, historical login IP address, and historical transaction form, and the historical transaction form includes: any one of withdrawal, transfer, and deposit; The generating of a plurality of monitoring data groups according to the current fund transaction information and / or the account history information, each monitoring data group including at least one data to be monitored, includes: Generate a seventh monitoring data group according to the current IP address and all historical login IP addresses, wherein the seventh monitoring data group includes a plurality of IP address data; generating an eighth monitoring data group according to the current transaction amount and all historical transaction amounts, wherein the eighth monitoring data group includes a plurality of transaction amount data; Generate a ninth monitoring data group according to the current transaction time and all historical transaction times, wherein the ninth monitoring data group includes a plurality of transaction time data; Generate a tenth monitoring data group according to the multiple historical account opening dates and all historical transaction dates, the tenth monitoring data group including multiple historical account opening date data and multiple historical transaction date data; Generate an eleventh monitoring data group according to the historical transaction amount and the historical transaction form in each group of the historical fund transaction behavior information, wherein the eleventh monitoring data group includes a plurality of historical transaction amount data and historical transaction form data, and each historical transaction amount data corresponds to one historical transaction form data; The step of inputting the data to be monitored into a corresponding anti-money laundering model and outputting marking information for indicating that the data to be monitored hits a rule database set on the corresponding anti-money laundering model includes: Input the plurality of IP address data into a seventh anti-money laundering model, the seventh anti-money laundering model being used to output seventh marking information indicating whether the plurality of IP address data hits a rule database set on the seventh anti-money laundering model according to the number of times that the IP address is consistent with an IP address of a preset high-risk country and a preset IP number threshold; Inputting the plurality of transaction amount data into an eighth anti-money laundering model, the eighth anti-money laundering model being used to output eighth marking information indicating whether the plurality of transaction amount data hits a rule database set on the eighth anti-money laundering model, according to the probability that the transaction amounts among the plurality of transaction amounts are consistent and the first amount probability threshold, or according to the probability that the transaction amounts among the plurality of transaction amounts are lower than the transaction amount threshold and the second amount probability threshold, or according to whether the plurality of transaction amounts contain a preset amount value; Inputting the plurality of transaction time data into a ninth anti-money laundering model, the ninth anti-money laundering model being used to output ninth marking information indicating whether the plurality of transaction time data hits a rule database set on the ninth anti-money laundering model according to the probability that the transaction time is within a preset time period and the probability threshold of the number of times; Inputting the plurality of historical account opening date data and the plurality of historical transaction date data into a tenth anti-money laundering model, the tenth anti-money laundering model being used to output tenth marking information indicating whether the plurality of historical account opening date data and the plurality of historical transaction date data hit a rule database set on the tenth anti-money laundering model according to whether the period between any account opening date and the historical transaction date exceeds 3 months; Multiple historical transaction amount data and historical transaction form data are input into the eleventh anti-money laundering model, and the eleventh anti-money laundering model is used to output eleventh marking information indicating whether the multiple historical transaction amount data and historical transaction form data hit the rule database set on the eleventh anti-money laundering model based on the probability that the average daily cash withdrawal historical amount is less than a preset cash withdrawal amount threshold and the preset cash withdrawal probability. 7.An anti-money laundering monitoring system, characterized in that: It includes: users An information confirmation device, an anti-money laundering monitoring device as claimed in claim 6, and a display device; The user information confirmation device is used to confirm the identity information of the system administrator to prevent the leakage of highly sensitive user and account information; The display device is connected to the anti-money laundering monitoring device, and is used to display the target users corresponding to the high-risk customers.

Images