Financial transaction risk analysis method and system based on multi-technology cooperation, medium, terminal and program product

CN122023005APending Publication Date: 2026-05-12AIA LIFE INSURANCE CO LTD
View PDF -1 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
AIA LIFE INSURANCE CO LTD
Filing Date
2026-02-14
Publication Date
2026-05-12

AI Technical Summary

Technical Problem

Existing technologies make it difficult to quickly acquire external data, LLM direct analysis of raw structured data is subject to uncertainty, and the experience of experts in writing reports is difficult to replicate, resulting in low efficiency and unstable report quality in financial transaction risk analysis.

Method used

By acquiring and preprocessing external unstructured data through robotic process automation (RPA) technology, risk domains and risk characteristics are constructed. High-contribution risk factors are screened using risk dimension identification models and SHAP analysis techniques. Finally, a financial transaction risk analysis report is generated by combining a large language model and prompt word templates.

Benefits of technology

It improves the efficiency of external data acquisition, reduces the uncertainty of LLM, and enables the generation of high-quality, professional, and consistent financial transaction risk analysis reports, meeting regulatory requirements for interpretability and auditability.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122023005A_ABST
    Figure CN122023005A_ABST
Patent Text Reader

Abstract

The invention provides a financial transaction risk analysis method and system based on multi-technology collaboration, a medium, a terminal and a program product. The method comprises the following steps: acquiring internal structured data and external structured data related to financial transaction of a target customer; extracting risk factors in each risk domain from the internal structured data and the external structured data to form risk features; inputting the risk features into a risk dimension identification model, and outputting each risk domain score; calculating the contribution score of each risk factor to the risk domain score based on the SHAP analysis technology, and generating a plurality of risk factors with the highest contribution score; and inputting the risk factors with the highest score and contribution score of each risk domain and the corresponding original data into a large language model, and generating a financial transaction risk analysis report by the large language model according to the cue word template. According to the method, the risk focus of the financial transaction of the target customer can be accurately focused, and a high-quality and accurate financial transaction risk analysis report is generated.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a financial transaction risk analysis method, system, medium, terminal and program product based on multi-technology collaboration. Background Technology

[0002] Against the backdrop of increasingly stringent financial compliance regulations, financial institutions need to conduct risk screening on massive amounts of customer transaction behavior. Traditionally, rule engines are used to capture suspicious transactions, followed by manual risk report writing based on internal and external information. However, this process has the following problems: Risk assessment requires combining multiple data sources, including not only internal transaction data but also external data, such as customer execution information. Obtaining external information requires manual searching, which is time-consuming and labor-intensive. Furthermore, risk assessment is highly dependent on expert experience, and newcomers struggle to quickly grasp complex analytical logic and regulatory points. In addition, writing risk assessment reports is time-consuming and labor-intensive, averaging about 6 hours per report, resulting in a significant waste of human resources and failing to meet the demands of high-concurrency screening.

[0003] To address these challenges, with the development and widespread application of generative AI Large Language Models (LLMs), the industry has begun exploring the introduction of generative AI technology to build intelligent risk identification and report generation systems. However, while generative AI solutions show significant potential in risk analysis logic and report writing, they still face the following key technical difficulties in practical implementation:

[0004] (1) Difficulty in quickly obtaining external data: External data such as execution network, Baidu and other websites do not have data interface connections, making it difficult to obtain data.

[0005] (2) LLM directly analyzes raw structured data with uncertainty: If raw data such as unprocessed transaction records and policy lists are directly input into LLM, the model is prone to producing vague, generalized or even erroneous outputs due to the lack of clear risk focus and business context, which makes it difficult to meet the stringent requirements of accuracy and interpretability in financial scenarios.

[0006] (3) Experts’ experience in writing reports is difficult to replicate: High-quality risk reports rely on compliance experts’ comprehensive judgment of regulatory rules, transaction anomalies and business background. This kind of experience is mostly tacit knowledge and is difficult to structure and accumulate. Even if newcomers master the process, they often miss key points or make non-compliant statements due to a lack of judgment, resulting in unstable report quality, high training costs and difficulty in scaling.

[0007] Therefore, it is necessary to provide a financial transaction risk analysis method, system, medium, terminal, and program product based on multi-technology collaboration to solve the above-mentioned problems existing in the prior art. Summary of the Invention

[0008] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a financial transaction risk analysis method, system, medium, terminal and program product based on multi-technology collaboration, to solve the technical problems of the difficulty in quickly acquiring external data, the uncertainty of LLM direct analysis of raw structured data, and the difficulty in replicating the experience of experts in writing reports.

[0009] To achieve the above and other related objectives, the first aspect of this application provides a financial transaction risk analysis method based on multi-technology collaboration, comprising: acquiring internal structured data related to financial transactions of a target customer, and acquiring relevant external unstructured data from external sources based on robotic process automation (RPA) technology, and preprocessing the acquired external unstructured data to obtain external structured data; pre-constructing risk domains composed of multiple risk factors according to anti-money laundering regulatory rules, and extracting risk factors from each risk domain from the internal structured data and the external structured data to constitute risk features; inputting the risk features into a pre-constructed risk dimension identification model, and outputting scores for each risk domain; calculating the contribution score of each risk factor to the risk domain score based on SHAP analysis technology, and generating several risk factors with the highest contribution scores; inputting the scores of each risk domain, the several risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data into a large language model, which generates a financial transaction risk analysis report based on a pre-constructed prompt word template.

[0010] In some embodiments of the first aspect of this application, the pre-construction process of the risk dimension identification model is as follows: Collect historical cases marked as suspicious transactions, and define cases reported to anti-money laundering regulatory agencies after manual review as positive samples, and cases not reported after manual review as negative samples, to construct a supervised learning label set; standardize the risk features extracted from the internal structured data and the external unstructured data to obtain a risk feature matrix; input the constructed supervised learning label set and the risk feature matrix into a logistic regression model for training; construct a negative log-likelihood loss function based on maximum likelihood estimation, and use L1 or L2 regularization to limit the complexity of the logistic regression model; use gradient descent to minimize the negative log-likelihood loss function to obtain optimal parameters, thereby constructing the risk dimension identification model.

[0011] In some embodiments of the first aspect of this application, the pre-construction process of the prompt word template is as follows: obtaining multiple expert-written reports and de-identifying the obtained expert-written reports; inputting the de-identified expert-written reports into a large language model to extract analysis templates corresponding to each of the risk domains; converting the extracted analysis templates into prompt word templates corresponding to each of the risk domains and storing them to form a prompt word template library.

[0012] In some embodiments of the first aspect of this application, the preprocessing of the acquired external unstructured data to obtain external structured data specifically includes: calling an OCR engine to extract text content and its corresponding location information from externally acquired webpage screenshot data and PDF files; inputting the webpage screenshot data, PDF files, and the text content extracted by the OCR engine and its corresponding location information into a multimodal large language model, wherein the multimodal large language model outputs external structured data based on preset prompt words.

[0013] In some embodiments of the first aspect of this application, the method further includes: inputting feedback information based on the review, modification, and confirmation of the generated financial transaction risk analysis report by compliance personnel into the large language model for iterative optimization.

[0014] In some embodiments of the first aspect of this application, the risk domain includes customer identity risk information, policy information, transaction behavior, account risk information, family member risk information, abnormal fund information, and external risk information.

[0015] To achieve the above and other related objectives, a second aspect of this application provides a financial transaction risk analysis system based on multi-technology collaboration, comprising:

[0016] The acquisition module is used to acquire internal structured data related to the financial transactions of the target customer, as well as external unstructured data from external sources based on robotic process automation technology, and to preprocess the acquired external unstructured data to obtain external structured data.

[0017] The feature extraction module is used to pre-construct a risk domain consisting of multiple risk factors based on anti-money laundering regulatory rules, and extract the risk factors in each risk domain from the internal structured data and the external structured data to form risk features;

[0018] The scoring module is used to input the risk characteristics into a pre-built risk dimension identification model and output scores for each risk domain; and to calculate the contribution score of each risk factor to the risk domain score based on SHAP analysis technology, generating several risk factors with the highest contribution scores.

[0019] The report generation module is used to input the scores of each risk domain, the top risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data into the large language model. The large language model generates a financial transaction risk analysis report based on the pre-built prompt word template.

[0020] To achieve the above and other related objectives, a third aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method.

[0021] To achieve the above and other related objectives, a fourth aspect of this application provides a computer program product comprising computer program code that, when executed on a computer, causes the computer to implement the method.

[0022] To achieve the above and other related objectives, a fifth aspect of this application provides an electronic terminal, including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the method.

[0023] As described above, the financial transaction risk analysis method, system, medium, terminal, and program product based on multi-technology collaboration of this application have the following beneficial effects:

[0024] By leveraging robotic process automation (RPA) technology to automatically acquire relevant unstructured external data from external sources and preprocessing it to obtain structured external data, the bottleneck in external data acquisition is overcome, improving the efficiency of external data acquisition. Then, risk factors from pre-constructed risk domains are extracted from the acquired internal and external structured data to form risk features. A risk dimension identification model then outputs scores for each risk domain based on the input risk features, and SHAP analysis technology is used to calculate the contribution score of each risk factor to the risk domain score, thereby pre-screening risk dimensions with high contribution scores. This avoids the large language model blindly inferring from the entire dataset, significantly reducing irrelevant outputs and illusion rates. Finally, the scores of each risk domain, the highest-scoring risk factors, and the corresponding internal and external structured data are input into the large language model. The large language model generates a financial transaction risk analysis report for the target customer based on pre-constructed prompt word templates, enabling the replication of expert experience and ensuring that the output of the large language model is professional, compliant, and consistent, producing high-quality and accurate financial transaction risk analysis reports. Attached Figure Description

[0025] Figure 1 The diagram shown is a flowchart illustrating a financial transaction risk analysis method based on multi-technology collaboration in one embodiment of this application.

[0026] Figure 2 The diagram shown illustrates the working principle of a financial transaction risk analysis method based on multi-technology collaboration in one embodiment of this application.

[0027] Figure 3 The diagram shown is a block diagram of a financial transaction risk analysis system based on multi-technology collaboration in one embodiment of this application.

[0028] Figure 4 The diagram shown is a structural schematic of an electronic terminal according to an embodiment of this application. Detailed Implementation

[0029] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0030] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" do not necessarily imply that they are different.

[0031] It should be noted that, in the embodiments of this application, the words "exemplary" or "for example" refer to examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0032] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0033] Before providing a further detailed description of the present invention, the nouns and terms used in the embodiments of the present invention are explained, and the nouns and terms used in the embodiments of the present invention are subject to the following interpretations:

[0034] <1> Large Language Model (LLM): refers to a deep learning model trained on a large amount of text data, which enables the model to generate natural language text or understand the meaning of language text. These models can provide in-depth knowledge and language production on a wide range of topics by being trained on massive datasets. The core idea is to learn the patterns and structures of natural language through large-scale unsupervised training, which to some extent simulates the human language cognition and generation process.

[0035] <2> Robotic Process Automation (RPA) technology is a technology that uses software robots and artificial intelligence (AI) to automate repetitive office tasks performed by human workers. It integrates and performs repetitive tasks between enterprises and productivity applications through APIs and user interfaces (UIs).

[0036] <3> SHAP (Shapley Additive Explanations) analysis is a method for interpreting the output of machine learning models. Its core idea is to calculate the marginal contribution of each feature to the model's output, thereby interpreting the model's predictions.

[0037] <4> Logistic Regression Model: A classic linear classification algorithm. Its core idea is to use the sigmoid function to map the output of linear regression to between 0 and 1, and the output is a probability value. It is often used for binary classification tasks.

[0038] <5> Maximum Likelihood Estimation (MLE) is a commonly used parameter estimation method widely applied in statistics and machine learning. Its basic idea is to evaluate model parameters using observed data so that the probability of the observed data occurring is maximized given the parameters.

[0039] <6> L1 regularization: Regularization is achieved by adding the L1 norm of the weights (i.e., the sum of the absolute values ​​of the weight vectors) to the model's loss function. L1 regularization tends to produce a sparse weight matrix, which pushes some weights toward zero, thereby achieving the effect of feature selection.

[0040] <7> L2 regularization: Regularization is achieved by adding the L2 norm of the weights (i.e., the sum of squares of the weight vectors) to the model's loss function. L2 regularization makes the weight values ​​smaller, which can effectively control the complexity of the model, reduce the variance of the model parameters, and thus improve the stability of the model.

[0041] <8> OCR (Optical Character Recognition) engine: refers to the process by which electronic devices (such as scanners or digital cameras) examine characters printed on paper, determine their shapes by detecting dark and light patterns, and then translate the shapes into computer text using character recognition methods.

[0042] <9> Multimodal Large Language Model (MLLM) is a large-scale language model that combines the data processing and understanding capabilities of multiple modalities (such as text, images, audio, etc.). It exhibits powerful understanding and generation capabilities by encoding, aligning, and processing data from different modalities.

[0043] To facilitate understanding of the embodiments of this application, in conjunction with Figure 1 and Figure 2 Detailed explanation. Figure 1 The diagram illustrates a flowchart of a financial transaction risk analysis method based on multi-technology collaboration, as described in an embodiment of the present invention. Figure 2 This illustration shows a schematic diagram illustrating the working principle of a financial transaction risk analysis method based on multi-technology collaboration in an embodiment of the present invention. The financial transaction risk analysis report generation method based on a large language model in this embodiment includes the following steps:

[0044] Step S11: Obtain internal structured data related to the financial transactions of the target customer, and obtain relevant external unstructured data from external sources based on robotic process automation technology, and preprocess the obtained external unstructured data to obtain external structured data.

[0045] It should be noted that internal structured data refers to data related to the financial transactions of target customers obtained from within the financial institution; while external structured data refers to data related to the financial transactions of target customers obtained from outside the financial institution.

[0046] Specifically, it connects to the data platforms of financial institutions to obtain internal structured data, including full data such as basic information of target customers, family information, insurance policy information, transaction behavior information, and historical suspicious reporting records. Simultaneously, it integrates robotic process automation (RPA) technology to simulate manual operation by accessing external websites without API interfaces, such as Qichacha, the China Enforcement Information Disclosure Network, Baidu search, and the Dow Jones Risk Database. This automatically crawls external unstructured data, including webpage screenshots or downloaded PDF files, such as screenshots of equity penetration diagrams from Qichacha, screenshots of public results from the China Enforcement Information Disclosure Network, and screenshots of negative news from Baidu search. The obtained webpage screenshots or PDF files are then parsed and processed to obtain external structured data.

[0047] In some embodiments of this application, the preprocessing of the acquired external unstructured data to obtain external structured data specifically includes: calling an OCR engine to extract text content and its corresponding location information from externally acquired webpage screenshot data and PDF files; inputting the webpage screenshot data, PDF files, and the text content extracted by the OCR engine and its corresponding location information into a multimodal large language model, wherein the multimodal large language model outputs external structured data based on preset prompt words.

[0048] For example, the obtained screenshot of the equity penetration diagram is preprocessed. First, an OCR engine is used to identify the text content and corresponding location information from the screenshot. Then, the screenshot, the identified text content, and the corresponding location information are input into a multimodal large language model. The multimodal large language model is used for semantic understanding, thereby outputting external structured data based on preset prompts. For example, the multimodal large language model used is LLaVA or Qwen-VL.

[0049] Step S12: Based on anti-money laundering regulatory rules, a risk domain consisting of multiple risk factors is pre-constructed, and risk factors in each risk domain are extracted from the internal structured data and the external structured data to form risk characteristics.

[0050] In real-world applications, transaction risk assessment requires integrating multimodal data such as basic customer information, historical transaction flows, external blacklists, and public opinion summaries. However, existing technologies often process various types of data in isolation, lacking a unified semantic alignment and context aggregation framework. This makes it difficult to integrate multi-source heterogeneous data, resulting in fragmented LLM input information and affecting the overall judgment quality. At the same time, since transaction fields (such as "counterpartie ID" and "premium amount") do not carry semantic intent, while anti-money laundering regulatory rules are usually expressed in natural language (such as "frequent large-amount fund transfers in a short period of time"), it is difficult to bridge the semantic gap between structured data and natural language. Constructing an effective intermediate representation that enables LLM to accurately understand the compliance meaning behind structured data is a prerequisite for achieving reliable reasoning. To address this, in step S12, internal and external structured data are integrated, and risk factors with semantic information are extracted from each risk domain from the internal and external structured data. The extracted risk factors are used to construct risk features, thereby building an effective representation between structured data and natural language semantics, effectively bridging the gap between structured data and natural language semantics, and facilitating the large language model to accurately understand the meaning of compliance.

[0051] In some embodiments of this application, the risk domain includes customer identity risk information, policy information, transaction behavior, account risk information, family member risk information, abnormal fund information, and external risk information.

[0052] Specifically, customer identity risk information is used to monitor whether there are any abnormal or high-risk characteristics in a customer's basic identity attributes. This includes several risk factors such as: occupational risk level (policyholder role); age at which a customer purchases a high-risk product, such as a minor or elderly person purchasing a complex financial product; abnormalities in telephone, occupation, and document validity information, such as invalid contact information, occupation not matching income, or expired documents; and whether there is a history of high-risk occupations, such as having previously worked in high-risk occupations that are of concern to regulators.

[0053] Policy information is used to focus on whether the structure, product type, and payment mode of the policy itself exhibit abnormal concentration or high-risk characteristics. It includes several risk factors such as: the number and proportion of high-risk policies, for example, customers holding a large number of high-risk products (such as short-term lump-sum universal life insurance); a high proportion of policies with a payment period of ≤3 years, which means that they may be used for short-term arbitrage or money laundering; the same policyholder repeatedly purchasing the same product with the same insured within 30 days, which means suspected "brushing" or circumventing risk control; the number of times concentrated insurance purchase warnings are triggered, which means that a large number of insurance purchase behaviors are abnormal in a short period of time; and the insurance branches are scattered (involving multiple institutions), which may be to circumvent the risk control of a single institution.

[0054] Transaction behavior analysis is used to determine if a customer's behavior patterns in insurance purchases, loans, repayments, and policy surrenders are abnormal. This analysis includes several risk factors: frequent changes of policyholders within 180 days of policy effectiveness suggest potential asset transfers or concealment of the true controller; a surge in loan amounts over the past year (e.g., a sudden increase of more than three times) indicates abnormal funding needs or misuse; policy surrenders concentrated outside of the premium payment period or within two years of policy effectiveness suggest non-compliance with normal protection needs and are suspected of being for cash-out purposes; single loan amounts concentrated between 190,000 and 200,000 RMB (for ordinary customers) or 390,000 and 400,000 RMB (for VIP customers) indicate deliberate circumvention of large-amount monitoring thresholds; an excessive number of accounts used for initial premium payments suggests dispersed and suspicious funding sources; and large sums of additional premiums for universal life insurance policies may be used for fund pooling or money laundering.

[0055] Customer risk information is used to assess whether a customer has been flagged as a high-risk entity. It includes several risk factors, such as whether the customer is involved in suspicious transactions, for example, being alerted by the anti-money laundering system; and whether the customer matches a sanction or blacklist, such as being on a police or OFAC list.

[0056] Family member risk information is used to expand risk identification through related persons (family members), and includes the following risk factors: whether family members are involved in suspicious transactions or list matching, indicating that the risk is contagious; family members holding policies under the name of the insured are scattered across multiple branches, which may indicate that the family is circumventing supervision in a family-style manner; family members have high occupational risk levels, which indirectly reflects the risk of the customer's environment.

[0057] Anomaly information is used to monitor fund flows and whether account usage exhibits abnormal patterns. It includes several risk factors such as: high correlation between fees and cash (high SAER risk level), large proportion of cash transactions, and low transparency; loans, policy surrenders, and refunds involving multiple exit accounts, with funds being transferred out in a dispersed manner, suspected of being split and transferred; and the use of multiple different bank accounts to receive payments for policy surrenders within one year, in order to evade fund tracking.

[0058] External risk information is used to integrate risk ratings provided by third parties or regulatory agencies, which include the following risk factors: external risk level, such as a comprehensive score from credit bureaus, police, and international sanctions databases.

[0059] Step S13: Input the risk characteristics into the pre-built risk dimension identification model and output the scores of each risk domain; and calculate the contribution score of each risk factor to the risk domain score based on SHAP analysis technology, and generate several risk factors with the highest contribution scores.

[0060] In some embodiments of this application, the pre-construction process of the risk dimension identification model is as follows: Collect historical cases marked as suspicious transactions, and define cases reported to anti-money laundering regulatory agencies after manual review as positive samples, and cases not reported after manual review as negative samples, to construct a supervised learning label set; standardize the risk features extracted from the internal structured data and the external unstructured data to obtain a risk feature matrix; input the constructed supervised learning label set and the risk feature matrix into a logistic regression model for training; construct a negative log-likelihood loss function based on maximum likelihood estimation, and use L1 or L2 regularization to limit the complexity of the logistic regression model; use gradient descent to minimize the negative log-likelihood loss function to obtain optimal parameters, thereby constructing the risk dimension identification model.

[0061] Specifically, an offline logistic regression model is trained based on risk characteristics and historical reported cases to obtain a risk dimension identification model. The online-trained risk dimension identification model scores the financial transactions of target customers from an anti-money laundering perspective to identify several risk domains with the highest contribution. The specific process is as follows:

[0062] First, using all historically flagged suspicious transactions as the base dataset, suspicious transaction cases that have been manually reviewed and formally reported to anti-money laundering regulatory agencies (such as anti-money laundering monitoring and analysis centers) are defined as positive samples (black samples), and their labels are... Transactions initially screened as suspicious but not reported after manual review are defined as negative samples (white samples), and their labels are... Thus, a complete supervised learning label set is constructed. ,in, The set of labels for the entire supervised learning dataset; Indicates the first The labels of each sample; This represents the total number of historically suspicious transactions.

[0063] Secondly, for the current client's suspicious financial transactions, a set of predefined risk factors are extracted from the acquired internal and external structured data to form risk characteristics. ,in, Indicates the first Risk feature vector of each sample; For risk factor dimensions; Indicates the first The first sample The values ​​of each risk factor are then processed. Risk features are standardized, including but not limited to: performing min-max scaling or Z-score standardization on continuous risk factors to scale their distribution to a uniform scale; performing one-hot encoding or target encoding on categorical risk factors; and optionally introducing feature interaction terms, binning discretization, or business rule-based derived features to enhance the model's expressive power. The standardized risk feature matrix is ​​then obtained. ,in, This represents the risk feature matrix after processing the entire dataset; For the real number field; This represents the rows and columns of the feature matrix.

[0064] Then, a logistic regression model is used to fit the supervised learning label set and risk features. The form of the logistic regression model is as follows:

[0065] ;Formula (1)

[0066] in, This indicates the probability that the sample is predicted to be positive. Use the Sigmoid activation function; Let be the weight vector to be learned; For bias terms; This is the transpose operation.

[0067] During model training, optimizing the objective loss function based on maximum likelihood estimation is equivalent to minimizing the negative log-likelihood loss function, as shown in the following formula:

[0068] ;Formula (2)

[0069] in, Indicates the total number of samples; This indicates the probability that the sample is predicted to be a positive sample. Indicates the first The true label of each sample.

[0070] Meanwhile, to limit the complexity of the logistic regression model and prevent overfitting, L1 or L2 regularization is added to the negative log-likelihood loss function, as shown in the following formula:

[0071] ;Formula (3)

[0072] in, ; This is the hyperparameter for regularization intensity.

[0073] The optimal parameters are solved by minimizing the negative log-likelihood function using gradient descent methods (such as L-BFGS, SGD, etc.). After training, the optimal parameters are substituted into the model to obtain the final risk dimension scoring function. This scoring function is used to measure the suspiciousness of the target customer's transaction. The higher the score, the more likely the transaction is to be a high-risk transaction that should be reported to anti-money laundering regulatory agencies. The function formula is as follows:

[0074] ;Formula (4)

[0075] in, This is the transpose operation.

[0076] By using all historical suspicious transactions as the full sample, and whether or not they were reported as the label, reported cases are designated as black samples (positive samples), while unreported suspicious cases are designated as white samples (negative samples). The variable is the risk factor. The extracted risk factors are processed through feature engineering, such as normalization, and then fitted and trained to obtain a logistic regression scoring function. The risk dimension identification model obtained from offline training and SHAP analysis technology are used as an interpretable scorer. Based on the input risk feature vector after internal and external fusion, the overall risk score and the scores of each risk factor are output to automatically and reliably identify the Top-K risk domains with the highest contribution. This allows the large language model to focus on the real risk dimensions, avoiding the illusion, low correlation, and uninterpretable problems caused by generalizing inferences from the full data.

[0077] Step S14: Input the scores of each risk domain, the risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data into the large language model. The large language model generates a financial transaction risk analysis report based on the pre-built prompt word template.

[0078] In some embodiments of this application, the pre-construction process of the prompt word template is as follows: multiple expert-written reports are acquired and anonymized; the anonymized expert-written reports are input into a large language model to extract analysis templates corresponding to each risk domain; the extracted analysis templates are converted into prompt word templates corresponding to each risk domain and stored to form a prompt word template library. By reproducing and automating the analytical reasoning logic of expert-written risk reports, the financial transaction risk reports generated by the large language model are made more professional and consistent, and the generation efficiency is improved.

[0079] In the offline phase, a large language model is used to fine-tune or learn in-context from high-quality risk reports written by experts throughout history. Standard analytical logic templates for different risk dimensions are extracted from over 500 expert reports, including analytical approaches and document writing techniques for each risk domain. For example, "If a client transfers funds to multiple unrelated third parties in a short period and the amount is close to the regulatory threshold, there may be instances of splitting transactions to evade monitoring." The extracted logical analysis templates are then used to generate dynamic prompt templates, which include constraints such as regulatory basis, analytical framework, and evidence citation format. Because compliant wording needs to be strictly controlled to avoid LLM (Limited Language Management) improvisation, strong constraint prompt engineering is prioritized for constraint. For example, the prompt template is: "You are an anti-money laundering compliance expert. Please write a risk analysis report based on the following facts: [Risk Domain]: {risk_domain} [Regulatory Clause]: {regulation_clause} [Factual Evidence]: {evidence_list}. Requirements: 1. Use formal compliance language; 2. Clearly identify the risky behavior; 3. Citify specific evidence numbers."

[0080] Due to the continuous updates to financial compliance rules (such as revisions to anti-money laundering guidelines), traditional fine-tuning or static prompt templates are unable to respond quickly to changes, and the adaptation to dynamic regulatory rules lags behind. Therefore, constructing a mechanism that supports the dynamic injection of the latest regulatory provisions and guides LLMs to adjust their analysis logic and output format accordingly remains a key bottleneck for project implementation. To address this, this application designs a dynamic prompt template. After revisions to financial compliance rules, only the "regulatory basis" in the prompt template needs to be updated, enabling the large language model to generate reports based on the real-time updated regulatory basis.

[0081] Finally, the scores of each risk domain, the top-scoring risk factors, and the corresponding internal and external structured data are input into the large language model as context and injected into the prompt word template, driving the large language model to generate a financial transaction risk analysis report that is clearly structured, logically rigorous, and traceable.

[0082] Because financial regulation emphasizes "evidence-based conclusions and verifiable processes," the black-box nature of models makes their reasoning paths opaque. Without a controllable chain-of-thought, evidence citation mechanism, or output constraint strategy, the generated content will be difficult to verify through internal audits or external regulatory oversight. To ensure that risk assessments meet auditability and traceability requirements, the generated trading analysis reports should clearly indicate the sources of risk facts (such as transaction IDs and external links), cite regulatory provisions, and retain a manual review process to ensure traceability throughout the entire process and verifiable conclusions.

[0083] In some embodiments of this application, the method further includes inputting feedback information based on the review, modification, and confirmation of the generated financial transaction risk analysis report by compliance personnel into the large language model for iterative optimization.

[0084] Specifically, for the financial transaction risk analysis reports generated by the large language model, compliance personnel review, confirm, and revise them. All final reports, along with the corresponding original data and intermediate risk domain labels, are stored in the feedback database. The feedback database is used periodically to perform instruction tuning or reinforcement learning (RLHF) on the large language model, so as to achieve continuous accumulation of expert experience and iterative optimization of the model.

[0085] This application's financial transaction risk analysis method, based on multi-technology collaboration, utilizes robotic process automation (RoLA) technology to automatically collect external data from API-less websites, overcoming the bottleneck of external data acquisition, replacing manual queries, and significantly improving data acquisition efficiency. Furthermore, it introduces interpretable machine learning models, namely logistic regression and SHAP analysis, to pre-screen high-contribution risk dimensions, accurately focusing on risk priorities, avoiding blind inference by LLM on the entire dataset, and significantly reducing illusion rate and irrelevant output. Simultaneously, by offline distillation of the analytical logic from high-quality historical reports, it constructs structured prompt word templates to enable expert... The replicability of experience ensures that LLM outputs are professional, compliant, and consistent, allowing even newcomers to produce high-quality reports. Furthermore, the generated reports clearly indicate the sources of risk facts (such as transaction IDs and external links), cite regulatory provisions, and retain a manual review process, ensuring traceability throughout the entire process and verifiable conclusions, meeting regulatory auditability requirements. When new anti-money laundering regulations are released or updated, only the regulatory basis section of the prompt template needs to be updated, without retraining the model, enabling rapid response and supporting dynamic rule adaptation. The final drafts are manually reviewed to feed back into the model training, allowing it to continuously approach expert levels over time, overcoming the shortcomings of traditional AI's "static deployment and fixed capabilities," and forming a closed-loop learning mechanism.

[0086] To further explain the workflow of the multi-technology collaborative financial transaction risk analysis method of this application, a specific example is given, taking the risk screening of an insurance customer as an example:

[0087] First, internal data is aggregated, specifically: acquiring data on the customer's policy change records, surrender amounts, and counterparties for fund transfers over the past year, and generating tags such as "number of surrenders" and "fund recipients involved in 3 different provinces." Simultaneously, external data is crawled; using RPA to automatically log into the enforcement network, the customer's name and ID number are searched, revealing that they are the legal representative of a company and have been listed as a dishonest judgment debtor. Experience data about the company is also retrieved from Qichacha (a business information platform), identifying operational risks. Next, risk scoring and dimension identification are performed. A risk dimension identification model is used to integrate internal and external data tags; for example, a risk score of 45 is given. SHAP analysis reveals that the main risk dimensions are "legal representative involved in enforcement" (contributing 30 points) and "abnormal surrender behavior" (contributing 15 points). Finally, in the report generation stage, report generation prompts are written, including the following:

[0088] 1. Case Description: This includes [Customer Identity Information], [Family Member Identity Information], [Risk Information], [Policy Information], [Loan Repayment Information], [Personal Account Value Withdrawal Information], [Change of Policyholder Information], [Qichacha], and [China Enforcement Information Network]. This section is filled in using a template, for example: [Customer Identity Information] Customer Name: Zhang San, Gender: Female, Age: 45, Date of Birth: 1980-03-20, Nationality: China, ID Number: 12345, Employer: A New Materials Company, Occupation: Administrative Staff, Annual Income: 3 million RMB, Contact Number: 1111, Address: [Address]. [Policy Information] Customer Zhang San holds a total of 21 insurance policies, transaction region: Guangdong, of which 9 are valid (payment period), 1 has been paid off, 9 have been terminated, and 2 were withdrawn during the underwriting period. Insurance Period: 2002 to 2025. The client has 12 insurance policies for themselves, 5 policies for their 2 children, 2 policies for their spouse, and 2 policies for their parents. The types of insurance are traditional insurance, accident insurance, and health insurance; there are no high-risk or medium-to-high-risk policies. Health and accident insurance policies constitute the majority. The total annualized premium for policies in the payment period is approximately RMB 74,253.50. There is no record of entrusting personal payments, no record of entrusting employer payments, and no record of cross-border premium payments. The total premium paid is approximately RMB 2,955,936.00. The client has a history of loan repayments, a history of changing policyholders on current policies, and a history of policy surrenders. The surrender occurred in October 2025, totaling RMB 580,000, with receiving accounts at numbers 1234, 5678, and 9099. There is also a history of withdrawing personal account value.

[0089] 2. The risk dimension identification model and SHAP analysis technology are used to score the risk domain and summarize the scores of each risk factor. The data is then passed to the LLM, with prompts indicating that higher scores indicate higher risk, as shown in Table 1.

[0090] Table 1 Risk Domains and Scores of Each Risk Factor

[0091]

[0092] 3. Analytical thinking templates obtained based on expert knowledge distillation. For example, in this scenario, the analytical thinking template involved is as follows:

[0093] "The customer concentrated on handling multiple surrender transactions in a short period, with a cumulative amount of [amount] yuan, and the receiving accounts were scattered and lacked a reasonable business background, meeting the suspicious characteristics of 'evading large / suspicious transaction monitoring through scattered surrender'."

[0094] "The customer [Name / Company Name] is the legal representative / principal person in charge of [Related Enterprise Name] and was listed as a person subject to enforcement for failing to fulfill legal obligations by [Court Name] on [Inclusion Date] (Case Number: [Full Case Number]). In accordance with Article 15 of the Anti-Money Laundering Provisions of Financial Institutions regarding'requiring enhanced due diligence measures for high-risk customers', the customer should be included in the management of high-risk customers, and the legality of the transaction background, source of funds, and use of funds should be reviewed with emphasis."

[0095] Based on the above information, the large language model generated a certain paragraph in the financial transaction analysis report of this customer as follows:

[0096] "Upon verification, the customer, [Customer Name], as the legal representative of [Company Name], was listed as a person subject to enforcement by the XX Court in March 2025 (Case Number: (20××) Jing×××× Zhi×××× Hao). In accordance with Article 15 of the Anti-Money Laundering Provisions of Financial Institutions, the legality of the source of funds should be emphasized. At the same time, the customer concentrated on handling 3 surrender transactions in October 2025, with a total amount of 580,000 yuan. The receiving accounts were scattered and there was no reasonable business background, meeting the characteristics of 'evading monitoring through scattered surrender in a short period'..."

[0097] Finally, after manual confirmation and feedback, the compliance officer confirmed that the report was correct and submitted it for archiving. This case was subsequently used to fine-tune the LLM's judgment ability for the "combination mode of person involved in law enforcement + abnormal surrender".

[0098] [[ID=2�]] Figure 3 It is a schematic block diagram of a financial transaction risk analysis system based on multi-technology collaboration provided by an embodiment of the present application. As Figure 3 shown, the financial transaction risk analysis system 300 based on multi-technology collaboration includes:[[ID=2८]]

[0099] An acquisition module 301, configured to acquire internal structured data related to the financial transactions of the target customer, and acquire relevant external unstructured data from external sources based on robotic process automation technology, and preprocess the acquired external unstructured data to obtain external structured data;

[0100] The feature extraction module 302 is used to pre-construct a risk domain consisting of multiple risk factors based on anti-money laundering regulatory rules, and extract the risk factors in each risk domain from the internal structured data and the external structured data to form risk features;

[0101] The scoring module 303 is used to input the risk characteristics into a pre-built risk dimension identification model, output the scores of each risk domain, and calculate the contribution score of each risk factor to the risk domain score based on SHAP analysis technology, and generate several risk factors with the highest contribution scores.

[0102] The report generation module 304 is used to input the scores of each risk domain, the risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data into the large language model. The large language model generates a financial transaction risk analysis report based on the pre-built prompt word template.

[0103] It should be understood that the specific process of each module performing the above-mentioned steps has been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity.

[0104] It should also be understood that the module division in the embodiments of this application is illustrative and only represents a logical functional division; in actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0105] Figure 4 This is a schematic block diagram of the electronic terminal provided in an embodiment of this application. Figure 4 As shown, the electronic terminal 400 includes at least one processor 401, a memory 402, at least one network interface 403, and a user interface 405. The various components in the electronic terminal 400 are coupled together via a bus system 404. It is understood that the bus system 404 is used to implement communication between these components. In addition to a data bus, the bus system 404 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 4 The general will label all buses as bus systems.

[0106] The user interface 405 may include a monitor, keyboard, mouse, trackball, clicker, button, touchpad, or touch screen.

[0107] It is understood that memory 402 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM) or programmable read-only memory (PROM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM) and synchronous static random access memory (SSRAM). The memories described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable categories of memory.

[0108] In this embodiment of the invention, the memory 402 is used to store various types of data to support the operation of the electronic terminal 400. Examples of this data include: any executable program for operation on the electronic terminal 400, such as the operating system 4021 and application programs 4022; the operating system 4021 includes various system programs, such as the framework layer, core library layer, driver layer, etc., for implementing various basic services and handling hardware-based tasks. The application program 4022 may include various applications, such as a media player, browser, etc., for implementing various application services. The methods provided in this embodiment of the invention can be included in the application program 4022.

[0109] The methods disclosed in the above embodiments of the present invention can be applied to processor 401, or implemented by processor 401. Processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 401 or by instructions in the form of software. The processor 401 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 401 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. General-purpose processor 401 may be a microprocessor or any conventional processor, etc. The steps of the accessory optimization method provided in the embodiments of the present invention can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in a memory. The processor reads the information in the memory and combines it with its hardware to complete the steps of the aforementioned method.

[0110] In an exemplary embodiment, the electronic terminal 400 may be used by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), or complex programmable logic devices (CPLDs) to execute the aforementioned method.

[0111] According to the method provided in the embodiments of this application, this application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to execute... Figures 1 to 2 The method of any of the embodiments shown.

[0112] According to the method provided in the embodiments of this application, this application also provides a computer-readable storage medium storing program code, which, when executed on a computer, causes the computer to perform... Figures 1 to 2 The method of any of the embodiments shown.

[0113] As used in this specification, the terms "component," "module," "system," etc., are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0114] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0115] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0117] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0118] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0119] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. A computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs, DVDs), or semiconductor media (e.g., solid-state disks, SSDs, etc.).

[0120] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0121] In summary, addressing the technical challenges of existing technologies in rapidly acquiring external data, the uncertainty inherent in directly analyzing raw structured data using LLM, and the difficulty in replicating the experience of experts in writing reports, this application provides a financial transaction risk analysis method, system, medium, terminal, and program product based on multi-technology collaboration. This intelligent risk analysis is designed for compliance scenarios such as Anti-Money Laundering (AML). It utilizes structured business data to identify high-risk dimensions and combines Large Language Modeling (LLM) to learn from historical expert analysis logic, automatically generating risk assessment reports with professional explanatory power. Specifically, it automatically acquires relevant external unstructured data from external sources using robotic process automation (LBA) technology and preprocesses the acquired external unstructured data to obtain external structured data, thus overcoming the bottleneck in external data acquisition and improving the efficiency of external data acquisition. Then, risk factors from pre-constructed risk domains are extracted from the acquired internal and external structured data to form risk features. A risk dimension identification model is then used to output scores for each risk domain based on the input risk features. SHAP analysis technology is used to calculate the contribution score of each risk factor to the risk domain score, thereby pre-screening risk dimensions with high contribution scores. This avoids the large language model blindly inferring from the entire dataset, significantly reducing irrelevant outputs and illusion rates. Finally, the scores of each risk domain, the highest-scoring risk factors, and the corresponding internal and external structured data are input into the large language model. The large language model generates a financial transaction risk analysis report for the target customer based on pre-constructed prompt word templates, enabling the replication of expert experience. This ensures that the output of the large language model is professional, compliant, and consistent, producing high-quality and accurate financial transaction risk analysis reports. Therefore, this application effectively overcomes the various shortcomings of existing technologies and has high industrial application value.

[0122] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A financial transaction risk analysis method based on multi-technology collaboration, characterized in that, include: Acquire internal structured data related to the financial transactions of target customers, and acquire relevant external unstructured data from external sources based on robotic process automation technology, and preprocess the acquired external unstructured data to obtain external structured data; Based on anti-money laundering regulatory rules, a risk domain consisting of multiple risk factors is pre-constructed, and risk factors in each risk domain are extracted from the internal structured data and the external structured data to form risk characteristics; The risk characteristics are input into a pre-built risk dimension identification model, and the scores of each risk domain are output. Based on SHAP analysis technology, the contribution score of each risk factor to the risk domain score is calculated, and the risk factors with the highest contribution scores are generated. The scores of each risk domain, the risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data are input into the large language model. The large language model generates a financial transaction risk analysis report based on the pre-built prompt word template.

2. The financial transaction risk analysis method based on multi-technology collaboration according to claim 1, characterized in that, The pre-construction process of the risk dimension identification model is as follows: Collect historical cases marked as suspicious transactions, define cases that are reported to anti-money laundering regulatory agencies after manual review as positive samples, and define cases that are not reported after manual review as negative samples, in order to construct a supervised learning label set; The risk features extracted from the internal structured data and the external unstructured data are standardized to obtain a risk feature matrix; The constructed supervised learning label set and the risk feature matrix are input into the logistic regression model for training; A negative log-likelihood loss function is constructed based on maximum likelihood estimation, and L1 or L2 regularization is used to limit the complexity of the logistic regression model. The optimal parameters are obtained by minimizing the negative log-likelihood loss function using gradient descent to construct the risk dimension identification model.

3. The financial transaction risk analysis method based on multi-technology collaboration according to claim 1, characterized in that, The pre-construction process of the prompt word template is as follows: Obtain multiple expert-written reports and anonymize them. The anonymized expert-written reports are input into the large language model to extract analysis templates corresponding to each of the risk domains. The extracted analysis templates are converted into prompt word templates corresponding to each of the risk domains and stored to form a prompt word template library.

4. The financial transaction risk analysis method based on multi-technology collaboration according to claim 1, characterized in that, The specific process of preprocessing the acquired external unstructured data to obtain external structured data includes: The OCR engine is used to extract text content and its corresponding location information from webpage screenshots and PDF files obtained from external sources. Webpage screenshots, PDF files, and text content extracted by the OCR engine along with their corresponding location information are input into a multimodal large language model. The multimodal large language model outputs external structured data based on preset prompts.

5. The financial transaction risk analysis method based on multi-technology collaboration according to claim 1, characterized in that, Also includes: Feedback information from compliance personnel who review, modify, and confirm the generated financial transaction risk analysis reports will be input into the large language model for iterative optimization.

6. The financial transaction risk analysis method based on multi-technology collaboration according to claim 1, characterized in that, The risk domains include customer identity risk information, policy information, transaction behavior, account risk information, family member risk information, abnormal fund information, and external risk information.

7. A financial transaction risk analysis system based on multi-technology collaboration, characterized in that, include: The acquisition module is used to acquire internal structured data related to the financial transactions of the target customer, as well as external unstructured data from external sources based on robotic process automation technology, and to preprocess the acquired external unstructured data to obtain external structured data. The feature extraction module is used to pre-construct a risk domain consisting of multiple risk factors based on anti-money laundering regulatory rules, and extract the risk factors in each risk domain from the internal structured data and the external structured data to form risk features; The scoring module is used to input the risk features into a pre-built risk dimension identification model and output scores for each risk domain. Based on SHAP analysis technology, the contribution score of each risk factor to the risk domain score is calculated, and the risk factors with the highest contribution scores are generated. The report generation module is used to input the scores of each risk domain, the risk factors with the highest contribution scores, and the corresponding internal structured data and external structured data into the large language model. The large language model generates a financial transaction risk analysis report based on the pre-built prompt word template.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

9. A computer program product, characterized in that, The computer program product includes computer program code that, when run on a computer, causes the computer to implement the method as described in any one of claims 1 to 6.

10. An electronic terminal, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method as described in any one of claims 1 to 6.