A cross-border platform anti-money laundering system and method based on three-rail account book isolation and hash reconciliation

Abstract

The application discloses a cross-border platform anti-money laundering system and method based on three-track account book isolation and hash reconciliation, and belongs to the technical field of cross-border payment clearing and supply chain financial risk control. In the prior art, the cross-border trade platform faces structured vulnerabilities such as small risk cross-pool diffusion, factoring pre-loan arbitrage, real logistics and fund flow time difference, and illegal use of overseas accounts for money laundering. The application constructs three independent account books at the bottom layer of the clearing total gateway, implements hierarchical isolation and cross-pool fusing, blocks the conduction of small risks to the head settlement channel, generates unique anonymous feature codes of orders and logistics through irreversible salt value hash algorithm, performs collision comparison during settlement, and aligns one release with one. A dynamic credit fusing gateway is embedded in the access end of the factoring agency, low-activity accounts are screened and intercepted through activity detection and refund rate, factoring associated funds are released in stages, and the platform compliance responsibility boundary is locked at the hash collision completion node. The application is used for fund risk control in the field of cross-border trade platform and supply chain finance, and meets the requirements of penetrating review of the multilateral regulatory framework and the data minimization principle of personal information protection regulations.

Description

Technical Field

[0001] This invention relates to the fields of cross-border payment clearing, supply chain finance risk control, and privacy computing technology. Specifically, it relates to a system and method for performing pre-settlement authenticity verification and dynamic credit granting on the flow of funds, logistics, and orders in a cross-border trade platform by utilizing a multi-tenant three-track ledger isolation architecture, an irreversible salt value hash collision reconciliation model, and a factoring pre-circuit breaker gateway. Background Technology

[0002] In recent years, the regulatory framework for global cross-border payments and supply chain finance has continued to tighten. The OECD-led Common Reporting Standard (CRS) has been implemented globally, requiring financial institutions in participating jurisdictions to automatically exchange information on non-resident financial accounts. The EU's Anti-Money Laundering Directive (AMLD) has been updated to its sixth version, bringing virtual asset servicers under its regulatory scope and imposing higher requirements on the transparency of cross-border capital flows. The US CHIPS settlement system, as a major global channel for cross-border dollar clearing, continues to align its transaction monitoring standards with international anti-money laundering rules. The BOSS Act (Anti-Money Laundering and Counter-Terrorism Financing Act) strengthens the requirement for penetrating the ultimate beneficiaries of legal entities. Meanwhile, the full implementation of the Golden Tax System Phase IV in China integrates multi-source data from taxation, customs, industry and commerce, and banking into a unified regulatory network, replacing "reporting penetration" with "data penetration" to achieve closed-loop monitoring of enterprises' cash flow, invoice flow, and logistics.

[0003] The aforementioned regulatory system is shifting from "single-point compliance" to "full-chain penetration." Any mismatch of funds, discrepancies between goods and documents, or ambiguity of the subject matter in cross-border trade may trigger multiple regulatory thresholds, leading to fund freezes, account closures, or even criminal compliance reviews.

[0004] Furthermore, a high-frequency path exists in cross-border money laundering activities: Illegal entities acquire debit card accounts opened in domestic banks by overseas individuals through social networks or underground channels. Utilizing the dual attributes of these accounts ("domestic physical account + overseas individual identity"), they create fictitious orders on cross-border trade platforms and transfer funds overseas through factoring advance lending mechanisms, forming a closed loop of "domestic fund inflow → fictitious orders → factoring advance → overseas outflow." This type of money laundering relies heavily on the separation between the bank account's real name and the operator's identity—the account holder and the operator are not the same entity legally and physically. However, existing cross-border trade risk control systems lack mandatory binding of overseas user identity anchors during the registration process and do not incorporate bank card identification codes and passport numbers into the same hash system, causing the system to be unable to identify identity gaps in the fund flow before settlement.

[0005] However, the current cross-border payment and supply chain finance system still has the following shortcomings in its technical architecture:

[0006] (1) Lack of accounting segregation: All participants (large merchants, small and medium-sized manufacturers, and individual investors) share the same clearing channel. Small risk events can be transmitted to the settlement chain of leading merchants through high-frequency complaints, abnormal write-offs, etc., forming a systemic failure of "small amount contaminating large amount";

[0007] (2) The contradiction between privacy compliance and penetrating supervision: The current system must rely on plaintext information such as order details, bank card number, and logistics tracking number when settling accounts and reconciling accounts. It is difficult to simultaneously meet the data minimization requirements of personal information protection regulations and the dual requirements of regulatory penetrating review.

[0008] (3) Arbitrage loopholes in factoring early disbursement: Illegal entities use inactive accounts to place orders and fraudulently obtain early disbursement from cooperating factoring institutions before transferring the funds. Existing risk control systems cannot distinguish between genuine trade and order-placing arbitrage before factoring disbursement, resulting in factoring funds being continuously exposed to fraud risks;

[0009] (4) Settlement time difference between real logistics and cash flow: There is a natural time difference between order generation and goods receipt confirmation. The existing system does not enforce the verification of logistics confirmation status during settlement, resulting in a large number of refund orders, return orders, and unconfirmed receipt orders being included in the settlement flow, distorting the merchant's real transaction amount;

[0010] (5) Structural gap between regulatory pressure and technical capabilities: There is a structural gap between the continuous increase in regulatory pressure and the ability to verify the authenticity of transactions, resulting in high compliance costs and compliance risks accumulating on both the platform and the merchants. Summary of the Invention

[0011] To overcome the shortcomings of the prior art, this invention provides a cross-border platform anti-money laundering system and method based on three-track ledger segregation and hash reconciliation. The core technical solution of this invention comprises the following three main modules:

[0012] (a) Multi-tenant three-track ledger isolation architecture

[0013] This invention constructs a Triple-Track Ledger Architecture at the bottom layer of the clearing gateway, implementing hierarchical isolation based on merchant size and risk rating:

[0014] Track 1 (Top Merchant Isolation Pool): This track accommodates large multinational merchants whose annual transaction volume exceeds a set threshold. It monitors large-scale stability fluctuations and prioritizes the efficiency of large-scale transactions. This track has an independent clearing channel and a fund reserve pool, unaffected by minor anomalies.

[0015] The second track (mid-tier SME pool): This track provides standard supply chain finance and factoring credit. It operates a tiered lending mechanism (see Module 3 for details), allowing for independent extraction and phased release of factoring-related funds.

[0016] The third track (retail micro-merchant pool): isolates high-frequency, fragmented small-amount retail investors. This track operates on a dynamic credit granting model driven by truth-based behavioral profiles. All complaints and high-frequency write-offs caused by risk control interception are closed-loop circuit breakers within the third track, preventing "cross-pool contamination" of small-amount sudden risks to the first track and the group's overall clearing pool.

[0017] Physical-level circuit breakers are installed between the three tracks. When the abnormal complaint rate or abnormal write-off rate of any track exceeds a preset threshold, the system will automatically close the funding channel between that track and the main pool to ensure that the risk does not spread across the pool.

[0018] (II) Real-time collision and pre-settlement cleaning model of one-way anonymous hash signature

[0019] This system uses an asymmetric privacy-preserving reconciliation matrix to perform a "pre-settlement cleaning window" on all orders to be settled before settlement, filtering out refunds, returns, and orders with unconfirmed receipt.

[0020] In the milliseconds that the consumer makes a payment, the system seamlessly extracts the bank card number and device identification code, generates a unique anonymous hash feature code using an irreversible salt hash algorithm (such as SHA-256 or the national cryptographic standard SM3), and silently collects it into the underlying database, completely masking the real identity of the physical person.

[0021] Before the month-end settlement node, a preset time window (e.g., seven days) is established, and the risk control engine initiates pixel-level transaction alignment. The account numbers are compared with the front-end hash signatures in the memory matrix—"align one transaction, let one transaction through." If hedging funds without historical order hash support are found, the system performs localized and precise interception of this "contaminated funds" with zero latency.

[0022] Meanwhile, during the overseas user registration process, the system forcibly collects and verifies the user's passport information. After registration, the system merges the user's passport number with the identification code of their linked bank card, generating an "identity-account binding hash anchor" using an irreversible salt hash algorithm. During monthly settlement and reconciliation, the system performs bank card identification code consistency verification and passport number consistency verification on each order to be settled. If, within a preset time window, the system detects that the same passport is associated with more than a set number of different bank cards, or the same bank card is associated with more than a set number of different login devices, the system automatically marks it as "suspicious identity aggregation" and triggers an investigation process, suspending the factoring early loan channel for that account until manual verification is completed.

[0023] The hash collision pool has a built-in data sovereignty and access control mechanism:

[0024] (1) The order data, bank card identification code and logistics hash uploaded by each participant are processed by irreversible salt value hashing before entering the collision pool. The collision pool performs secondary encryption to prevent the original information from being restored when the underlying data is attacked from the outside.

[0025] (2) Access control for the collision pool is implemented in a hierarchical manner: compliant personnel can only view the summary information of the collision results (such as "Order A and logistics hash match successfully"), without exposing the original order data or the identity of the counterparty; the complete collision log and original data table can only be downloaded by senior management personnel at or above the set level with a digital certificate.

[0026] (iii) Factoring pre-arbitrage circuit breaker gateway

[0027] This invention embeds a dynamic credit fulfillment rate and account entropy value flow circuit breaker gateway at the front end of the cooperative factoring institution's access point, refusing to provide arbitrage opportunities for merchants without actual physical ownership of goods.

[0028] Merchant activity detection: When a merchant initiates a "factoring early withdrawal / loan" application, the system traces back to the set of users associated with that merchant, calculating their historical login frequency, device fingerprint overlap, and lifecycle trajectory. If a high proportion of accounts are determined to be inactive for an extended period, the factoring gateway directly triggers a loan disbursement rejection circuit breaker.

[0029] Refund Rate Grid Screening: The system calculates the difference between a merchant's "actual net income and refund rate" in real time within a settlement cycle. If an abnormal surge in the historical refund rate is detected (such as exceeding a set threshold), it indicates suspected money laundering activities such as "using factoring cycles to exploit time differences, transferring funds in advance, and then issuing large-scale refunds afterward." The system will forcibly disable the merchant's advance foreign exchange settlement function and revert them to the standard "settlement after physical goods confirmation" process.

[0030] Tiered lending for SMEs: When a single vendor's monthly net actual transaction volume exceeds a preset threshold (such as a set amount), the system automatically withdraws this portion of funds from the cleansing pool, marking it as "factoring-related funds." This portion of funds does not enter the normal monthly settlement process but instead enters a tiered release queue: the initial release in the current month does not exceed a set percentage of the approved net amount; subsequent releases are based on constants such as the merchant's historical transaction stability, refund rate, and logistics confirmation cycle, and are gradually released monthly over the following months; the overall release cycle does not exceed a set number of days.

[0031] Retail investor behavior profiling assessment: For retail merchants in the third track with high frequency and fragmented transactions, the system dynamically decides whether to grant loans based on a four-dimensional profile of activity score, net turnover trend, refund rate curve, and abnormal IP marking. If the frequency of "order placement-refund" cycles exceeds a preset threshold in a single period, the system automatically freezes the factoring early withdrawal function and returns the funds to the "settlement after physical goods confirmation" process.

[0032] Platform responsibility boundaries are defined as follows: Once the system completes hash collision and net amount verification, the platform is deemed to have fulfilled its pre-emptive fault detection and compliant liquidation obligations. The repayment tracking and default handling of factoring-related funds are the sole responsibility of the cooperating factoring party; the platform does not participate in the recovery process between the factoring party and the merchant. The system only outputs the merchant's net amount verification conclusion and historical stability parameters to the factoring party, which independently makes subsequent credit decisions and risk management based on these parameters. Detailed Implementation

[0033] Example 1: Three-track isolation and cross-pool fuse

[0034] A cross-border trade platform has attracted several large multinational merchants (Channel 1), a number of small and medium-sized manufacturing enterprises with annual turnover ranging from tens of millions to hundreds of millions of yuan (Channel 2), and a large number of individual merchants (Channel 3). One day, several individual merchants in Channel 3 filed refund complaints due to risk control intervention, collectively initiating work orders with the platform. Because Channel 3 has an independent complaint handling channel, all abnormal complaints were closed-loop and circuit-broken within Channel 3. The settlement channels for top merchants in Channel 1 were unaffected; their daily settlements ran normally in the high-value channels without any delays or malfunctions.

[0035] Example 2: Hash Collision and Pre-washing – Real Trade Verification

[0036] A small-to-medium-sized manufacturer generated multiple orders during its monthly settlement cycle. Some of these orders had been refunded by consumers, while others remained unconfirmed. Before settlement, a pre-set time window was established, during which the system entered a pre-cleaning phase: refund orders and unconfirmed orders were removed from the settlement pool, and the remaining orders entered a hash collision pool. The system compared each of the remaining orders with a logistics confirmation hash. Successful matches proceeded to the settlement process, while unsuccessful matches had no corresponding logistics hash. Transactions without actual logistics support were frozen and not included in the settlement process. The manufacturer's actual settlement amount for the month was the actual transaction amount corresponding to the successfully matched orders.

[0037] Example 3: Factoring Pre-Trial Circuit Breaker – Low-Activity Accounts and Arbitrage Interception

[0038] A retail merchant initiated a "factoring early loan disbursement" application. The system traced back to the user set of the merchant's recent orders: a large number of orders came from the same device fingerprint, and this device fingerprint had been associated with orders from multiple different retail merchants recently. The system determined that this group of orders was a low-activity account engaging in fraudulent order placement, and the factoring gateway directly triggered a loan disbursement rejection circuit breaker. The merchant's early withdrawal function was disabled, and the funds were returned to the "settlement after physical goods confirmation" channel.

[0039] Example 4: Suspicious Identity Aggregation and Interception of Overseas Accounts

[0040] The system detected anomalies in the association between the identification codes and passport numbers of multiple bank cards during the pre-settlement cleaning window. These bank cards all originated from the same overseas passport number, and all of them had been associated with multiple different login devices within a short period. Some of these bank cards were involved in orders with refund rates exceeding a set threshold in the previous settlement cycle. The system automatically flagged this group of bank cards as having "suspicious identity aggregation" and suspended the factoring advance loan channel for all accounts associated with this passport number. After reviewing the collision summary, the platform's compliance personnel confirmed that all of these abnormal orders involved the same overseas passport number, and the login IP corresponding to this passport number had shifted across multiple countries within a short period. The system then locked all accounts in this batch and forwarded the information to the risk control team for manual verification.

[0041] Example 5: Data Sovereignty Protection of Hash Collision Pools

[0042] During a settlement period, a platform's partner factoring institution requested to view the complete settlement data of its creditworthy merchants. Platform compliance personnel logging into the system could only view a summary of the collision results. The complete collision log and original hash table could only be accessed by senior management personnel at or above the platform's designated level using digital certificates. The download log recorded the operator, operation time, and the range of data downloaded. This operation record was automatically stored in the collision pool audit log.

[0043] Beneficial effects

[0044] 1. By using a three-track ledger isolation architecture, the spread of small-amount risk events to the settlement channels of leading merchants is blocked, avoiding systemic failures of "small-amount contaminating large-amount" and reducing the failure rate and operational pressure of the platform's clearing gateway.

[0045] 2. By using a pre-processing cleaning window, refund orders, return orders, and unconfirmed receipt orders are removed before settlement to ensure that the settlement basis is the actual transaction amount and prevent fund mismatch due to time differences.

[0046] 3. By using irreversible salt value hash collision technology, anonymous reconciliation is achieved, ensuring that "data is available but not visible," while simultaneously meeting the data minimization requirements and the requirements of transparent regulatory auditing in accordance with relevant personal information protection regulations.

[0047] 4. By using identity-account binding hash anchor technology, passports and bank card identification codes are forcibly bound during the overseas user registration process, blocking high-frequency paths for overseas accounts to be illegally acquired and used for money laundering.

[0048] 5. By using a factoring pre-circuit breaker gateway, intercept arbitrage activities such as low-activity accounts making fraudulent orders, abnormal refund rates, and suspicious identity aggregation before loan disbursement, thus breaking the fraud loop of "factoring pre-disbursement → fund transfer → large-scale refunds afterward".

[0049] 6. By using a tiered lending mechanism, factoring-related funds for small and medium-sized manufacturers can be released in installments, reducing the risk of concentrated bad debts for factoring parties, extending the risk exposure window, and improving the safe recovery rate of factoring funds.

[0050] 7. By using a hash collision pool for data sovereignty and a secondary encryption mechanism, the commercial data sovereignty of all participants is protected, external attacks are prevented from restoring the underlying data, and hierarchical access control for compliance personnel and management personnel is achieved.

[0051] 8. By locking the platform's compliance responsibility boundary at the hash collision completion node, the responsibility of the platform and the factoring party in fund recovery and default handling is clarified, thereby reducing the platform's compliance guarantee risk.

Claims

1. A method for anti-money laundering on cross-border platforms based on three-track ledger segregation and hash reconciliation, characterized in that, Includes the following steps: (1) Construct three independent operating ledgers at the bottom layer of the clearing gateway and implement hierarchical isolation based on the size and risk rating of the merchants: the first track carries large merchants, the second track carries small and medium-sized manufacturers, and the third track carries individual merchants. Physical-level circuit breaker valves are set between the three tracks. (2) Before the settlement node, the system performs pre-settlement cleaning on all orders to be settled, and removes refund orders, return orders and unconfirmed receipt orders; (3) When the consumer pays, the system extracts the bank card number and device identification code, generates an anonymous hash feature code through an irreversible salt hash algorithm, and compares the order hash with the logistics confirmation hash during settlement, and releases one order at a time if they are aligned. (4) A dynamic credit circuit breaker gateway is embedded in the front end of the cooperative factoring institution's access terminal. When a merchant initiates a factoring early loan application, the system reversely traces the activity level of its associated users, the overlap of device fingerprints, and the historical refund rate. If the abnormal threshold is triggered, the loan will be rejected. (5) When the monthly net real transaction amount of a single merchant exceeds the preset threshold, the system will identify the funds as factoring-related funds, which will not be included in the normal settlement of the current month, but will be included in the tiered release queue and gradually released in subsequent cycles. (6) The hash collision pool has a built-in data sovereignty and access control mechanism. Before entering the collision pool, the data of each participant undergoes irreversible hashing. The collision pool performs secondary encryption and implements hierarchical control of access permissions.

2. The method according to claim 1, characterized in that, The three-track ledger is equipped with a physical-level circuit breaker valve. When the abnormal complaint rate or abnormal write-off rate of any track exceeds a preset threshold, the system automatically closes the funding channel between that track and the main pool.

3. The method according to claim 1, characterized in that, The pre-settlement cleaning window is seven days before the settlement node. During this window period, the system performs a process to remove refund orders, return orders, and unconfirmed receipt orders from all orders to be settled, and only includes the cleaned net transaction amount in the hash collision reconciliation process.

4. The method according to claim 1, characterized in that, The irreversible salt hash algorithm is SHA-256 or the national cryptographic standard SM3. The system concatenates the user identifier, bank card identification code, passport number and timestamp, and then generates a fixed-length anonymous hash feature code through salt hashing to replace the original sensitive information in the clearing and reconciliation process.

5. The method according to claim 1, characterized in that, When overseas users register, the system forcibly collects and verifies the user's passport information, merges the passport number with the identification code of the bank card it is linked to, and generates an identity-account binding hash anchor using an irreversible salt value hash algorithm. During clearing and reconciliation, the system performs bank card identification code consistency verification and passport number consistency verification on each order to be settled. When the system detects that the same passport is associated with more than a set number of different bank cards or the same bank card is associated with more than a set number of different login devices within a preset time window, the system automatically marks it as "identity aggregation suspicious" and triggers the investigation process, suspending the factoring early loan channel for that account.

6. The method according to claim 1, characterized in that, The release rules for the tiered release queue are as follows: the initial release in the current month shall not exceed a set percentage of the approved net amount; subsequent releases shall be made gradually on a monthly basis in subsequent periods based on the merchant's historical transaction stability, refund rate, and logistics confirmation cycle parameters; the overall release period shall not exceed the set number of days.

7. The method according to claim 1, characterized in that, The data sovereignty and access control mechanism of the hash collision pool includes: the order data, bank card identification code and logistics hash uploaded by each participant are irreversibly salted and hashed before entering the collision pool, and secondary encryption is performed inside the collision pool; compliance personnel can only view the summary information of the collision results, and the complete collision log and original table can only be downloaded by managers at the set level or above with digital certificates, and the download operation is automatically recorded in the audit log.

8. A cross-border platform anti-money laundering system based on three-track ledger segregation and hash reconciliation, characterized in that, include: (1) Three-track ledger isolation module: used to build three-track independent operating ledgers at the bottom layer of the clearing main gateway, and implement hierarchical isolation and cross-pool circuit breaking based on merchant size and risk rating; (2) Anonymous hash feature code generation and collision module: used to extract bank card number and device identification code when consumers pay to generate irreversible salt value hash feature code, and to perform collision comparison between order hash and logistics hash during settlement; (3) Pre-cleaning module: used to remove refund orders, return orders and unconfirmed receipt orders before the settlement node; (4) Factoring pre-circuit breaker gateway module: used to perform activity detection, refund rate screening and low-activity account blocking on the factoring advance loan application of merchants at the access end of the cooperating factoring institution; (5) Tiered loan disbursement module: used to release factoring-related funds in installments that exceed a preset threshold; (6) Data sovereignty and access control module: used to perform secondary encryption and hierarchical access control on hash data in the collision pool.