CN111738868A - Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium - Google Patents

Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium Download PDF

Info

Publication number
CN111738868A
CN111738868A CN202010529627.1A CN202010529627A CN111738868A CN 111738868 A CN111738868 A CN 111738868A CN 202010529627 A CN202010529627 A CN 202010529627A CN 111738868 A CN111738868 A CN 111738868A
Authority
CN
China
Prior art keywords
monitoring
risk
money laundering
rule model
financing
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010529627.1A
Other languages
Chinese (zh)
Inventor
熊国平
李瑶
刘春姿
董明
伍薇
陈锦坤
巫天华
刘永刚
高安
晋雯
曹玮航
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Xiangshang Yixin Technology Co ltd
Original Assignee
Beijing Xiangshang Yixin Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Xiangshang Yixin Technology Co ltd filed Critical Beijing Xiangshang Yixin Technology Co ltd
Priority to CN202010529627.1A priority Critical patent/CN111738868A/en
Publication of CN111738868A publication Critical patent/CN111738868A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/08Insurance
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/3003Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/302Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24Querying
    • G06F16/245Query processing
    • G06F16/2455Query execution
    • G06F16/24564Applying rules; Deductive queries

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Business, Economics & Management (AREA)
  • Technology Law (AREA)
  • Strategic Management (AREA)
  • Marketing (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Mathematical Physics (AREA)
  • Quality & Reliability (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

The invention provides an anti-money laundering anti-terrorist financing risk monitoring method, an anti-money laundering anti-terrorist financing risk monitoring device, computer equipment and a storage medium. The method comprises the following steps: presetting a rule model library for monitoring the risk of anti-money laundering and anti-terrorism financing, wherein the rule model library comprises a plurality of rule models; monitoring whether the rule model base changes or not; modifying the monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model used when the monitoring task is executed, a data source and a data storage position of a calculation result, the monitoring task is used for acquiring data from the data source, the risk level of the money laundering terrorism financing risk is calculated by using the rule model, and the calculation result is input to the data storage position; monitoring whether user information changes; and when the user information changes, starting a monitoring task to calculate the risk level of the risk of the user for carrying out money laundering terrorism financing. By the method and the device, the accuracy and the real-time performance of monitoring the risk of anti-terrorist financing of anti-money laundering can be improved.

Description

Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium
Technical Field
The invention relates to the technical field of risk monitoring, in particular to an anti-money laundering anti-terrorist financing risk monitoring method and device, computer equipment and a storage medium.
Background
The technology improves the financial service efficiency, simultaneously, makes the financial risk more covert and quickly disseminated, and exerts unprecedented pressure on the technical ability of financial supervision. Meeting compliance requirements is an important factor for financial institutions to reduce risks and promote the continuous development of financial markets. Conventional compliance management performs file management in an offline manner, requiring a large amount of human resources and time costs. With the continuous development of financial science and technology, the supervision science and technology is considered as a main means for preventing and dealing with financial risks, and the important purpose is to improve the supervision efficiency and carry out supervision and management on a supervised organization more pertinently.
In the supervision field, monitoring of the risk of anti-money laundering and anti-terrorist financing is an important part, in the current financial network, an anti-money laundering and anti-terrorist financing system is generally arranged to monitor suspicious money laundering and anti-terrorist financing accounts, in the prior art, the system mainly carries out statistical analysis on offline transaction data through some fixed analysis models so as to obtain corresponding offline analysis results, and the following problems exist in the mode: on one hand, with the continuous upgrading of the money laundering terrorism financing activity, the existing analysis model can not better adapt to the change generated by the upgrading, thereby influencing the monitoring accuracy; on the other hand, the offline analysis mode lacks the online identification capability, and online transaction data cannot be analyzed in time, so that the timeliness of monitoring the anti-money laundering and anti-terrorism financing behavior is not high, and the risk account is not easy to find in time and relevant control measures are taken.
Therefore, the problems of low accuracy and poor real-time performance of the anti-money laundering anti-terrorist financing system in the prior art become technical problems which need to be solved in the field.
Disclosure of Invention
The invention aims to provide an anti-money laundering anti-terrorist financing risk monitoring method, an anti-money laundering anti-terrorist financing risk monitoring device, computer equipment and a storage medium, which are used for solving the technical problems in the prior art.
In one aspect, the invention provides an anti-money laundering anti-terrorist financing risk monitoring method.
The anti-money laundering anti-terrorist financing risk monitoring method comprises the following steps: presetting a rule model base for monitoring the risk of anti-money laundering and anti-terrorism financing, wherein the rule model base comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering and terrorism financing; monitoring whether the rule model base changes or not; modifying the monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model used when the monitoring task is executed, a data source and a data storage position of a calculation result, the monitoring task is used for acquiring data from the data source, the risk level of the money laundering terrorism financing risk is calculated by using the rule model, and the calculation result is input to the data storage position; monitoring whether user information changes; and when the user information changes, starting a monitoring task to calculate the risk level of the risk of the user for carrying out money laundering terrorism financing.
Further, the user information comprises user profile information and information for representing that the user has money-in and money-out behaviors.
Further, the step of monitoring whether the user information changes includes: acquiring the updating time of user data information; and determining whether the user profile information is changed according to the updating time.
Further, the step of monitoring whether the user information changes includes: obtaining the table operation of the deposit and withdrawal record table of the user; and determining whether the user has cash-in and cash-out behaviors according to the table operation.
Further, the user profile information includes user characteristics and account characteristics of the user, and the rule model calculates the terrorist money laundering risk level by the following steps: calculating a first sub-parameter of the risk level according to the corresponding relation between the preset user characteristics and the risk level; calculating a second sub-parameter of the risk level according to the corresponding relation between the preset account characteristics and the risk level; calculating a third sub-parameter of the risk level according to the preset corresponding relation between the combination of the user characteristic and the account characteristic and the risk level; and calculating the risk level of money laundering terrorism financing according to the first sub-parameter of the risk level, the second sub-parameter of the risk level and the third sub-parameter of the risk level.
Further, the information for representing the user having the money entrance behavior comprises the money discharge amount, the money entrance amount, the money discharge amount in unit time, the account balance, the transaction times in a preset time length before the current time and/or the occurrence frequency of the money entrance behavior, and the rule model calculates the terrorist money laundering risk level through the following steps: judging whether the money amount is larger than a first money amount threshold value or not, and if the money amount is larger than the first money amount threshold value, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the deposit amount is greater than a second amount threshold value or not, and if the deposit amount is greater than the second amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the cash-out amount in unit time is larger than the percentage threshold of the historical accumulated cash-in amount, and if the cash-out amount in unit time is larger than the percentage threshold, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the account balance is greater than a third amount threshold value, and if the account balance is greater than the third amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the transaction times within a preset time length before the current time is smaller than a time threshold, if the transaction times is smaller than the time threshold, judging whether the account balance is larger than a fourth amount threshold, and if the account balance is larger than the fourth amount threshold, determining that the money laundering terrorist financing risk level reaches a preset level; and judging whether the occurrence frequency of the money entrance and exit behaviors is greater than a frequency threshold, and if the occurrence frequency is greater than the frequency threshold, determining that the money laundering terrorism financing risk level reaches a preset level.
Further, the step of modifying the monitoring task based on changes occurring to the rule model base includes: when a rule model is added to the rule model base, a corresponding monitoring task is added to the monitoring engine; when the rule model base deletes the rule model, deleting the corresponding monitoring task in the monitoring engine; and when the rule model in the rule model base is updated, updating the configuration information of the corresponding monitoring task in the monitoring engine.
On the other hand, in order to achieve the purpose, the invention also provides an anti-money laundering anti-terrorist financing risk monitoring device.
This anti-terrorist financing risk monitoring device of money laundering includes: the system comprises a presetting module, a monitoring module and a monitoring module, wherein the presetting module is used for presetting a rule model library for monitoring the risk of anti-money laundering anti-terrorism financing, the rule model library comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering terrorism financing; the first monitoring module is used for monitoring whether the rule model base changes or not; the modification module is used for modifying the monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model used when the monitoring task is executed, a data source and a data storage position of a calculation result, the monitoring task is used for acquiring data from the data source, calculating the risk level of money laundering terrorism financing risk by using the rule model, and inputting the calculation result to the data storage position; the second monitoring module is used for monitoring whether the user information changes; and the starting module is used for starting the monitoring task when the user information changes so as to calculate the risk level of the risk of money laundering terrorism financing of the user.
To achieve the above object, the present invention also provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the above method when executing the computer program.
To achieve the above object, the present invention also provides a computer-readable storage medium having stored thereon a computer program which, when being executed by a processor, carries out the steps of the above method.
The invention provides a method, a device, computer equipment and a storage medium for monitoring anti-money laundering anti-terrorism financing risk, wherein a rule model library for monitoring anti-money laundering anti-terrorism financing risk is preset, a plurality of rule models included in the rule model library are used for calculating the risk level of money laundering anti-terrorism financing risk, the rule model library can be configured and modified in real time, whether the rule model library changes or not is monitored in the monitoring process, if the rule model library is modified, the rule model library changes, when the rule model library changes, a monitoring task is modified according to the change of the rule model library, the monitoring task is used for calculating the risk level of money laundering financing risk, wherein relevant information in the calculating process is limited by configuration information, the configuration information specifically comprises the rule models used in executing the monitoring task, data sources and data storage positions of calculation results, therefore, the monitoring task calculates the risk level of the money laundering terrorism financing risk for the data obtained from the data source by using the rule model, and inputs the calculation result to the data storage position; in the monitoring process, whether user data information changes or not is monitored, and when the user information changes, a monitoring task is started to calculate the risk level of the risk of money laundering terrorism financing of a user, so that the method, the device, the computer equipment and the storage medium for monitoring the risk of money laundering terrorism financing are adopted, and a rule model base is configured, so that the rule model base can be modified by reconfiguring a rule model meeting requirements along with the change upgrading of financial activities, the change upgrading of compliance requirements and the like, and the corresponding monitoring task can be triggered to change when the rule model base changes, so that the linked change of the monitoring task along with the change of the rule model is realized; when the change of the user data information is monitored, the monitoring task is triggered to be started, and the risk level is calculated again according to the change of the user data information, so that the method, the device, the computer equipment and the storage medium for monitoring the risk of anti-terrorist financing of anti-money laundering can improve the accuracy and the real-time performance of the anti-terrorist financing system of anti-money laundering.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
FIG. 1 is a flowchart of a method for monitoring risk of anti-money laundering, anti-terrorist financing according to an embodiment of the present invention;
FIG. 2 is a block diagram of an anti-money laundering anti-terrorist financing risk monitoring device according to a second embodiment of the present invention;
fig. 3 is a hardware structure diagram of a computer device according to a third embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In order to solve the technical problems in the prior art, the invention provides an anti-money laundering anti-terrorist financing risk monitoring method, an anti-money laundering anti-terrorist financing risk monitoring device, computer equipment and a storage medium, wherein in the anti-money laundering anti-terrorist financing risk monitoring method, a plurality of rule models can be established according to money laundering, terrorist financing and corresponding regulations and requirements of a financial supervision institution, each rule model is used for calculating the risk level of money laundering terrorist financing risk, and the rule models are preset to form a rule model library for monitoring the anti-money laundering anti-terrorist financing risk; when the rule model library is modified with any change, for example, the rule model is added, the rule model is deleted, the rule model is updated, and the like, modification of the monitoring task is triggered, the operation of the monitoring task is executed according to the configuration information of the monitoring task, specifically, the configuration information of the monitoring task comprises the rule model, a data source and a data storage position of a calculation result, which are used when the monitoring task is executed, so that the monitoring task can acquire data from the configured data source when running, calculate the risk level of money laundering and terrorism financing risk by using the configured rule model, and input the calculation result to the configured data storage position, that is, the monitoring task can automatically change correspondingly along with the change in the rule model library, therefore, when the existing rule model in the rule model library cannot adapt to a new monitoring requirement or a monitoring scene, the rule model base can be modified, and the modification of the corresponding monitoring task is automatically triggered, so that the monitoring process can better adapt to the change of the money laundering terrorist financing activity, and the monitoring accuracy is improved; in the monitoring process, whether the user information changes or not can be monitored in real time, when the user information changes, the monitoring task is started in real time, after the monitoring task is started, the risk level of the money laundering terrorism financing risk of the user can be calculated, the online transaction data can be analyzed in real time, online identification of the money laundering terrorism financing risk is provided, and the monitoring timeliness is improved.
Specific embodiments of the method, apparatus, computer device and storage medium for monitoring risk of anti-money laundering anti-terrorist financing provided by the present invention will be described in detail below.
Example one
An embodiment of the present invention provides an anti-money laundering anti-terrorist financing risk monitoring method, by which accuracy and real-time performance of anti-money laundering anti-terrorist financing risk monitoring can be improved, and specifically, fig. 1 is a flowchart of the anti-money laundering anti-terrorist financing risk monitoring method provided by the embodiment of the present invention, as shown in fig. 1, the anti-money laundering anti-terrorist financing risk monitoring method includes the following steps S101 to S105:
step S101: and presetting a rule model library for monitoring the risk of anti-money laundering and anti-terrorism financing.
Wherein the rule model library comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering terrorism financing.
Specifically, the rule model is also a rule for calculating the risk level of the money laundering terrorist financing risk, in which data required for calculation and a calculation method are involved, one rule model may individually determine and output the risk level of the anti-money laundering terrorist financing risk, or a plurality of rule models may jointly determine and output the risk level of the anti-money laundering terrorist financing risk, which is not limited in the present application.
The rule models in the rule model library can be configured before monitoring, or alternatively, in the monitoring process, service configuration personnel can perform real-time online configuration on the rule model library, including adding new rule models in the rule model library, deleting existing rule models in the rule model library, performing partial modification and updating on existing rule models in the rule model library, and the like, so that the real-time performance of modification effectiveness of the rule model library can be ensured. Further optionally, a visual interface for modifying the rule model library is provided, operation modification is performed on the visual interface by a service configuration personnel, the modification is automatically translated into a computer bottom rule code by a background program, and convenience for modifying the rule model library can be improved.
Step S102: and monitoring whether the rule model base changes.
The monitoring of the rule model library can be realized based on operations received on the rule model configuration visual interface, or based on read-write operations of storage media of the rule model library, or other monitoring modes in the prior art can be adopted, and the specific monitoring mode is not limited in the application.
Step S103: and modifying the monitoring task according to the change of the rule model base.
The configuration information of the monitoring task comprises a rule model, a data source and a data storage position of a calculation result, wherein the rule model is used when the monitoring task is executed, the monitoring task is used for acquiring data from the data source, the rule model is used for calculating the risk level of the risk of money laundering terrorism financing, and the calculation result is input to the data storage position.
Specifically, the monitoring task is used for calculating the risk level of the money laundering terrorism financing risk, the calculation process is configured by the configuration information of the monitoring task, and the configuration information defines which rule model is specifically used when calculating the risk level, optionally, a uniquely identifiable identifier can be set for the rule model, and the identifier is set in the configuration information to define the rule model used for executing the monitoring task; in addition, the configuration information also defines a data source used in calculating the risk level, and the data source may be a data interface provided by other platforms, systems and the like, or may also be a data storage path such as a database, a table and the like; the configuration information also defines the data storage position of the calculation result obtained after the risk level is calculated, so that the platform or the system for displaying the data result can read the risk level from the data storage position for displaying.
It should be noted that, in a case where each monitoring task also configures the same data source and the same data storage location of the calculation result, the same data source and the same data storage location of the calculation result may be used as a default configuration in the configuration information without specific description, and in this case, the present application also falls within the protection scope.
Optionally, the modifying of the rule model library includes adding, deleting, and updating the rule model, and the monitoring task is set in the monitoring engine, and then the step S103, that is, the step of modifying the monitoring task according to the change of the rule model library, may further specifically include:
when the rule model is added to the rule model base, corresponding monitoring tasks are added to the monitoring engine, and based on the fact, when the risk level of the terror money laundering financing activity needs to be calculated for the new financial activity, the corresponding rule models can be added to the rule model base, and the corresponding monitoring tasks are triggered to be automatically added to the monitoring engine, so that the change of the anti-terror money laundering risk monitoring along with the change of the financial activity on line and in real time is ensured, and the monitoring accuracy and timeliness are also ensured;
when the rule model base deletes the rule model, the corresponding monitoring task is deleted in the monitoring engine, and based on the fact, when some financial activities disappear along with the change of science and technology or market, the corresponding rule model can be deleted in the rule model base, and the corresponding monitoring task is triggered to be automatically deleted in the monitoring engine, so that the redundant processing of the anti-terror financing risk monitoring of the anti-money laundering can be avoided, on one hand, the effectiveness of the anti-terror financing risk monitoring of the anti-money laundering is ensured, and on the other hand, the redundant processing is prevented from occupying the processing resources of effective monitoring;
when the rule model in the rule model base is updated, the configuration information of the corresponding monitoring task is updated in the monitoring engine, and based on the configuration information, when the existing financial activity or the specified part required to be met by the financial activity changes, the corresponding rule model in the rule model base can be updated, and the corresponding monitoring task is automatically triggered to be updated in the monitoring engine, so that the monitoring of the anti-terrorist financing risk of anti-money laundering can be changed along with the change of the financial activity on line and in real time, and the monitoring accuracy and timeliness are also ensured.
Step S104: and monitoring whether the user information changes.
The user information comprises user profile information and information for representing that the user has money-making and money-paying behaviors, wherein the user profile information further comprises user characteristics and account characteristics of the user, the characteristics of the user can comprise information such as age, nationality, education level, occupation and gender of the user, and the account characteristics of the user comprise information such as account opening time, account balance and activity level of the account. The information representing the deposit and withdrawal behaviors of the user comprises information such as the deposit amount, the deposit amount in unit time, account balance, transaction times in a preset time length before the current time and/or the occurrence frequency of the deposit and withdrawal behaviors.
On one hand, for the scenario of monitoring whether the user profile information changes, for the step S104, that is, the step of monitoring whether the user information changes, further includes: acquiring the updating time of user data information; and determining whether the user profile information is changed according to the updating time. Optionally, the user profile has time information such as a timestamp or valid time, the update time of the user profile can be determined through the time information, when the user profile changes, the update time of the user profile is correspondingly changed into the time when the user profile changes, an acquisition period of the update time of the user profile information can be set, if the update times acquired in two adjacent acquisition periods are consistent, the user profile information is represented to be unchanged, and if the update times acquired in two adjacent acquisition periods are inconsistent, the user profile information is represented to be changed.
On the other hand, for the scenario of monitoring whether the information representing the user having the deposit and withdrawal behavior changes, for the step S104, that is, the step of monitoring whether the user information changes, the method further includes: obtaining the table operation of the deposit and withdrawal record table of the user; and determining whether the user has cash-in and cash-out behaviors according to the table operation. Alternatively, an deposit/withdrawal record table is provided corresponding to the deposit/withdrawal behavior of the user, and when the user has the deposit/withdrawal behavior, a change in deposit/withdrawal is written in the deposit/withdrawal record table, so that it is possible to determine whether the user has the deposit/withdrawal behavior based on the table operation of the deposit/withdrawal record table. The method comprises the steps of setting an acquisition period of table operation of an access fund record table, representing that a user has no access fund behavior in the acquisition period if the table operation is not acquired in the acquisition period, and representing that the user has the access fund behavior in the acquisition period if the table operation is acquired in the acquisition period. It should be noted that the acquisition period in this place may be set to have a different period length from the acquisition period mentioned in the above paragraph.
Step S105: and when the user information changes, starting a monitoring task to calculate the risk level of the risk of money laundering terrorism financing of the user.
In step S105, when the user information changes, a monitoring task is started, and the monitoring task calculates the risk level of the money laundering terrorism financing risk of the user according to the configuration information, and performs risk prompt by using the calculated risk level.
In the method for monitoring risk of anti-money laundering anti-terrorism financing, a rule model library for monitoring risk of anti-money laundering anti-terrorism financing is preset, the rule model library comprises a plurality of rule models for calculating risk level of risk of money laundering terrorism financing, the rule model library can be configured and modified in real time, in the monitoring process, whether the rule model library changes or not is monitored, if the rule model library is modified, the rule model library changes, when the rule model library changes, a monitoring task is modified according to the change of the rule model library, the monitoring task is used for calculating risk level of risk of money laundering terrorism financing, wherein relevant information in the calculating process is limited by configuration information, the configuration information specifically comprises the rule model used when the monitoring task is executed, a data source and a data storage position of a calculation result, therefore, the monitoring task calculates the risk level of the money laundering terrorism financing risk for the data obtained from the data source by using the rule model, and inputs the calculation result to the data storage position; in the monitoring process, whether user data information changes or not is monitored, and when the user information changes, a monitoring task is started to calculate the risk level of the user for carrying out terror money laundering risk, so that the rule model base is configured, so that the rule model meeting the requirements can be reconfigured to modify the rule model base along with the change upgrade of financial activities, the change upgrade of compliance requirements and the like, and the corresponding monitoring task can be triggered to change due to the change of the rule model base, so that the linked change of the monitoring task along with the change of the rule model is realized; when the change of the user data information is monitored, the monitoring task is triggered to be started, and the risk level is calculated again according to the change of the user data information, so that the accuracy and the real-time performance of the anti-money laundering anti-terrorist financing risk monitoring method provided by the embodiment can be improved.
Optionally, in one embodiment, the user profile information includes user characteristics and account characteristics of the user, and the rules model calculates the washed money terrorism financing risk level by: calculating a first sub-parameter of the risk level according to the corresponding relation between the preset user characteristics and the risk level; calculating a second sub-parameter of the risk level according to the corresponding relation between the preset account characteristics and the risk level; calculating a third sub-parameter of the risk level according to the preset corresponding relation between the combination of the user characteristic and the account characteristic and the risk level; and calculating the risk level of money laundering terrorism financing according to the first sub-parameter of the risk level, the second sub-parameter of the risk level and the third sub-parameter of the risk level.
By adopting the anti-money laundering anti-terrorist financing risk monitoring method provided by the embodiment, the comprehensive calculation of the money laundering terrorist financing risk level can be realized according to the user characteristics and the account characteristics of the user, so that the money laundering terrorist financing risk level can be comprehensively evaluated based on the user characteristics and the account characteristics of the user, and the accuracy of the money laundering terrorist financing risk level evaluation is further improved.
Optionally, in an embodiment, the information characterizing the user having money entrance and money exit behavior includes a money amount, a money entrance amount, a money exit amount per unit time, an account balance, a number of transactions within a preset time period before a current time and/or an occurrence frequency of money entrance and money exit behavior, and the rule model calculates the money laundering terrorism financing risk level by: judging whether the money amount is larger than a first money amount threshold value or not, and if the money amount is larger than the first money amount threshold value, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the deposit amount is greater than a second amount threshold value or not, and if the deposit amount is greater than the second amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the cash-out amount in unit time is larger than the percentage threshold of the historical accumulated cash-in amount, and if the cash-out amount in unit time is larger than the percentage threshold, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the account balance is greater than a third amount threshold value, and if the account balance is greater than the third amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the transaction times within a preset time length before the current time is smaller than a time threshold, if the transaction times is smaller than the time threshold, judging whether the account balance is larger than a fourth amount threshold, and if the account balance is larger than the fourth amount threshold, determining that the money laundering terrorist financing risk level reaches a preset level; and judging whether the occurrence frequency of the money entrance and exit behaviors is greater than a frequency threshold, and if the occurrence frequency is greater than the frequency threshold, determining that the money laundering terrorism financing risk level reaches a preset level.
By adopting the anti-money laundering anti-terrorism financing risk monitoring method provided by the embodiment, the calculation of the money laundering terrorism financing risk level can be realized according to the money accessing behavior of the user, so that the money laundering terrorism financing risk level can be evaluated based on multiple dimensions of the money accessing behavior of the user, and the accuracy of the money laundering terrorism financing risk level evaluation is further improved.
Optionally, in an embodiment, a flink cluster is set, and when a rule model base changes, a corresponding jobb (also called a monitoring task) is triggered to be submitted to the flink cluster, where the jobb is defined with a source (also called a data source), a sink (also called a data storage location of a calculation result) and an operator (also called a rule model), and when user profile information changes, corresponding data is collected into kafka and mysql through a data collection service, and when the data enters kafka, the flink jobb is started to run, so as to run the corresponding rule, and score is given according to a predetermined score, thereby implementing risk level calculation of risk of money laundering terrorism financing risk.
Example two
Corresponding to the first embodiment, the second embodiment of the present invention provides an anti-money laundering anti-terrorist financing risk monitoring device, and reference may be made to the first embodiment for corresponding technical features and corresponding technical effects, which are not described herein again. Fig. 2 is a block diagram of an anti-money laundering anti-terrorist financing risk monitoring apparatus according to a second embodiment of the present invention, as shown in fig. 2, the apparatus includes: a preset module 201, a first monitoring module 202, a modification module 203, a second monitoring module 204, and an initiation module 205.
The preset module 201 is used for presetting a rule model library for monitoring the risk of anti-money laundering and anti-terrorism financing, wherein the rule model library comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering and terrorism financing; the first monitoring module 202 is used for monitoring whether the rule model base changes; the modification module 203 is used for modifying the monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model used when the monitoring task is executed, a data source and a data storage position of a calculation result, the monitoring task is used for acquiring data from the data source, calculating the risk level of money laundering terrorism financing risk by using the rule model, and inputting the calculation result to the data storage position; the second monitoring module 204 is configured to monitor whether the user information changes; and the starting module 205 is used for starting a monitoring task when the user information changes so as to calculate the risk level of the risk of money laundering terrorism financing of the user.
Optionally, in one embodiment, the user information includes user profile information and information characterizing that the user has money in and out behavior.
Optionally, in an embodiment, the second monitoring module 204 includes a first monitoring unit, and the first monitoring unit is configured to obtain an update time of the user profile information, and determine whether the user profile information changes according to the update time.
Optionally, in an embodiment, the second monitoring module 204 includes a second monitoring unit, and the second monitoring unit is configured to obtain a table operation of an deposit and withdrawal record table of the user, and determine whether the user has deposit and withdrawal behaviors according to the table operation.
Optionally, in one embodiment, the user profile information includes user characteristics and account characteristics of the user, and the rules model calculates the washed money terrorism financing risk level by: calculating a first sub-parameter of the risk level according to the corresponding relation between the preset user characteristics and the risk level; calculating a second sub-parameter of the risk level according to the corresponding relation between the preset account characteristics and the risk level; calculating a third sub-parameter of the risk level according to the preset corresponding relation between the combination of the user characteristic and the account characteristic and the risk level; and calculating the risk level of money laundering terrorism financing according to the first sub-parameter of the risk level, the second sub-parameter of the risk level and the third sub-parameter of the risk level.
Optionally, in an embodiment, the information characterizing the user having money entrance and money exit behavior includes a money amount, a money entrance amount, a money exit amount per unit time, an account balance, a number of transactions within a preset time period before a current time and/or an occurrence frequency of money entrance and money exit behavior, and the rule model calculates the money laundering terrorism financing risk level by: judging whether the money amount is larger than a first money amount threshold value or not, and if the money amount is larger than the first money amount threshold value, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the deposit amount is greater than a second amount threshold value or not, and if the deposit amount is greater than the second amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the cash-out amount in unit time is larger than the percentage threshold of the historical accumulated cash-in amount, and if the cash-out amount in unit time is larger than the percentage threshold, determining that the money laundering terrorism financing risk level reaches a preset level; judging whether the account balance is greater than a third amount threshold value, and if the account balance is greater than the third amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level; judging whether the transaction times within a preset time length before the current time is smaller than a time threshold, if the transaction times is smaller than the time threshold, judging whether the account balance is larger than a fourth amount threshold, and if the account balance is larger than the fourth amount threshold, determining that the money laundering terrorist financing risk level reaches a preset level; and judging whether the occurrence frequency of the money entrance and exit behaviors is greater than a frequency threshold, and if the occurrence frequency is greater than the frequency threshold, determining that the money laundering terrorism financing risk level reaches a preset level.
Optionally, in an embodiment, the modification module 203 includes a first modification unit, a second modification unit, and a third modification unit, where the first modification unit is configured to add a corresponding monitoring task in the monitoring engine when the rule model library adds a rule model; the second modification unit is used for deleting the corresponding monitoring task in the monitoring engine when the rule model base deletes the rule model; and the third modification unit is used for updating the configuration information of the corresponding monitoring task in the monitoring engine when the rule model in the rule model library is updated.
EXAMPLE III
The third embodiment further provides a computer device, such as a smart phone, a tablet computer, a notebook computer, a desktop computer, a rack server, a blade server, a tower server or a rack server (including an independent server or a server cluster composed of multiple servers) capable of executing programs, and the like. As shown in fig. 3, the computer device 01 of the present embodiment at least includes but is not limited to: a memory 011 and a processor 012, which are communicatively connected to each other via a system bus, as shown in fig. 3. It is noted that fig. 3 only shows the computer device 01 having the component memory 011 and the processor 012, but it is to be understood that not all of the shown components are required to be implemented, and that more or fewer components may be implemented instead.
In this embodiment, the memory 011 (i.e., a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the storage 011 can be an internal storage unit of the computer device 01, such as a hard disk or a memory of the computer device 01. In other embodiments, the memory 011 can also be an external storage device of the computer device 01, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a flash Card (FlashCard), etc. provided on the computer device 01. Of course, the memory 011 can also include both internal and external memory units of the computer device 01. In this embodiment, the memory 011 is generally used for storing an operating system and various application software installed on the computer device 01, such as the anti-money laundering anti-terrorist financing risk monitoring device in the second embodiment. Further, the memory 011 can also be used to temporarily store various kinds of data that have been output or are to be output.
The processor 012 may be a Central Processing Unit (CPU), a controller, a microcontroller, a microprocessor, or other data Processing chip in some embodiments. The processor 012 is generally used to control the overall operation of the computer device 01. In this embodiment, the processor 012 is configured to execute program codes stored in the memory 011 or process data, such as an anti-money laundering anti-terrorist financing risk monitoring method.
Example four
The fourth embodiment further provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, which when executed by a processor implements corresponding functions. The computer-readable storage medium of this embodiment is used to store an anti-money laundering anti-terrorist financing risk monitoring apparatus, and when being executed by the processor, the anti-money laundering anti-terrorist financing risk monitoring method of the first embodiment is implemented.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.
Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner.
The above description is only a preferred embodiment of the present invention, and not intended to limit the scope of the present invention, and all modifications of equivalent structures and equivalent processes, which are made by using the contents of the present specification and the accompanying drawings, or directly or indirectly applied to other related technical fields, are included in the scope of the present invention.

Claims (10)

1. An anti-money laundering anti-terrorist financing risk monitoring method is characterized by comprising the following steps:
presetting a rule model library for monitoring the risk of anti-money laundering and anti-terrorism financing, wherein the rule model library comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering and terrorism financing;
monitoring whether the rule model base changes;
modifying a monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model, a data source and a data storage position of a calculation result, the rule model, the data source and the data storage position are used for executing the monitoring task, the monitoring task is used for acquiring data from the data source, calculating the risk level of money laundering terrorism financing risk by using the rule model, and inputting the calculation result to the data storage position;
monitoring whether user information changes; and
and when the user information changes, starting the monitoring task to calculate the risk level of the risk of money laundering terrorism financing of the user.
2. The method of claim 1, wherein the user information comprises user profile information and information characterizing the user's money-in and money-out activities.
3. The anti-money laundering anti-terrorist financing risk monitoring method according to claim 2, wherein the step of monitoring whether the user information is changed comprises:
acquiring the updating time of the user profile information;
and determining whether the user profile information changes according to the updating time.
4. The anti-money laundering anti-terrorist financing risk monitoring method according to claim 2, wherein the step of monitoring whether the user information is changed comprises:
obtaining the table operation of the deposit and withdrawal record table of the user;
and determining whether the user has cash-in and cash-out behaviors according to the table operation.
5. The method of monitoring risk of anti-money laundering anti-terrorist financing according to claim 2, wherein the user profile information includes user characteristics and user account characteristics, and the rule model calculates the risk level of money laundering terrorist financing by:
calculating a first sub-parameter of the risk level according to the corresponding relation between the preset user characteristics and the risk level;
calculating a second sub-parameter of the risk level according to the corresponding relation between the preset account characteristics and the risk level;
calculating a third sub-parameter of the risk level according to the preset corresponding relation between the combination of the user characteristic and the account characteristic and the risk level;
and calculating the risk level of money laundering terrorist financing according to the first sub-parameter of the risk level, the second sub-parameter of the risk level and the third sub-parameter of the risk level.
6. The method for monitoring risk of anti-money laundering anti-terrorist financing according to claim 2, wherein the information characterizing that the user has money laundering behavior comprises money discharge amount, money deposit amount, money discharge amount per unit time, account balance, transaction number within a preset time period before the current time and/or occurrence frequency of money laundering behavior, and the rule model calculates the risk level of money laundering terrorist financing by the following steps:
judging whether the money outlet amount is larger than a first amount threshold value or not, and if the money outlet amount is larger than the first amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level;
judging whether the deposit amount is larger than a second amount threshold value or not, and if the deposit amount is larger than the second amount threshold value, determining that the money laundering terrorist financing risk level reaches the preset level;
judging whether the cash-out amount in unit time is larger than a percentage threshold of historical accumulated cash-in amount, and if the cash-out amount in unit time is larger than the percentage threshold, determining that the money laundering terrorism financing risk level reaches the preset level;
judging whether the account balance is greater than a third amount threshold value, and if the account balance is greater than the third amount threshold value, determining that the money laundering terrorist financing risk level reaches a preset level;
judging whether the transaction times within a preset time length before the current time is smaller than a time threshold, if the transaction times is smaller than the time threshold, judging whether the account balance is larger than a fourth amount threshold, and if the account balance is larger than the fourth amount threshold, determining that the money laundering terrorist financing risk level reaches a preset level;
and judging whether the occurrence frequency of the money entrance and exit behaviors is greater than a frequency threshold, and if the occurrence frequency is greater than the frequency threshold, determining that the money laundering terrorism financing risk level reaches a preset level.
7. The method for monitoring risk of anti-money laundering anti-terrorist financing according to claim 1, wherein the step of modifying the monitoring task based on changes occurring in the rule model base comprises:
when the rule model is added to the rule model base, adding a corresponding monitoring task to a monitoring engine;
when the rule model base deletes the rule model, deleting the corresponding monitoring task in the monitoring engine;
and when the rule model in the rule model base is updated, updating the configuration information of the corresponding monitoring task in the monitoring engine.
8. An anti-money laundering anti-terrorist financing risk monitoring device, comprising:
the system comprises a presetting module, a monitoring module and a monitoring module, wherein the presetting module is used for presetting a rule model library for monitoring the risk of anti-money laundering anti-terrorism financing, the rule model library comprises a plurality of rule models, and the rule models are used for calculating the risk level of the risk of money laundering terrorism financing;
the first monitoring module is used for monitoring whether the rule model base changes or not;
the modification module is used for modifying a monitoring task according to the change of the rule model base, wherein the configuration information of the monitoring task comprises a rule model, a data source and a data storage position of a calculation result, the rule model, the data source and the data storage position are used for executing the monitoring task, the monitoring task is used for acquiring data from the data source, calculating the risk level of the risk of terrorist money laundering and financing by using the rule model, and inputting the calculation result to the data storage position;
the second monitoring module is used for monitoring whether the user information changes; and
and the starting module is used for starting the monitoring task when the user information changes so as to calculate the risk level of the risk of money laundering terrorism financing of the user.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1 to 7 are implemented by the processor when executing the computer program.
10. A computer-readable storage medium having stored thereon a computer program, characterized in that: the computer program when executed by a processor implements the steps of the method of any one of claims 1 to 7.
CN202010529627.1A 2020-06-11 2020-06-11 Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium Pending CN111738868A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010529627.1A CN111738868A (en) 2020-06-11 2020-06-11 Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010529627.1A CN111738868A (en) 2020-06-11 2020-06-11 Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium

Publications (1)

Publication Number Publication Date
CN111738868A true CN111738868A (en) 2020-10-02

Family

ID=72648797

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010529627.1A Pending CN111738868A (en) 2020-06-11 2020-06-11 Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN111738868A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112801788A (en) * 2021-01-20 2021-05-14 国家计算机网络与信息安全管理中心 Internet stock right financing platform monitoring system and monitoring method
CN114091899A (en) * 2021-11-22 2022-02-25 支付宝(杭州)信息技术有限公司 Risk feature identification method and device

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714273A (en) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 Rule engine-based method and system for monitoring exceptional service of bank
WO2016138183A1 (en) * 2015-02-24 2016-09-01 Pneuron Corp. Distributed money laundering detection system
CN106952162A (en) * 2016-01-07 2017-07-14 平安科技(深圳)有限公司 Money laundering risks rating calculation method and system
CN108053087A (en) * 2017-10-20 2018-05-18 深圳前海微众银行股份有限公司 Anti money washing monitoring method, equipment and computer readable storage medium
CN109509097A (en) * 2018-11-27 2019-03-22 深圳华锐金融技术股份有限公司 Abnormal trading activity monitoring method, device, computer equipment and storage medium
CN110046993A (en) * 2018-12-15 2019-07-23 深圳壹账通智能科技有限公司 Illicit gain legalizes behavior monitoring method, system, computer installation and medium
CN111125695A (en) * 2019-12-26 2020-05-08 武汉极意网络科技有限公司 Account risk assessment method, device, equipment and storage medium

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714273A (en) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 Rule engine-based method and system for monitoring exceptional service of bank
WO2016138183A1 (en) * 2015-02-24 2016-09-01 Pneuron Corp. Distributed money laundering detection system
CN106952162A (en) * 2016-01-07 2017-07-14 平安科技(深圳)有限公司 Money laundering risks rating calculation method and system
CN108053087A (en) * 2017-10-20 2018-05-18 深圳前海微众银行股份有限公司 Anti money washing monitoring method, equipment and computer readable storage medium
CN109509097A (en) * 2018-11-27 2019-03-22 深圳华锐金融技术股份有限公司 Abnormal trading activity monitoring method, device, computer equipment and storage medium
CN110046993A (en) * 2018-12-15 2019-07-23 深圳壹账通智能科技有限公司 Illicit gain legalizes behavior monitoring method, system, computer installation and medium
CN111125695A (en) * 2019-12-26 2020-05-08 武汉极意网络科技有限公司 Account risk assessment method, device, equipment and storage medium

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112801788A (en) * 2021-01-20 2021-05-14 国家计算机网络与信息安全管理中心 Internet stock right financing platform monitoring system and monitoring method
CN114091899A (en) * 2021-11-22 2022-02-25 支付宝(杭州)信息技术有限公司 Risk feature identification method and device

Similar Documents

Publication Publication Date Title
JP6869347B2 (en) Risk control event automatic processing method and equipment
CN110503564B (en) Security case processing method, system, equipment and storage medium based on big data
CN103403674A (en) Performing a change process based on a policy
CN111580874B (en) System safety control method and system for data application and computer equipment
CN111694718A (en) Method and device for identifying abnormal behavior of intranet user, computer equipment and readable storage medium
CN110674014A (en) Method and device for determining abnormal query request
US11151012B2 (en) Predictive reserved instance for hyperscaler management
CN110764902A (en) Virtual resource allocation method and device based on AI (Artificial Intelligence), computer equipment and storage medium
CN109359802B (en) Inverse selection risk determination method, system, computer device and storage medium
US20130144782A1 (en) Electronic invoice payment prediction system and method
CN112269811A (en) IT capacity prediction method and system based on traffic
CN111738868A (en) Anti-money laundering anti-terrorist financing risk monitoring method, device, computer equipment and storage medium
CN109544014B (en) Anti-fraud method and device based on historical data playback
CN111737080A (en) Abnormal transaction suspicion monitoring method and device, computer equipment and storage medium
CN114782201A (en) Stock recommendation method and device, computer equipment and storage medium
CN109308660B (en) Credit assessment scoring model evaluation method, apparatus, device and storage medium
CN111506455B (en) Checking method and device for service release result
CN110442466B (en) Method, device, computer equipment and storage medium for preventing repeated access request
CN110618990B (en) List report setting method, system and list report acquisition method
CN114971887A (en) Credit system operation monitoring method and device, storage medium and electronic equipment
CN114612220A (en) Wind control strategy adjusting method and device, electronic equipment and storage medium
CN114186961A (en) Business approval process configuration method and device, computer equipment and storage medium
CN110956552B (en) Insurance problem processing method, apparatus, device and storage medium
CN114004660A (en) Data processing method and device, electronic equipment and storage medium
AU2021383742A1 (en) Systems and methods for confidence interval transaction settlement range predictions

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination