JP2019061548A - Transaction monitoring system, method, and program - Google Patents

Abstract

To provide a transaction monitoring system, a related method, and a related program, which support determination to be performed accurately and efficiently by automatically determining the degree of difficulty in determination, even in complex cases in which it is difficult to determine if a transaction is suspicious.SOLUTION: A transaction monitoring system 10, which includes acquisition means 13, calculation means 14, and determination means 15, can support determination to be performed accurately, even when it is difficult to determine if a transaction is suspicious, by making a person in charge with high level of skill make a decision in the case of higher degree of difficulty in determination, and can use time efficiently.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a transaction monitoring system, method and program for monitoring account transactions.

  When a so-called "suspicious transaction" occurs at a financial institution or the like, it is necessary to notify the relevant government agency of the transaction as a measure against money laundering. Such “suspicious transactions” have been on the rise in recent years.

  Here, Patent Document 1 below discloses an account evaluation system for efficiently evaluating an account opened in a financial institution and using it for detection of a “suspicious transaction”.

JP, 2016-224549, A

  However, the account evaluation system described in Patent Document 1 calculates the total score of the risk degree based on the evaluation rule of the processing target account, and uniformly executes the alarm process if the value of the total score is equal to or more than the reference value. Then, a person in charge of investigation investigates the account for which the alarm process has been performed. Therefore, it is actually a suspicious transaction if it is difficult to determine whether it is a suspicious transaction such as “The transaction amount is small but it deviates from the account movement expected from past transactions.” Even if the transaction amount is small, there is a possibility that it may be erroneously judged not to be a suspicious transaction.

  Furthermore, when it is difficult to determine whether the transaction is suspicious or not, it is also necessary for the person in charge to confirm the contents in order to make a more accurate determination. However, although the number of transactions to be judged is large, the account evaluation system described in Patent Document 1 efficiently uses the time for confirmation such as automatically judging the degree of difficulty of the judgment. Is not disclosed.

  The present invention has been proposed in view of the above situation, and it is possible to accurately determine the degree of difficulty of determination as to whether or not a suspicious transaction, even in complicated cases where it is difficult to determine whether or not it is a suspicious transaction. It is an object of the present invention to provide a transaction monitoring system, method and program for assisting in making decisions efficiently.

  In order to achieve the above object, a transaction monitoring system according to the present invention is a transaction monitoring system in a financial institution, and by referring to a case storage unit, an acquisition unit for acquiring alert data from account transaction data, and alert data And learning data, calculating means for calculating the reliability of the alert data, and determining means for determining the degree of difficulty about the suspiciousness of the transaction of the alert data based on the reliability.

  A method according to the present invention is a method executed by a transaction monitoring system in a financial institution, and, referring to a case storage unit, acquiring alert data from account transaction data, based on alert data and learning data. And calculating the reliability of the alert data, and determining the degree of difficulty of the transaction of the alert data based on the reliability.

  The present invention further provides a program for causing a computer to execute the above method.

  According to the present invention, it is determined automatically that there is no need for notification for those that can clearly determine whether a transaction is suspicious or not, while the degree of difficulty of determination is automatically determined if it is difficult to determine. Therefore, if the judgment is difficult, the person in charge with high learning level makes judgments, etc., and supports accurate judgment even if the judgment of the suspicious transaction is complicated or not, and the time is efficient It can be used for

It is a block diagram of a transaction monitoring system concerning one embodiment of the present invention. It is a block diagram showing composition of a transaction monitoring system concerning one embodiment of the present invention. It is a flowchart for demonstrating the acquisition means of the control part of the transaction monitoring system which concerns on one Embodiment of this invention. It is a flowchart for demonstrating the calculation means of the control part of the transaction monitoring system which concerns on one Embodiment of this invention. It is a flowchart for demonstrating the determination means of the control part of the transaction monitoring system which concerns on one Embodiment of this invention. It is a figure which shows the transaction database which concerns on one Embodiment of this invention. It is a figure showing a customer database concerning one embodiment of the present invention. It is a figure showing an account database concerning one embodiment of the present invention. It is a figure showing a case database concerning one embodiment of the present invention. It is a figure showing a machine learning database concerning one embodiment of the present invention. It is a figure which shows the proficiency level database which concerns on one Embodiment of this invention. It is a figure which shows the alert database which concerns on one Embodiment of this invention. FIG. 5 is a diagram showing account transaction data according to an embodiment of the present invention. It is a figure showing the system configuration of the transaction monitoring system concerning one embodiment of the present invention.

  Hereinafter, embodiments according to the present invention will be described with reference to the drawings.

  First, a transaction monitoring system 10 according to an embodiment of the present application will be described with reference to FIG. The transaction monitoring system 10 is installed in a financial institution such as a bank that carries out measures against money laundering. Here, the transaction monitoring system 10 may be implemented alone, or may be implemented on a server or host computer in a system of a financial institution existing in the related art.

  The transaction monitoring system 10 is connected to the terminals 20 a to 20 c via the network 30. The network 30 may be the Internet, a local area network (LAN) or a wide area network (WAN).

  In the following, when it is not necessary to distinguish and describe each of the terminals 20a to 20c in particular, the terminals 20a to 20c are described as the terminals 20. Further, although only three terminals 20 are shown in FIG. 1 for the sake of simplicity, it goes without saying that more terminals may be present.

  Here, the terminal 20 represents a terminal used by a user working at a financial institution, for example, a bank clerk, for normal business. The terminal 20 can be used not only in a head office or a branch office but also outside the office.

  The terminal 20 has a human interface such as a keyboard and a touch panel, and more specifically, a desktop personal computer, a notebook personal computer, a smartphone, a tablet, or a PDA (Personal Digital Assistant). A mobile type information processing terminal etc. are mentioned.

  Next, the configuration of the transaction monitoring system 10 in an embodiment of the present application will be described using FIG. Here, description will be made with reference to the drawings of FIGS. 7 to 14. As shown in FIG. 2, the transaction monitoring system 10 includes a transmitting / receiving unit 11, a control unit 12, and a storage unit 16. The storage unit 16 includes a transaction database 17, a customer database 18, and an account database 19. And a case database 21, a machine learning database 22, a statement database 23, a skill level database 24, and an alert database 25.

  First, the storage unit 16 of the transaction monitoring system 10 will be described.

  The storage unit 16 of the transaction monitoring system 10 has a function of storing information transmitted from the terminal 20 and various data. The storage unit 16 is realized by, for example, various storage media such as a hard disk drive, an SSD, and a flash memory.

  Next, the transaction database 17, the customer database 18, the account database 19, the case database 21, the machine learning database 22, the statement database 23, the skill level database 24, and the alert database 25 stored in the storage unit 16 And explain.

  The transaction database 17 is a database in which the history of account transactions is stored. As shown in FIG. 6, “item item”, “transfer client code”, “date” on which the account transaction was performed, “debit / department classification” indicating deposit or withdrawal, “amount”, and the contents of the account transaction The “summary” representing “summary” is stored in association with “branch code” and “account number” assigned to each account holder.

  The customer database 18 is a database in which customer registration information is stored. As shown in FIG. 7, a "branch code" and an "account" in which the "item" of the account, the "address", the "name", and the "telephone number" of the account holder who is the customer are allocated for each account holder. It is stored in association with the number.

  The account database 19 is a database in which account information is stored. As shown in FIG. 8, the “branch name”, the “item” of the account, the name of the “nominee” etc. are stored in association with the “branch code” and the “account number” allocated for each account holder. ing.

  The case database 21 is a database in which cases determined to be "suspicious transactions" are stored. The “case name” describing the contents of the case, the “extraction criteria” as the suspicious transaction, and the “update date” are stored in the case database 21 in association with the “number” attached to each “case name”. ing.

  For example, as shown in FIG. 9, the "case name" describes "a large amount of deposit or withdrawal" which may be regarded as one of "suspicious transactions". Therefore, it can be said that the account transaction corresponding to the “extraction criteria” “one deposit and withdrawal amount is the standard or more” may be “suspicious transaction”.

  In machine learning database 22, machine learning is performed by machine learning algorithm on the trend of the transaction which was reported as "suspicious transaction" among the data including the alert data in the past, and which was not, it is judged as "suspicious transaction" The range of possible transaction amounts and their scores are calculated and stored as learning data. Here, the alert data refers to the account transaction data shown in FIG. 13 that is determined by the transaction monitoring system 10 as a "suspicious transaction". Here, the file format of the account transaction data and the alert data is the same.

  Here, in the machine learning database 22, as the score value decreases, the possibility of being a "suspicious transaction" increases. For example, in FIG. 10, if the “month end account balance” is “1000 yen or less”, the score is as low as −50, and the score may be “suspicious transaction” than “20 more than 1000 yen to 30000 yen or less”. Is shown to be higher.

  The detail database 23 is a database that outputs data including alert data that is automatically determined to be unnecessary for notification because the possibility of being a “suspicious transaction” in the transaction monitoring system 10 is low. The “data including alert data” will be described later.

  The proficiency level database 24 is a database that stores proficiency levels of persons in charge of determining whether or not a “suspicious transaction” is applicable. In FIG. 11, the "person in charge name" and the "available range" indicating the range of difficulty that can be determined by the person in charge regarding the suspicious transaction are associated with the "person in charge ID" allocated for each person in charge. Are stored in the skill level database 24.

  The alert database 25 stores data including alert data that is likely to correspond to the “suspicious transaction”. Here, “data including alert data” means “number” in the alert data, “case name” in the case database 21 and “reliability degree indicating possibility of suspicious transaction as shown in FIG. And “the detection case” indicating the “number” of the case database 21 is added.

  Here, the detailed configuration of the control unit 12 of the transaction monitoring system 10 will be described.

  The control unit 12 includes an acquisition unit 13, a calculation unit 14, and a determination unit 15.

  Next, processing of each of the units 13 to 15 constituting the control unit 12 will be described. The processing of each of the units 13 to 15 constituting the control unit 12 is all performed by the processor.

  FIG. 3 describes the processing of the acquisition means 13 of the control unit 12, and will be described below with reference to FIGS. 6 to 8 and FIG.

  The acquisition means 13 reads data from the transaction database 17, the customer database 18, and the account database 19 using the branch code and the account number as keys (step S101).

  Next, acquisition means 13 creates account transaction data shown in FIG. 13 based on the data read in step S101 (step S102). The account transaction data indicates the history and details of the account holder's account transaction.

  The account transaction data includes “branch name”, “item” of the account, “nominee” name of the account holder, “address”, “transfer client code”, “date” on which the account transaction was made, “payment and payment” Items such as "division", "amount", and "summary" are associated with "branch code" and "account number" assigned to each account holder.

  The acquisition means 13 refers to the case database 21 of FIG. 9 for the account transaction data created in step S102 (step S103). Then, the acquiring means 13 acquires the account transaction data corresponding to the “extraction criteria” of the case database 21 as “alert data” which is highly likely to be “suspicious transaction”.

  In addition, the acquisition means 13 acquires the “number” and the “case name” from the case database 21 at the time of the meeting. The acquired "number" and "case name" are used to create "data including alert data" in the determination means 15 described below.

  Here, in the record of the number “1” of the case database 21 of FIG. 9, the case name is “large deposit / withdrawal”, and the extraction criterion is “one deposit or withdrawal amount is equal to or more than the criterion”. For example, when "the amount of one deposit and withdrawal is 1 million yen or more" is defined as the standard to judge the suspicious transaction, the account transaction data in which the amount of the account transaction data is "1 million yen" is considered as alert data. It is extracted.

  FIG. 4 describes the process of the calculating means 14 of the control unit 12. Here, this will be described below with reference to FIG.

  The calculating unit 14 collates the alert data acquired in step S103 of the acquiring unit 13 with the learning data stored in the machine learning database 22 of FIG. 10 (step S201). Here, the account data such as “date”, “payment and payment classification”, “summary” and “amount” of alert data, the content of transaction such as “ATM cash withdrawal amount” for learning data, and “range of amount” And so on.

  Next, the calculation means 14 calculates the score of all alert data based on the value of the corresponding "score" of the learning data which has been matched in step S201. Then, the calculating means 14 calculates the reliability of all alert data based on the value of the calculated score (step S202). In the method of calculating the reliability of each alert data, weightings according to the contents, such as the amount of money, are performed on each score, for all the score values calculated for one alert data. Then, using the weighted scores, the reliability of each alert data is calculated based on a formula. The reliability calculation method may use an existing application, and is not particularly limited. Here, the degree of reliability represents the rate at which the account transaction content of the account transaction data corresponds to "suspicious transaction". Thus, the higher the confidence value, the more likely that the content of the account transaction data falls into a "suspicious transaction."

  For example, account transaction data for which the degree of confidence is determined to be “90%” is likely to correspond to “suspicious transaction”. On the other hand, account transaction data for which the reliability is judged to be "10%" is likely not to correspond to "suspicious transaction".

  FIG. 5 describes the process of the determination unit 15 of the control unit 12. Here, this will be described below with reference to FIGS. 10 and 11.

  The determination unit 15 determines whether the reliability of the alert data calculated in step S202 is equal to or less than a reference value (step S301).

  Here, "the reliability of alert data is less than or equal to a reference value" means that it can be determined that "the possibility of not corresponding to a suspicious transaction is very high" such as "the reliability of alert data is 3% or less". Here, the value of the reference value can be freely set.

  In step S301, when the determination means 15 determines that the reliability of the alert data is equal to or less than the reference value, it is determined that "the notification to the administrative agency is unnecessary because the possibility of not corresponding to the suspicious transaction is very high." Then, the "number" in the alert data, the "case name" acquired from the case database 21 in step S103, the "reliability" calculated in step S202, and the "number" acquired from the case database 21 in step S103. “Data including alert data” added as “detection case” is automatically output to the detail database 23 (step S302). In this case, the degree of difficulty is not determined for data including alert data. The degree of difficulty will be described later.

  The data including the alert data output in step S302 is an account transaction such as an amount, a "case name", a "date", and a "payment and payment classification" as the "case where notification to the government office is not performed" in the determination means 15. The content, reliability, etc. of the are learned by machine learning based on machine learning algorithm.

  Then, learning data is newly created or updated by data including machine-learned alert data. That is, the contents of the machine learning database 22 including the learning data are updated by data including the machine-learned alert data (step S303).

  For example, in the machine learning database 22 of FIG. 10, when the range of the “ATM cash withdrawal amount” is “10,000 yen or less”, the score is “30”. However, even if the "ATM cash withdrawal amount" of data including alert data is "20,000 yen", the reliability is low, and when it is judged by machine learning that notification is unnecessary, "20,000 yen or less" In the case of "", the content of learning data can be updated by setting it as a score "30".

  The items of “range” and “score” of the learning data of the machine learning database 22 can be freely changed based on the contents of account transaction of the data including the alert data, the reliability, and the like.

  On the other hand, when the determination means 15 determines that “the reliability of the alert data is higher than %%, ie, higher than the reference value” in step S301, the difficulty level about the suspiciousness of the transaction of the alert data, ie, the alert data is The determination means 15 determines the degree of difficulty of the determination by the person in charge as to whether or not the “suspicious transaction” falls under (step S304).

  Here, when the degree of reliability is relatively high such as 90%, or relatively low such as 10% or 20%, it can be determined that the degree of difficulty is low. Also, if the degree of reliability is moderate, such as 50% or 60%, it can be determined that the degree of difficulty is high.

  In other words, if the reliability of the alert data calculated in S202 is calculated relatively high, such as 90%, the amount of the account transaction is high and the score is low. It can be relatively easily determined that there is a certain possibility. And if the value of confidence is relatively low, such as 10% or 20%, the amount of the account transaction is low, the frequency of deposits and withdrawals is low, and the score is high. It is relatively easy to judge that the possibility is not high. In such a case, the determination means 15 determines that the degree of difficulty of the determination is low.

  On the other hand, when the reliability value is moderate, such as 50% or 60%, it indicates that it is difficult to determine whether the transaction is a "suspicious transaction" or not, such as the amount of money being low but being frequently withdrawn from the account. In such a case, the determination means 15 determines that the degree of difficulty of determination is high.

  Furthermore, the determination means 15 adds the "number", the "case name", the "reliability" calculated in step S202, and the "detection case" to the alert data whose degree of difficulty has been determined in step S304. It is output to the alert database 25 of FIG. 12 as “data including alert data”.

  The determination means 15 refers to the “possible range” of the skill level database 24 of FIG. Then, if the degree of difficulty determined in step S304 is low, data including the alert data is transmitted from the alert database 25 to the terminal 20 of the person in charge whose "corresponding range" is "low difficulty to normal" (step S306) ).

  Here, since the "corresponding range" of the proficiency database 24 "low difficulty to normal" means that the proficiency of the corresponding person in charge is relatively low, the degree of difficulty in determining whether it is a suspicious transaction is " It indicates that it is in charge of data including “normal” relatively easy alert data.

  On the other hand, when the degree of difficulty determined in step S304 is high, the determination unit 15 refers to the “supportable range” of the skill level database 24 and the person in charge is the “usable range” is “normal to high difficulty”. The data including alert data is transmitted from the alert database 25 to the terminal 20 of (step S307).

  Here, since the “corresponding range” of the proficiency database 24 is “normal to high difficulty”, the proficiency of the person in charge is relatively high, so the degree of difficulty in determining whether it is a suspicious transaction is “normal to Indicate that you will be in charge of data that includes relatively difficult alert data with high difficulty.

  For example, in the skill level database 24 of FIG. 11, the person-in-charge name “×× Hanako” of the person-in-charge ID “3333333” has a corresponding range of “normal to high difficulty”. Therefore, data including alert data having a relatively high degree of difficulty in determining whether it is a suspicious transaction is transmitted by the determination means 15 to the terminal 20 of the person in charge name “×× Hanako”. On the other hand, the person-in-charge name “□□ Saburo” of the person-in-charge ID “4444444” has a compatible range of “low difficulty to normal”. Therefore, data including alert data having a relatively low degree of difficulty in determining whether it is a suspicious transaction is transmitted by the determination means 15 to the terminal 20 of the person-in-charge name “□□ Saburo”.

  The person in charge investigates whether the data including the sent alert data corresponds to the suspicious transaction. After investigation, the findings are approved by the approver. Then, data including alert data determined to be required to be notified is notified to the administrative agency as a suspicious transaction by the person in charge. On the other hand, data including alert data determined not to require notification does not require notification.

  Here, data including alert data determined to be necessary or unnecessary by the person in charge is machine-learned in the determination means 15 as in step S303. Then, the data including the machine-learned alert data can update the contents of the machine learning database 22 as learning data.

  For example, in the machine learning database 22 of FIG. 10, when the range of the “end of month account balance” is “1,000 yen or less”, the score is “−50”. However, even if "End of month account balance" of data including alert data is "10,000 yen", it is highly reliable, and if it is determined by machine learning that notification is necessary, "10,000 yen or less" In the case of, the content of the learning data can be updated by setting the score to "-50".

  FIG. 14 shows a system configuration of the transaction monitoring system 10. The transaction monitoring system 10 includes a CPU 40, a RAM 41, a ROM 42, a storage 43, a connection interface 44, and a network interface 45. The components 40 to 45 are communicably connected to one another via a bus 46.

  The CPU 40 controls each of the devices and circuits, and performs arithmetic and data processing. The RAM 41 is a temporary storage area, and is used when the CPU 40 executes an operation. The ROM 42 is a storage area for storing various programs. The storage 43 is configured of, for example, a hard disk drive (HDD) or a solid state drive (SSD), and stores various data. Data is read from storage 43 and data is written to storage 43 based on control of CPU 40.

  The connection interface 44 is an interface for connecting various devices to the transaction monitoring system 10. For example, a display, a keyboard, a mouse, an external storage device, etc. can be connected to the transaction monitoring system 10 via the connection interface 44.

  The network interface 45 is connected to the network 30 through a communication line. The network interface 45 controls input / output of data between the network 30 and the transaction monitoring system 10 based on the control of the CPU 40. The connection between the network interface 45 and the network 30 may be either a wired connection or a wireless connection.

  In the present application, the network interface 45 corresponds to the transmission / reception unit 11, and the CPU 40 corresponds to the control unit 12. Further, the storage 43 corresponds to the storage unit 16.

  As described above, the transaction monitoring system 10 according to the embodiment of the present application is configured. Next, the effects of the transaction monitoring system 10 will be described.

  According to this embodiment, learning data is created by a machine learning algorithm based on data including alert data. Therefore, the past alert data is automatically updated by machine learning, taking into consideration the tendency of those who reported to the administrative agency as suspicious transactions and those who did not report, and newly created new data. It is particularly efficient when the number of alert data is large because it can be done. In addition, since the contents of the machine learning database for determining whether it is a suspicious transaction can be updated by learning data update or new creation, the degree of accuracy in determining whether to report or not is automatically made. It can be raised.

  According to the present embodiment, when the reliability value is less than or equal to the reference value, the determination unit 15 automatically determines that the data including the alert data is unnecessary for notification. Therefore, it is efficient because it is automatically determined that notification to the administrative agency is unnecessary without considering the degree of difficulty if it is clear that the value of the degree of reliability of alert data is below the standard value and is not a suspicious transaction. .

  According to the present embodiment, the determination unit 15 transmits alert data to the terminal 20 according to the determined degree of difficulty by referring to the skill level storage unit 24. Therefore, when the level of difficulty is high, data including alert data is transmitted to a person with high skill level, and when the level of difficulty is low, alert data is transmitted to a person with low level of skill. Therefore, it is efficient without transmitting timely alert data having a high degree of difficulty to a person in charge with a low skill level. Also, the alert data handling is changed according to the degree of difficulty rather than the degree of reliability. Therefore, if it is difficult to determine whether a transaction is suspicious or not, such as small amount of money and frequent use of the account but there is a possibility of suspicious transaction, it is accurate without making uniform determinations such as the amount uniformly. It can help you make decisions.

  As mentioned above, although embodiment concerning this invention was described, this invention is not limited to this embodiment, It can not be overemphasized that it can implement in a various aspect in the range which does not deviate from the summary. For example, the roles of the units 13 to 15 of the transaction monitoring system 10 and the control unit 12 are not limited to the above-described example.

DESCRIPTION OF SYMBOLS 10 Transaction monitoring system 11 Transmission / reception unit 12 Control unit 13 Acquisition means 14 Calculation means 15 Determination means 16 Storage unit 17 Transaction database 18 Customer database 19 Account database 20a terminal 20b terminal 20c terminal 21 Case database 22 Machine learning database 23 Detail database 24 Familiarity level Database 25 Alert Database 30 Network 40 CPU
41 RAM
42 ROM
43 storage 44 connection interface 45 network interface

Claims (5)

Transaction monitoring system at a financial institution,
Acquisition means for acquiring alert data from account transaction data with reference to the case storage means;
Calculating means for calculating the reliability of the alert data based on the alert data and the learning data;
A determining means for determining the degree of difficulty about the suspiciousness of the transaction of the alert data based on the degree of reliability;
A transaction monitoring system comprising:   The transaction monitoring system according to claim 1, wherein the learning data is created by a machine learning algorithm based on data including the alert data.   The transaction monitoring according to claim 1 or 2, wherein the determination means transmits data including the alert data to the terminal according to the determined degree of difficulty by referring to the proficiency level storage means. system. A method implemented in a transaction monitoring system at a financial institution, comprising
Obtaining alert data from account transaction data with reference to the case storage means;
Calculating the reliability of the alert data based on the alert data and the learning data;
Determining the degree of difficulty for suspiciousness of trading of the alert data based on the degree of confidence;
A method comprising:   A program for causing a computer to execute the method according to claim 4.

Images