wkc/ccdi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

更新大额交易口径与本地流水分析配置

Browse Source
This commit is contained in:
wkc
2026-03-16 16:52:34 +08:00
parent e1ee681550
commit 7fed9927b3
3 changed files with 20 additions and 1021 deletions
Download Patch File Download Diff File Expand all files Collapse all files

996
assets/初核系统模型业务口径-1.27-可疑模型业务口径.csv
View File

@@ -1,996 +0,0 @@
可疑行为排查模型,,,,,,,,,
序号,模型名称,描述,业务口径,代码,,,,,
1,大额交易,"关注账户（包括本人、亲属、注册主体等账户），房、车采购等大额消费，异常纳税支出等。
除工资收入外的大额流入，大额的额度可在排查参数输入页面进行设置
修改默认限额，且年流水交易额超过默认限额。
大额存现或短时间多次存现
大额转账或频繁转账，大额的定义数字可在排查参数输入页面进行设置","1.备注或对交易对手是房产公司、二手房、车辆销售公司、物业公司等。
2.有税务支出记录
3.同一交易对手（除家庭成员外、本单位代发工资）单笔超过 设置限额或累计交易金额超过 设置限额的资金流入；
4.年流水交易额超过  设置限额；
5.大额存现或短时间多次存现，单笔超过 设置限额；
6.大额转账或频繁转账，单笔超过 设置限额。","---员工及其亲属购买车房支出金额
select id_card
,sum(amount_dr) as amount_dr
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷'
or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0
union all
select t1.person_id
,amount_dr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷'
or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0
)
group by id_card;
----员工及其亲属税务支出金额
select id_card
,sum(amount_dr) as amount_dr
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr > 0
union all
select t1.person_id
,amount_dr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr > 0
)
group by id_card;
--员工与同一交易对手（非亲属）的最大一笔收入交易金额
select id_card
,max(max_amount_cr) as max_amount_cr
from
(
select
t1.id_card
,t1.customer_account_name
,t1.max_amount_cr
from
(
select t1.id_card
,customer_account_name
,max(amount_cr) as max_amount_cr
from ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and t2.le_account_name <> t2.customer_account_name
and customer_account_name not like '%代发%'
and customer_account_name not like '%工资%'
and user_memo not like '%代发%'
and user_memo not like '%工资%'
and user_memo not like '%奖金%'
and user_memo not like '%薪酬%'
and user_memo not like '%薪金%'
and user_memo not like '%补贴%'
and user_memo not like '%薪%'
and user_memo not like '%年终奖%'
and user_memo not like '%年金%'
and user_memo not like '%加班费%'
and user_memo not like '%劳务费%'
and user_memo not like '%劳务外包%'
and user_memo not like '%提成%'
and user_memo not like '%劳务派遣%'
and user_memo not like '%绩效%'
and user_memo not like '%酬劳%'
and user_memo not like '%PAYROLL%'
and user_memo not like '%SALA%'
and user_memo not like '%CPF%'
and user_memo not like '%directors%fees%'
and user_memo not like '%批量代付%'
and cash_type not like '%代发%'
and cash_type not like '%工资%'
and cash_type not like '%劳务费%'
and amount_cr > 0
group by id_card,customer_account_name
) t1
left join ccdi_staff_fmy_relation t2
on t1.id_card = t2.person_id
and t1.customer_account_name = t2.relation_name
where t2.person_id is null;
) group by id_card;
--员工与同一交易对手（非亲属）的累计收入交易金额
select
t1.id_card
,t1.customer_account_name
,t1.amount_cr
from
(
select t1.id_card
,customer_account_name
,sum(amount_cr) as amount_cr
from ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and t2.le_account_name <> t2.customer_account_name
and customer_account_name not like '%代发%'
and customer_account_name not like '%工资%'
and user_memo not like '%代发%'
and user_memo not like '%工资%'
and user_memo not like '%奖金%'
and user_memo not like '%薪酬%'
and user_memo not like '%薪金%'
and user_memo not like '%补贴%'
and user_memo not like '%薪%'
and user_memo not like '%年终奖%'
and user_memo not like '%年金%'
and user_memo not like '%加班费%'
and user_memo not like '%劳务费%'
and user_memo not like '%劳务外包%'
and user_memo not like '%提成%'
and user_memo not like '%劳务派遣%'
and user_memo not like '%绩效%'
and user_memo not like '%酬劳%'
and user_memo not like '%PAYROLL%'
and user_memo not like '%SALA%'
and user_memo not like '%CPF%'
and user_memo not like '%directors%fees%'
and user_memo not like '%批量代付%'
and cash_type not like '%代发%'
and cash_type not like '%工资%'
and cash_type not like '%劳务费%'
group by id_card,customer_account_name
having sum(amount_cr)>0
) t1
left join ccdi_staff_fmy_relation t2
on t1.id_card = t2.person_id
and t1.customer_account_name = t2.relation_name
where t2.person_id is null;
--员工及其亲属 年交易金额
select id_card
,sum(trans_amount) as trans_amount
from
(
select t1.id_card
,amount_dr + amount_cr as trans_amount
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and TRX_DATE >= $$$ --近一年
and t2.le_account_name <> t2.customer_account_name --排除同名交易
union all
select t1.person_id
,amount_dr + amount_cr as trans_amount
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and TRX_DATE >= $$$ --近一年
and t2.le_account_name <> t2.customer_account_name --排除同名交易
)
group by id_card;
---员工及其亲属 最大一笔存现单笔金额
select id_card
,max(amount_cr) as amount_cr
FROM
(
select t1.id_card
,max(amount_cr) as amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
group by t1.id_card
union all
select t1.person_id
,max(amount_cr) as amount_cr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
group by t1.person_id
)
group by id_card
;
--员工及其亲属 存现总金额
select id_card,sum(amount_cr) as amount_cr
from
(
select t1.id_card
,amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
union all
select t1.person_id
,amount_cr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
)group by id_card
;
--员工及其亲属 大额现金存入次数
select id_card,count(1)
from
(
select t1.id_card
,amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr> $$$$$$
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
union all
select t1.person_id
,amount_cr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr> $$$$$$$
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
)group by id_card
;
--员工及其亲属 大额转账次数
select id_card,count(1)
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_dr> $$$$$$
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入')
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
union all
select t1.person_id
,amount_dr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_dr> $$$$$$
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入')
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
)
group by id_card
;",,,,,
2,异常交易,"员工及关系人与客户之间非正常资金往来
关系人中没有收入或低收入人员有大额资金交易","1.员工及关系人与客户及关系人之间有超过1000元以上的资金往来；客户指信贷类客户包括贷款户、担保人，中介库人员，包括中介注册的主体及主体关系人。
2.关系人中没有收入或月收入低于 3000元 的人员，单笔或累计交易金额超过 10万元。","--员工及其亲属与贷款客户、担保户、中介有异常交易
with loan_cust_acct as (
select t2.aa01ac15
from
(
select substr(nfabcsid,4) as nfabcsid
from odsdb.blfmconf --贷款合同文件
where nfaacost in ('3','5','7') --合同状态
and substr(nfaabrno,1,3) = '902' --机构
and del_f = '0'
group by substr(nfabcsid,4)
) t1
inner join
(
select
aa01ac15 --账号
,aa62cfno
from sjfx_pro.bdfmhqaa_orc
where del_f = 0
and substr(trim(aa47brno),1,3) = '902' --机构号修改
and rcstrs1b <>'9'
AND aa15zhzt ='1' -- 账户状态 1-正常 2-销户 3-新开户 4-结清
group by aa01ac15 ,aa62cfno
) t2
on t1.nfabcsid = t2.aa62cfno
) ,
assure_cust_acct as (
select t2.aa01ac15
from
(
select asseure_sign
from xdzx.assure_infomation
where del_f= '0'
and assure_state <> '2'
and substr(create_org,1,3)='902'
group by asseure_sign
) t1
inner join
(
select
aa01ac15 --账号
,aa03csno
from sjfx_pro.bdfmhqaa_orc
where del_f = 0
and substr(trim(aa47brno),1,3) = '902' --机构号修改
and rcstrs1b <>'9'
AND aa15zhzt ='1' -- 账户状态 1-正常 2-销户 3-新开户 4-结清
group by aa01ac15 ,aa03csno
) t2
on t1.asseure_sign = t2.aa03csno
)
select distinct id_card
from
(
select id_card
,customer_account_no
from
(
select t1.id_card
,customer_account_no
,amount_dr + amount_cr as trans_amount
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and customer_account_no is not null
union all
select t1.person_id
,customer_account_no
,amount_dr + amount_cr as trans_amount
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and customer_account_no is not null
) group by id_card,customer_account_no
having sum(customer_account_no)>1000
) a
where exists (select 1 from loan_cust_acct b on a.customer_account_no = b.aa01ac15)
or exists (select 1 from assure_cust_acct c on a.customer_account_no = c.aa01ac15)
or exists (select 1 from 中介名单 d on a.customer_account_no = d.中介账号);
--员工亲属低收入但交易金额高
select distinct person_id
from
(
select person_id
,relation_cert_no
,avg(amount_cr) as avg_amount_cr
from
(
select t1.person_id
,t1.relation_cert_no
,substr(trx_time,1,7)
,sum(amount_cr) as amount_cr--收入金额
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and t2.le_account_name <> t2.customer_account_name --排除同名交易
group by t1.person_id,t1.relation_cert_no,substr(trx_time,1,7)
)
group by person_id,relation_cert_no
having avg(amount_cr)<=3000 ---月均收入不超过3000
) t1
left join
(
select t1.relation_cert_no
,sum(amount_cr + amount_dr) as trans_amount
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
group by t1.relation_cert_no
having sum(amount_cr + amount_dr) >= 100000
or max(amount_cr) >= 100000
or max(amount_dr) >= 100000
) t2
on t1.relation_cert_no = t2.relation_cert_no
where t2.relation_cert_no is not null
;
",,,,,
3,疑似赌博,"通过多人多次在相近时间有转账、微信转账、支付宝转账发生，且额度在可疑区间。金额区间可在排查设置页面进行设置
大额购买彩票行为
疑似赌球行为
疑似网络赌博行为","1.多人只2人及以上，多次指2次以上，相近时间指同一天。
2.备注或交易摘要、对手有“游戏、抖币、体彩、福彩”等字眼","--员工 疑似赌博
select distinct id_card
from
(
select t1.id_card,trx_time
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and ((amount_dr>= $$$ and amount_dr<=$$$) or (amount_cr>= $$$ and amount_cr<=$$$)) -----转入转出金额区间
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|红包|网转|转入' or cash_type rlike '转帐|转账|红包|网转|转入')
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
group by t1.id_card,trx_time
having count(distinct customer_account_name)>=2
and count(1)>=2
);
--员工 网络赌博、体彩
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_dr> 0
and (user_memo rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注'
or customer_account_name rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注')
;
",,,,,
4,可疑关系,除与配偶、子女外发生特殊金额交易，如1314、520。可在排查参数输入页面进行设置,除与配偶、子女外，发生特殊金额交易，如 1314元、520元 等具有特殊含义的金额。,"--员工 可疑关系
select distinct t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
left join
ccdi_staff_fmy_relation t3
on t1.id_card = t3.person_id
and t2.customer_account_name = t3.relation_name
where t2.project_id = PROJECT_ID
and t3.relation_type not in (配偶，子女) --关系类型按实际数据的码值确定
and (amount_dr in (520,1314) or amount_cr in (520,1314))
;",,,,,
5,可疑兼职,除本行工资收入外，有固定收入,"1.除本行工资收入外，每月有固定收入，固定收入金额自行设置。
2.每季或每年从固定交易对手转入金额，金额可设区间值，如5000-10000。
3.转入资金摘要有“工资”、“分红”、“红利”、“利息（非银行结息）”等收入","--员工 可疑兼职
select t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and bank <> 'ZJRCU'
and (customer_account_name rlike '代发|工资'
or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees'
or cash_type rlike '代发|工资|劳务费'
)
group by t1.id_card
having sum(amount_cr)>0
;
--员工 可疑固定收入
select distinct id_card
from
(
select id_card
,customer_account_name
,count(1) as income_qrt
,stddev(amount_total) as stddev_amount
from
(
select
id_card
,customer_account_name
,trans_qrt
,count(1) as trans_cnt
,sum(amount_cr) as amount_total
from
(
select t1.id_card
,customer_account_name
,amount_cr
,concat(year(trx_time),'-Q',quarter(trx_time)) as trans_qrt --每季度的固定收入
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr>0 --每笔收入金额
and t2.le_account_name <> t2.customer_account_name --排除同名交易
)
group by id_card,customer_account_name,trans_qrt
having count(1) > 3 --每季度大于3笔
and sum(amount_cr) between 3000 and 10000 ---该季度总收入，区间自行设置
)
group by id_card,customer_account_name
having count(1) >= 2 --2个及以上季度
and stddev(amount_total)<2000 --标准差小于2000，标识稳定收入
);",,,,,
6,可疑财产,"通过分析车险、房屋险、水电费、燃气费、物业费、车位费、租金、卫生费等缴纳判断车产、房产信息
有转出到售房公司交易，但本人及亲属名下无新增房产
新增住房信息（或有入住新房），但无购房交易、无定金、房款、装修款、设计费记录等
购房资金溯源，是否存在异常收入或向客户借入行为
与家庭收入不匹配的豪华房产","1.购房资金溯源，购房前账户资金来源构成。
2.员工及关系人有购房交易，但名下房产无新增登记。
3.员工及关系人有物业缴费记录，但名下房产无新增登记。
4.员工及关系人有5000元以上的纳税记录，但名下无房产车产新增登记。
5.有新增登记购房，但无相关购房交易记录。
6.入信新房但近期无购房、装修等支出。
7.与家庭年收入不匹配的豪华房产，其评估价值超过家庭年收入的 10倍。","--员工及其亲属购买房产但无资产登记
select t1.id_card
from
(
select id_card
,min(trx_time) as trx_time
from
(
select t1.id_card
,trx_time
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|房款|首付'
or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0
union all
select t1.person_id
,trx_time
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|房款|首付'
or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0
)
group by id_card
) t1
left join
(
select person_id
,max(updated_at) as updated_at
from ccdi_asset_info
where asset_main_type = 不动产 --根据具体数据确定码值
and asset_sub_type in (住宅,商铺) --根据具体数据确定码值
and asset_status = 正常 --根据具体数据确定码值
group by person_id
) t2
on t1.id_card = t2.person_id
where t1.trx_time > t2.updated_at --购买时间大于最近一次资产更新时间
or t2.person_id is null;
--有物业缴费记录但无房产登记
select t1.id_card
FROM
(
select id_card
from
(
select t1.id_card
,trx_time
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务'
or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区')
and amount_dr > 0
union all
select t1.person_id
,trx_time
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务'
or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区')
and amount_dr > 0
)
group by id_card
) t1
left join
(
select person_id
,max(updated_at) as updated_at
from ccdi_asset_info
where asset_main_type = 不动产
and asset_sub_type in (住宅,商铺)
and asset_status = 正常
group by person_id
) t2
on t1.id_card = t2.person_id
where t2.person_id is null;
----有5000元以上的纳税记录但无房产登记
select t1.id_card
FROM
(
select id_card
from
(
select t1.id_card
,trx_time
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr >= 5000
union all
select t1.person_id
,trx_time
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr >= 5000
)
group by id_card
) t1
left join
(
select person_id
,max(updated_at) as updated_at
from ccdi_asset_info
where asset_main_type = 不动产
and asset_sub_type in (住宅,商铺)
and asset_status = 正常
group by person_id
) t2
on t1.id_card = t2.person_id
where t2.person_id is null;
",,,,,
7,可疑外汇交易,异常购汇、结汇、跨境结汇,单笔购汇、结汇或跨境结汇金额超过限额。,"--员工 可疑外汇交易
select t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and customer_account_name rlike '银行|外汇|售汇|结汇|国家外汇管理局|外汇'
user_memo rlike '购汇|结汇|换汇|外汇|汇率|外币|现汇|结汇水单|外币兑换人民币|结汇入账|外汇结汇|外汇买入|购外币|购买外汇|外币'
group by t1.id_card
having sum(amount_cr)>100000
or sum(amount_dr)>100000 --限额自行设置
;",,,,,
8,可疑付息,客户经理管户的客户在智柜、柜面连续代交利息人数比较多,客户经理管户的客户在智柜、柜面连续 代交利息，且代交人数超过 2人。,"---管户经理与贷款客户有交易往来
with cust_loan_duty as (
select t1.id_card
,t2.customer_isn
from
ccdi_base_staff t1
left join
(
select customer_isn,creditor_code
from xdzx.loan_liability
where status = '1'
and product_code <> '15AC'
group by customer_isn,creditor_code
UNION
select t2.nfaacsno,t1.primary_principal
from xdzx.loan_duty t1
left join odsdb.blfmconf t2
on t1.contract_no = t2.nfaacono
where t1.status='1'
and t1.product_code ='15AC'
group by t2.nfaacsno,t1.primary_principal
) t2
on t1.staff_id = t2.creditor_code
)
select cret_no
FROM
(
select t1.cret_no,t2.customer_isn
from ccdi_bank_statement t1
inner join cust_loan_duty t2
on t1.cret_no = t2.id_card
left join
(
select CINOCSNO
,DFANAC19
,CDNOAC19
from odsdb.BWFMDCIM
where rcstrs1b <> '9'
and del_f = '0'
and OWONBRNO like '902%'
group by CINOCSNO,DFANAC19,CDNOAC19
) t3
on t2.customer_isn = t3.CINOCSNO
where project_id = PROJECT_ID
and (t1.customer_account_no = t3.DFANAC19--账号
or t1.customer_account_no = t3.CDNOAC19)--卡号
group by t1.cret_no,t2.customer_isn
having t1.amount_cr +t1.amount_dr > 0
)
group by cret_no
having count(customer_isn) > 2 --交易贷款客户超过两人
;",,,,,
9,可疑采购,"1.提示可能化整为零的采购
2.提示向同一企业或同一人实控的企业采购集中度过高的情况",单笔采购金额超过 10万元；提示向同一企业或同一人实控的企业采购集中度过高，单个供应商采购额占总采购额比例超过 70%。,"--单笔采购金额大于10万
select t1.id_card
from ccdi_base_staff t1
inner join
(
select applicant_id
from ccdi_purchase_transaction
where actual_amount>100000
UNION
select purchase_leader_id
from ccdi_purchase_transaction
where actual_amount>100000
) t2
on t1.staff_id = t2.applicant_id
;
----单个供应商采购金额占项目总采购额超百分之70
with project_total as (
select purchase_id
,sum(actual_amount) as total_amount
from ccdi_purchase_transaction
group by purchase_id
),
supplier_project AS (
select t1.applicant_id,t1.purchase_leader_id
from
(
select applicant_id
,purchase_leader_id
,purchase_id
,supplier_uscc
,sum(actual_amount) as supply_amount
from ccdi_purchase_transaction
group by applicant_id,purchase_leader_id,purchase_id,supplier_uscc
) t1
left join project_total t2
ON t1.purchase_id = t2.purchase_id
where t1.supply_amount / t2.total_amount > 0.7
)
select t2.id_card
(
select applicant_id
from supplier_project
union
select purchase_leader_id
from supplier_project
) t1
inner join
ccdi_base_staff t2
on t1.applicant_id = t2.staff_id;",,,,,
10,异常行为,"1.每天长时间电话、频繁电话、微信电话
2.丰收互联交易IP地址与属地IP地址段不匹配
3.家庭老人、非家庭关系人银证大额转账
4.微信支付宝频繁提现
5.工资发放后立即转出大部分资金的行为
6.工资发放后除代扣项目外，几乎不使用的情况
7.涉诉情况
8.大额炒股
9.操控他人账户交易
","1.每天电话、微信通话时长超过 2小时 或同一对像通话次数超过5次。
2.丰收互联交易IP地址与属地IP地址段不匹配。
3.家庭老人、非家庭关系人银证大额转账，单笔超过设置限额。
4.微信、支付宝单日提现次数超过设置次 或单日累计提现金额超过 设置限额。
5.工资发放后 24小时内 转出超过 80% 的资金。
6.工资发放后除代扣项目外，连续30天 无任何消费或转账记录。
7.大额炒股，单次三方资管交易金额超过 100万元。
8.多次代理他人账户交易，或登录员工手机操作他人丰收互联交易。
","--支付宝微信单日提现金额和笔数
select t1.id_card
,t2.trx_time
,count(1) as trans_cnt
,sum(amount_cr) as trans_amt
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现'
or customer_account_name rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现')
and amount_cr >= 0
group by t1.id_card,t2.trx_time;
--员工 发工资后1天内转出80%以上
select t1.id_card
from
(
select t1.id_card
,t2.trx_time as sala_time
,t2.amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and bank = 'ZJRCU'
and (customer_account_name rlike '代发|工资'
or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees'
or cash_type rlike '代发|工资|劳务费'
and amount_cr > 0
)
) t1
left join
(
select t1.id_card
,t2.trx_time
,t2.amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and bank = 'ZJRCU'
and amount_dr > 0
) t2
on t1.id_card = t2.id_card
where t2.trx_time between t1.sala_time and date_add(t1.sala_time,interval 1 day)
group by t1.id_card
having sum(t2.amount_dr) / sum(t1.amount_cr) >0.8
;
--炒股、单次三方资管交易金额超100万
select distinct id_card
FROM
(
select t1.id_card
,t2.amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (customer_account_name rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财'
or user_memo rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财'
or cash_type rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财'
)
and amount_dr > 1000000
);",,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
1 可疑行为排查模型
2 序号 模型名称 描述 业务口径 代码
3 1 大额交易 关注账户（包括本人、亲属、注册主体等账户），房、车采购等大额消费，异常纳税支出等。 除工资收入外的大额流入，大额的额度可在排查参数输入页面进行设置 修改默认限额，且年流水交易额超过默认限额。 大额存现或短时间多次存现 大额转账或频繁转账，大额的定义数字可在排查参数输入页面进行设置 1.备注或对交易对手是房产公司、二手房、车辆销售公司、物业公司等。 2.有税务支出记录 3.同一交易对手（除家庭成员外、本单位代发工资）单笔超过 设置限额或累计交易金额超过 设置限额的资金流入； 4.年流水交易额超过  设置限额； 5.大额存现或短时间多次存现，单笔超过 设置限额； 6.大额转账或频繁转账，单笔超过 设置限额。 ---员工及其亲属购买车房支出金额 select id_card ,sum(amount_dr) as amount_dr from ( select t1.id_card ,amount_dr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷' or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局') and amount_dr > 0 union all select t1.person_id ,amount_dr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷' or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局') and amount_dr > 0 ) group by id_card; ----员工及其亲属税务支出金额 select id_card ,sum(amount_dr) as amount_dr from ( select t1.id_card ,amount_dr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '税务|缴税|税款' or customer_account_name rlike '税务|税务局|国库|国家金库|财政') and amount_dr > 0 union all select t1.person_id ,amount_dr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and (user_memo rlike '税务|缴税|税款' or customer_account_name rlike '税务|税务局|国库|国家金库|财政') and amount_dr > 0 ) group by id_card; --员工与同一交易对手（非亲属）的最大一笔收入交易金额 select id_card ,max(max_amount_cr) as max_amount_cr from ( select t1.id_card ,t1.customer_account_name ,t1.max_amount_cr from ( select t1.id_card ,customer_account_name ,max(amount_cr) as max_amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and t2.le_account_name <> t2.customer_account_name and customer_account_name not like '%代发%' and customer_account_name not like '%工资%' and user_memo not like '%代发%' and user_memo not like '%工资%' and user_memo not like '%奖金%' and user_memo not like '%薪酬%' and user_memo not like '%薪金%' and user_memo not like '%补贴%' and user_memo not like '%薪%' and user_memo not like '%年终奖%' and user_memo not like '%年金%' and user_memo not like '%加班费%' and user_memo not like '%劳务费%' and user_memo not like '%劳务外包%' and user_memo not like '%提成%' and user_memo not like '%劳务派遣%' and user_memo not like '%绩效%' and user_memo not like '%酬劳%' and user_memo not like '%PAYROLL%' and user_memo not like '%SALA%' and user_memo not like '%CPF%' and user_memo not like '%directors%fees%' and user_memo not like '%批量代付%' and cash_type not like '%代发%' and cash_type not like '%工资%' and cash_type not like '%劳务费%' and amount_cr > 0 group by id_card,customer_account_name ) t1 left join ccdi_staff_fmy_relation t2 on t1.id_card = t2.person_id and t1.customer_account_name = t2.relation_name where t2.person_id is null; ) group by id_card; --员工与同一交易对手（非亲属）的累计收入交易金额 select t1.id_card ,t1.customer_account_name ,t1.amount_cr from ( select t1.id_card ,customer_account_name ,sum(amount_cr) as amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and t2.le_account_name <> t2.customer_account_name and customer_account_name not like '%代发%' and customer_account_name not like '%工资%' and user_memo not like '%代发%' and user_memo not like '%工资%' and user_memo not like '%奖金%' and user_memo not like '%薪酬%' and user_memo not like '%薪金%' and user_memo not like '%补贴%' and user_memo not like '%薪%' and user_memo not like '%年终奖%' and user_memo not like '%年金%' and user_memo not like '%加班费%' and user_memo not like '%劳务费%' and user_memo not like '%劳务外包%' and user_memo not like '%提成%' and user_memo not like '%劳务派遣%' and user_memo not like '%绩效%' and user_memo not like '%酬劳%' and user_memo not like '%PAYROLL%' and user_memo not like '%SALA%' and user_memo not like '%CPF%' and user_memo not like '%directors%fees%' and user_memo not like '%批量代付%' and cash_type not like '%代发%' and cash_type not like '%工资%' and cash_type not like '%劳务费%' group by id_card,customer_account_name having sum(amount_cr)>0 ) t1 left join ccdi_staff_fmy_relation t2 on t1.id_card = t2.person_id and t1.customer_account_name = t2.relation_name where t2.person_id is null; --员工及其亲属 年交易金额 select id_card ,sum(trans_amount) as trans_amount from ( select t1.id_card ,amount_dr + amount_cr as trans_amount from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and TRX_DATE >= $$$ --近一年 and t2.le_account_name <> t2.customer_account_name --排除同名交易 union all select t1.person_id ,amount_dr + amount_cr as trans_amount from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and TRX_DATE >= $$$ --近一年 and t2.le_account_name <> t2.customer_account_name --排除同名交易 ) group by id_card; ---员工及其亲属 最大一笔存现单笔金额 select id_card ,max(amount_cr) as amount_cr FROM ( select t1.id_card ,max(amount_cr) as amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_cr>0 and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) group by t1.id_card union all select t1.person_id ,max(amount_cr) as amount_cr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and amount_cr>0 and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) group by t1.person_id ) group by id_card ; --员工及其亲属 存现总金额 select id_card,sum(amount_cr) as amount_cr from ( select t1.id_card ,amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_cr>0 and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) union all select t1.person_id ,amount_cr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and amount_cr>0 and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) )group by id_card ; --员工及其亲属 大额现金存入次数 select id_card,count(1) from ( select t1.id_card ,amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_cr> $$$$$$ and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) union all select t1.person_id ,amount_cr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and amount_cr> $$$$$$$ and ( (((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or ((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%') ) )group by id_card ; --员工及其亲属 大额转账次数 select id_card,count(1) from ( select t1.id_card ,amount_dr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_dr> $$$$$$ and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入') and user_memo not like '%款%' and t2.le_account_name <> t2.customer_account_name --排除同名交易 union all select t1.person_id ,amount_dr from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and amount_dr> $$$$$$ and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入') and user_memo not like '%款%' and t2.le_account_name <> t2.customer_account_name --排除同名交易 ) group by id_card ;
4 2 异常交易 员工及关系人与客户之间非正常资金往来 关系人中没有收入或低收入人员有大额资金交易 1.员工及关系人与客户及关系人之间有超过1000元以上的资金往来；客户指信贷类客户包括贷款户、担保人，中介库人员，包括中介注册的主体及主体关系人。 2.关系人中没有收入或月收入低于 3000元 的人员，单笔或累计交易金额超过 10万元。 --员工及其亲属与贷款客户、担保户、中介有异常交易 with loan_cust_acct as ( select t2.aa01ac15 from ( select substr(nfabcsid,4) as nfabcsid from odsdb.blfmconf --贷款合同文件 where nfaacost in ('3','5','7') --合同状态 and substr(nfaabrno,1,3) = '902' --机构 and del_f = '0' group by substr(nfabcsid,4) ) t1 inner join ( select aa01ac15 --账号 ,aa62cfno from sjfx_pro.bdfmhqaa_orc where del_f = 0 and substr(trim(aa47brno),1,3) = '902' --机构号修改 and rcstrs1b <>'9' AND aa15zhzt ='1' -- 账户状态 1-正常 2-销户 3-新开户 4-结清 group by aa01ac15 ,aa62cfno ) t2 on t1.nfabcsid = t2.aa62cfno ) , assure_cust_acct as ( select t2.aa01ac15 from ( select asseure_sign from xdzx.assure_infomation where del_f= '0' and assure_state <> '2' and substr(create_org,1,3)='902' group by asseure_sign ) t1 inner join ( select aa01ac15 --账号 ,aa03csno from sjfx_pro.bdfmhqaa_orc where del_f = 0 and substr(trim(aa47brno),1,3) = '902' --机构号修改 and rcstrs1b <>'9' AND aa15zhzt ='1' -- 账户状态 1-正常 2-销户 3-新开户 4-结清 group by aa01ac15 ,aa03csno ) t2 on t1.asseure_sign = t2.aa03csno ) select distinct id_card from ( select id_card ,customer_account_no from ( select t1.id_card ,customer_account_no ,amount_dr + amount_cr as trans_amount from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and customer_account_no is not null union all select t1.person_id ,customer_account_no ,amount_dr + amount_cr as trans_amount from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and customer_account_no is not null ) group by id_card,customer_account_no having sum(customer_account_no)>1000 ) a where exists (select 1 from loan_cust_acct b on a.customer_account_no = b.aa01ac15) or exists (select 1 from assure_cust_acct c on a.customer_account_no = c.aa01ac15) or exists (select 1 from 中介名单 d on a.customer_account_no = d.中介账号); --员工亲属低收入但交易金额高 select distinct person_id from ( select person_id ,relation_cert_no ,avg(amount_cr) as avg_amount_cr from ( select t1.person_id ,t1.relation_cert_no ,substr(trx_time,1,7) ,sum(amount_cr) as amount_cr--收入金额 from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and t2.le_account_name <> t2.customer_account_name --排除同名交易 group by t1.person_id,t1.relation_cert_no,substr(trx_time,1,7) ) group by person_id,relation_cert_no having avg(amount_cr)<=3000 ---月均收入不超过3000 ) t1 left join ( select t1.relation_cert_no ,sum(amount_cr + amount_dr) as trans_amount from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID group by t1.relation_cert_no having sum(amount_cr + amount_dr) >= 100000 or max(amount_cr) >= 100000 or max(amount_dr) >= 100000 ) t2 on t1.relation_cert_no = t2.relation_cert_no where t2.relation_cert_no is not null ;
5 3 疑似赌博 通过多人多次在相近时间有转账、微信转账、支付宝转账发生，且额度在可疑区间。金额区间可在排查设置页面进行设置 大额购买彩票行为 疑似赌球行为 疑似网络赌博行为 1.多人只2人及以上，多次指2次以上，相近时间指同一天。 2.备注或交易摘要、对手有“游戏、抖币、体彩、福彩”等字眼 --员工 疑似赌博 select distinct id_card from ( select t1.id_card,trx_time from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and ((amount_dr>= $$$ and amount_dr<=$$$) or (amount_cr>= $$$ and amount_cr<=$$$)) -----转入转出金额区间 and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|红包|网转|转入' or cash_type rlike '转帐|转账|红包|网转|转入') and user_memo not like '%款%' and t2.le_account_name <> t2.customer_account_name --排除同名交易 group by t1.id_card,trx_time having count(distinct customer_account_name)>=2 and count(1)>=2 ); --员工 网络赌博、体彩 select t1.id_card ,amount_dr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_dr> 0 and (user_memo rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注' or customer_account_name rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注') ;
6 4 可疑关系 除与配偶、子女外发生特殊金额交易，如1314、520。可在排查参数输入页面进行设置 除与配偶、子女外，发生特殊金额交易，如 1314元、520元 等具有特殊含义的金额。 --员工 可疑关系 select distinct t1.id_card from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no left join ccdi_staff_fmy_relation t3 on t1.id_card = t3.person_id and t2.customer_account_name = t3.relation_name where t2.project_id = PROJECT_ID and t3.relation_type not in (配偶，子女) --关系类型按实际数据的码值确定 and (amount_dr in (520,1314) or amount_cr in (520,1314)) ;
7 5 可疑兼职 除本行工资收入外，有固定收入 1.除本行工资收入外，每月有固定收入，固定收入金额自行设置。 2.每季或每年从固定交易对手转入金额，金额可设区间值，如5000-10000。 3.转入资金摘要有“工资”、“分红”、“红利”、“利息（非银行结息）”等收入 --员工 可疑兼职 select t1.id_card from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and bank <> 'ZJRCU' and (customer_account_name rlike '代发|工资' or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees' or cash_type rlike '代发|工资|劳务费' ) group by t1.id_card having sum(amount_cr)>0 ; --员工 可疑固定收入 select distinct id_card from ( select id_card ,customer_account_name ,count(1) as income_qrt ,stddev(amount_total) as stddev_amount from ( select id_card ,customer_account_name ,trans_qrt ,count(1) as trans_cnt ,sum(amount_cr) as amount_total from ( select t1.id_card ,customer_account_name ,amount_cr ,concat(year(trx_time),'-Q',quarter(trx_time)) as trans_qrt --每季度的固定收入 from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and amount_cr>0 --每笔收入金额 and t2.le_account_name <> t2.customer_account_name --排除同名交易 ) group by id_card,customer_account_name,trans_qrt having count(1) > 3 --每季度大于3笔 and sum(amount_cr) between 3000 and 10000 ---该季度总收入，区间自行设置 ) group by id_card,customer_account_name having count(1) >= 2 --2个及以上季度 and stddev(amount_total)<2000 --标准差小于2000，标识稳定收入 );
8 6 可疑财产 通过分析车险、房屋险、水电费、燃气费、物业费、车位费、租金、卫生费等缴纳判断车产、房产信息 有转出到售房公司交易，但本人及亲属名下无新增房产 新增住房信息（或有入住新房），但无购房交易、无定金、房款、装修款、设计费记录等 购房资金溯源，是否存在异常收入或向客户借入行为 与家庭收入不匹配的豪华房产 1.购房资金溯源，购房前账户资金来源构成。 2.员工及关系人有购房交易，但名下房产无新增登记。 3.员工及关系人有物业缴费记录，但名下房产无新增登记。 4.员工及关系人有5000元以上的纳税记录，但名下无房产车产新增登记。 5.有新增登记购房，但无相关购房交易记录。 6.入信新房但近期无购房、装修等支出。 7.与家庭年收入不匹配的豪华房产，其评估价值超过家庭年收入的 10倍。 --员工及其亲属购买房产但无资产登记 select t1.id_card from ( select id_card ,min(trx_time) as trx_time from ( select t1.id_card ,trx_time from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '(购|买).*房|房款|首付' or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局') and amount_dr > 0 union all select t1.person_id ,trx_time from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and (user_memo rlike '(购|买).*房|房款|首付' or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局') and amount_dr > 0 ) group by id_card ) t1 left join ( select person_id ,max(updated_at) as updated_at from ccdi_asset_info where asset_main_type = 不动产 --根据具体数据确定码值 and asset_sub_type in (住宅,商铺) --根据具体数据确定码值 and asset_status = 正常 --根据具体数据确定码值 group by person_id ) t2 on t1.id_card = t2.person_id where t1.trx_time > t2.updated_at --购买时间大于最近一次资产更新时间 or t2.person_id is null; --有物业缴费记录但无房产登记 select t1.id_card FROM ( select id_card from ( select t1.id_card ,trx_time from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务' or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区') and amount_dr > 0 union all select t1.person_id ,trx_time from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务' or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区') and amount_dr > 0 ) group by id_card ) t1 left join ( select person_id ,max(updated_at) as updated_at from ccdi_asset_info where asset_main_type = 不动产 and asset_sub_type in (住宅,商铺) and asset_status = 正常 group by person_id ) t2 on t1.id_card = t2.person_id where t2.person_id is null; ----有5000元以上的纳税记录但无房产登记 select t1.id_card FROM ( select id_card from ( select t1.id_card ,trx_time from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '税务|缴税|税款' or customer_account_name rlike '税务|税务局|国库|国家金库|财政') and amount_dr >= 5000 union all select t1.person_id ,trx_time from ccdi_staff_fmy_relation t1 inner join ccdi_bank_statement t2 on t1.relation_cert_no = t2.cret_no where t1.status = 1 and t2.project_id = PROJECT_ID and (user_memo rlike '税务|缴税|税款' or customer_account_name rlike '税务|税务局|国库|国家金库|财政') and amount_dr >= 5000 ) group by id_card ) t1 left join ( select person_id ,max(updated_at) as updated_at from ccdi_asset_info where asset_main_type = 不动产 and asset_sub_type in (住宅,商铺) and asset_status = 正常 group by person_id ) t2 on t1.id_card = t2.person_id where t2.person_id is null;
9 7 可疑外汇交易 异常购汇、结汇、跨境结汇 单笔购汇、结汇或跨境结汇金额超过限额。 --员工 可疑外汇交易 select t1.id_card from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and customer_account_name rlike '银行|外汇|售汇|结汇|国家外汇管理局|外汇' user_memo rlike '购汇|结汇|换汇|外汇|汇率|外币|现汇|结汇水单|外币兑换人民币|结汇入账|外汇结汇|外汇买入|购外币|购买外汇|外币' group by t1.id_card having sum(amount_cr)>100000 or sum(amount_dr)>100000 --限额自行设置 ;
10 8 可疑付息 客户经理管户的客户在智柜、柜面连续代交利息人数比较多 客户经理管户的客户在智柜、柜面连续 代交利息，且代交人数超过 2人。 ---管户经理与贷款客户有交易往来 with cust_loan_duty as ( select t1.id_card ,t2.customer_isn from ccdi_base_staff t1 left join ( select customer_isn,creditor_code from xdzx.loan_liability where status = '1' and product_code <> '15AC' group by customer_isn,creditor_code UNION select t2.nfaacsno,t1.primary_principal from xdzx.loan_duty t1 left join odsdb.blfmconf t2 on t1.contract_no = t2.nfaacono where t1.status='1' and t1.product_code ='15AC' group by t2.nfaacsno,t1.primary_principal ) t2 on t1.staff_id = t2.creditor_code ) select cret_no FROM ( select t1.cret_no,t2.customer_isn from ccdi_bank_statement t1 inner join cust_loan_duty t2 on t1.cret_no = t2.id_card left join ( select CINOCSNO ,DFANAC19 ,CDNOAC19 from odsdb.BWFMDCIM where rcstrs1b <> '9' and del_f = '0' and OWONBRNO like '902%' group by CINOCSNO,DFANAC19,CDNOAC19 ) t3 on t2.customer_isn = t3.CINOCSNO where project_id = PROJECT_ID and (t1.customer_account_no = t3.DFANAC19--账号 or t1.customer_account_no = t3.CDNOAC19)--卡号 group by t1.cret_no,t2.customer_isn having t1.amount_cr +t1.amount_dr > 0 ) group by cret_no having count(customer_isn) > 2 --交易贷款客户超过两人 ;
11 9 可疑采购 1.提示可能化整为零的采购 2.提示向同一企业或同一人实控的企业采购集中度过高的情况 单笔采购金额超过 10万元；提示向同一企业或同一人实控的企业采购集中度过高，单个供应商采购额占总采购额比例超过 70%。 --单笔采购金额大于10万 select t1.id_card from ccdi_base_staff t1 inner join ( select applicant_id from ccdi_purchase_transaction where actual_amount>100000 UNION select purchase_leader_id from ccdi_purchase_transaction where actual_amount>100000 ) t2 on t1.staff_id = t2.applicant_id ; ----单个供应商采购金额占项目总采购额超百分之70 with project_total as ( select purchase_id ,sum(actual_amount) as total_amount from ccdi_purchase_transaction group by purchase_id ), supplier_project AS ( select t1.applicant_id,t1.purchase_leader_id from ( select applicant_id ,purchase_leader_id ,purchase_id ,supplier_uscc ,sum(actual_amount) as supply_amount from ccdi_purchase_transaction group by applicant_id,purchase_leader_id,purchase_id,supplier_uscc ) t1 left join project_total t2 ON t1.purchase_id = t2.purchase_id where t1.supply_amount / t2.total_amount > 0.7 ) select t2.id_card ( select applicant_id from supplier_project union select purchase_leader_id from supplier_project ) t1 inner join ccdi_base_staff t2 on t1.applicant_id = t2.staff_id;
12 10 异常行为 1.每天长时间电话、频繁电话、微信电话 2.丰收互联交易IP地址与属地IP地址段不匹配 3.家庭老人、非家庭关系人银证大额转账 4.微信支付宝频繁提现 5.工资发放后立即转出大部分资金的行为 6.工资发放后除代扣项目外，几乎不使用的情况 7.涉诉情况 8.大额炒股 9.操控他人账户交易 1.每天电话、微信通话时长超过 2小时 或同一对像通话次数超过5次。 2.丰收互联交易IP地址与属地IP地址段不匹配。 3.家庭老人、非家庭关系人银证大额转账，单笔超过设置限额。 4.微信、支付宝单日提现次数超过设置次 或单日累计提现金额超过 设置限额。 5.工资发放后 24小时内 转出超过 80% 的资金。 6.工资发放后除代扣项目外，连续30天 无任何消费或转账记录。 7.大额炒股，单次三方资管交易金额超过 100万元。 8.多次代理他人账户交易，或登录员工手机操作他人丰收互联交易。 --支付宝微信单日提现金额和笔数 select t1.id_card ,t2.trx_time ,count(1) as trans_cnt ,sum(amount_cr) as trans_amt from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (user_memo rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现' or customer_account_name rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现') and amount_cr >= 0 group by t1.id_card,t2.trx_time; --员工 发工资后1天内转出80%以上 select t1.id_card from ( select t1.id_card ,t2.trx_time as sala_time ,t2.amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and bank = 'ZJRCU' and (customer_account_name rlike '代发|工资' or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees' or cash_type rlike '代发|工资|劳务费' and amount_cr > 0 ) ) t1 left join ( select t1.id_card ,t2.trx_time ,t2.amount_dr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and bank = 'ZJRCU' and amount_dr > 0 ) t2 on t1.id_card = t2.id_card where t2.trx_time between t1.sala_time and date_add(t1.sala_time,interval 1 day) group by t1.id_card having sum(t2.amount_dr) / sum(t1.amount_cr) >0.8 ; --炒股、单次三方资管交易金额超100万 select distinct id_card FROM ( select t1.id_card ,t2.amount_cr from ccdi_base_staff t1 inner join ccdi_bank_statement t2 on t1.id_card = t2.cret_no where project_id = PROJECT_ID and (customer_account_name rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财' or user_memo rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财' or cash_type rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财' ) and amount_dr > 1000000 );
13
14
15
16
17
18
19
20
21
22

41
assets/大额交易.csv
View File

@@ -176,39 +176,34 @@ and (
)
;
",大额存现金额,流水明细,一般
,,短时间多次存现,短时间多次存现，次数超过设置限额,单日存现总次数,FREQUENT_CASH_DEPOSIT,员工本人,员工及其亲属账户中，按日统计现金存入次数超阈值,"sql<br>--员工及其亲属 大额现金存入次数
select id_card,count(1)
from
(
,,短时间多次存现,短时间多次存现，次数超过设置限额,单日存现总次数,FREQUENT_CASH_DEPOSIT,员工本人,员工及其亲属账户中，按日统计现金存入次数超阈值,"sql<br>--员工单日大额存现次数
select t1.id_card
,amount_cr
,left(t2.trx_time,10) as cash_trans_date
,count(1) as cash_count
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr> $$$$$$
and amount_cr>$$$$ ---大额存现阈值参数
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
union all
select t1.person_id
,amount_cr
from
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr> $$$$$$$
and (
(((user_memo like '%现金%' and user_memo not like '%金管理%' and user_memo not like '%金添利%' and user_memo not like '%现金利%' and user_memo not like '%现金宝%' and user_memo not like '%金分析%' ) or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%' or cash_type like '%存现%' or cash_type like '%现存%' or cash_type like '%金存入%' or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%' and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%' or user_memo like '%自助存款%' or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
)group by id_card
group by t1.id_card,left(t2.trx_time,10)
;
",单日存现总次数,个人、日期、次数,一般
1.6,,大额转账交易,大额转账单笔超过设置限额,大额转账金额（单笔）,large_tfr_cnt,员工本人,员工及其亲属账户中，筛选单笔 amount_dr 超金额阈值的数据,,大额转账金额,流水明细,一般
1.6,,大额转账交易,大额转账单笔超过设置限额,大额转账金额（单笔）,large_tfr_cnt,员工本人,员工及其亲属账户中，筛选单笔 amount_dr 超金额阈值的数据,"--员工大额转账（排除同名转账）转出超阈值 流水id
select t2.bank_statement_id
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_dr> $$$$$$ --大额转账阈值
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入')
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
;",大额转账金额,流水明细,一般
1 序号 模型名称 核心异常点（展示在前端页面） 业务口径 相关指标 指标英文名 风险筛查对象 技术口径 代码 限制阈值指标 可疑结果返回 风险等级
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209