可疑行为排查模型,,,,,,,,,
序号,模型名称,描述,业务口径,代码,,,,,
1,大额交易,"关注账户（包括本人、亲属、注册主体等账户），房、车采购等大额消费，异常纳税支出等。
除工资收入外的大额流入，大额的额度可在排查参数输入页面进行设置
修改默认限额，且年流水交易额超过默认限额。
大额存现或短时间多次存现
大额转账或频繁转账，大额的定义数字可在排查参数输入页面进行设置","1.备注或对交易对手是房产公司、二手房、车辆销售公司、物业公司等。
2.有税务支出记录
3.同一交易对手（除家庭成员外、本单位代发工资）单笔超过 设置限额或累计交易金额超过 设置限额的资金流入；
4.年流水交易额超过  设置限额；
5.大额存现或短时间多次存现，单笔超过 设置限额；
6.大额转账或频繁转账，单笔超过 设置限额。","---员工及其亲属购买车房支出金额
select id_card
,sum(amount_dr) as amount_dr
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷'
or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0 
union all
select t1.person_id
,amount_dr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '(购|买).*房|(购|买).*车|车款|房款|首付|(房|车).*贷'
or customer_account_name rlike '汽车销售|汽车金融|4S店|汽贸|车行|房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
and amount_dr > 0 
)
group by id_card;

----员工及其亲属税务支出金额
select id_card
,sum(amount_dr) as amount_dr
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr > 0 
union all
select t1.person_id
,amount_dr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and (user_memo rlike '税务|缴税|税款'
or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
and amount_dr > 0 
)
group by id_card;



--员工与同一交易对手（非亲属）的最大一笔收入交易金额
select id_card
	,max(max_amount_cr) as max_amount_cr
from
(
select
	t1.id_card
	,t1.customer_account_name
	,t1.max_amount_cr
from 
(
	select t1.id_card
		,customer_account_name
		,max(amount_cr) as max_amount_cr
	from ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and t2.le_account_name <> t2.customer_account_name
	and customer_account_name not like '%代发%' 
	and customer_account_name not like '%工资%'
	and user_memo not like '%代发%' 
	and user_memo not like '%工资%' 
	and user_memo not like '%奖金%' 
	and user_memo not like '%薪酬%'
	and user_memo not like '%薪金%'
	and user_memo not like '%补贴%'
	and user_memo not like '%薪%'
	and user_memo not like '%年终奖%'
	and user_memo not like '%年金%' 
	and user_memo not like '%加班费%' 
	and user_memo not like '%劳务费%' 
	and user_memo not like '%劳务外包%' 
	and user_memo not like '%提成%'
	and user_memo not like '%劳务派遣%'
	and user_memo not like '%绩效%'
	and user_memo not like '%酬劳%'
	and user_memo not like '%PAYROLL%' 
	and user_memo not like '%SALA%'
	and user_memo not like '%CPF%'
	and user_memo not like '%directors%fees%'
	and user_memo not like '%批量代付%'
	and cash_type not like '%代发%'  
	and cash_type not like '%工资%' 
	and cash_type not like '%劳务费%' 
	and amount_cr > 0
	group by id_card,customer_account_name
) t1
left join ccdi_staff_fmy_relation t2
on t1.id_card = t2.person_id
and t1.customer_account_name = t2.relation_name
where t2.person_id is null;
) group by id_card;




--员工与同一交易对手（非亲属）的累计收入交易金额
select
	t1.id_card
	,t1.customer_account_name
	,t1.amount_cr
from 
(
	select t1.id_card
		,customer_account_name
		,sum(amount_cr) as amount_cr
	from ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and t2.le_account_name <> t2.customer_account_name
	and customer_account_name not like '%代发%' 
	and customer_account_name not like '%工资%'
	and user_memo not like '%代发%' 
	and user_memo not like '%工资%' 
	and user_memo not like '%奖金%' 
	and user_memo not like '%薪酬%'
	and user_memo not like '%薪金%'
	and user_memo not like '%补贴%'
	and user_memo not like '%薪%'
	and user_memo not like '%年终奖%'
	and user_memo not like '%年金%' 
	and user_memo not like '%加班费%' 
	and user_memo not like '%劳务费%' 
	and user_memo not like '%劳务外包%' 
	and user_memo not like '%提成%'
	and user_memo not like '%劳务派遣%'
	and user_memo not like '%绩效%'
	and user_memo not like '%酬劳%'
	and user_memo not like '%PAYROLL%' 
	and user_memo not like '%SALA%'
	and user_memo not like '%CPF%'
	and user_memo not like '%directors%fees%'
	and user_memo not like '%批量代付%'
	and cash_type not like '%代发%'  
	and cash_type not like '%工资%' 
	and cash_type not like '%劳务费%' 
	group by id_card,customer_account_name
	having sum(amount_cr)>0
) t1
left join ccdi_staff_fmy_relation t2
on t1.id_card = t2.person_id
and t1.customer_account_name = t2.relation_name
where t2.person_id is null;


 

--员工及其亲属 年交易金额
select id_card
,sum(trans_amount) as trans_amount
from
(
	select t1.id_card
	,amount_dr + amount_cr as trans_amount
	from
	ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and TRX_DATE >= $$$     --近一年
	and t2.le_account_name <> t2.customer_account_name --排除同名交易
	union all
	select t1.person_id
	,amount_dr + amount_cr as trans_amount
	from 
	ccdi_staff_fmy_relation t1
	inner join
	ccdi_bank_statement t2
	on t1.relation_cert_no = t2.cret_no
	where t1.status = 1
	and t2.project_id = PROJECT_ID
	and TRX_DATE >= $$$     --近一年
	and t2.le_account_name <> t2.customer_account_name --排除同名交易
)
group by id_card;




---员工及其亲属 最大一笔存现单笔金额
select id_card
,max(amount_cr) as amount_cr
FROM
(
select t1.id_card
,max(amount_cr) as amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
group by t1.id_card
union all
select t1.person_id
,max(amount_cr) as amount_cr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
group by t1.person_id
)
group by id_card
;





--员工及其亲属 存现总金额
select id_card,sum(amount_cr) as amount_cr
from
(
select t1.id_card
,amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
union all
select t1.person_id
,amount_cr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr>0
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
)group by id_card
;



--员工及其亲属 大额现金存入次数
select id_card,count(1)
from
(
select t1.id_card
,amount_cr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_cr> $$$$$$
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
union all
select t1.person_id
,amount_cr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_cr> $$$$$$$
and (
(((user_memo like '%现金%' and user_memo not  like '%金管理%'  and user_memo not  like '%金添利%'  and user_memo not  like '%现金利%' and user_memo not  like '%现金宝%'  and user_memo not  like '%金分析%' )  or user_memo like '%存现%' or user_memo like '%现存%' or cash_type like '%现金%'  or cash_type like '%存现%'  or cash_type like '%现存%' or cash_type like '%金存入%'  or user_memo like '%金存入%' or (user_memo like '%ATM%' and (user_memo like '%存款%' or user_memo like '%转入%')) or (cash_type like '%ATM%'  and (cash_type like '%存款%' or cash_type like '%转入%'))) and (customer_account_name = '' or customer_account_name = '无' or customer_account_name like '%存现%') or user_memo like '%DEPOSIT%') or
((customer_account_name = '库存现金' or ((user_memo like '%现金存款%'  or user_memo like '%自助存款%'  or user_memo like '%CRS存款%' or cash_type like '%现金存款%' or cash_type like '%自助存款%' or cash_type like '%本行CRS存款%' or cash_type like '%柜面%' or user_memo like '%柜面%') and customer_account_name = '' )) or (customer_account_name = '现金' and user_memo not like '%借款%') or user_memo like '%本行ATM%')
)
)group by id_card
;




--员工及其亲属 大额转账次数
select id_card,count(1)
from
(
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_dr> $$$$$$
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入') 
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
union all
select t1.person_id
,amount_dr
from 
ccdi_staff_fmy_relation t1
inner join
ccdi_bank_statement t2
on t1.relation_cert_no = t2.cret_no
where t1.status = 1
and t2.project_id = PROJECT_ID
and amount_dr> $$$$$$
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入' or cash_type rlike '转帐|转账|汇入|转存|红包|汇款|网转|转入') 
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
)
group by id_card
;",,,,,
2,异常交易,"员工及关系人与客户之间非正常资金往来
关系人中没有收入或低收入人员有大额资金交易","1.员工及关系人与客户及关系人之间有超过1000元以上的资金往来；客户指信贷类客户包括贷款户、担保人，中介库人员，包括中介注册的主体及主体关系人。
2.关系人中没有收入或月收入低于 3000元 的人员，单笔或累计交易金额超过 10万元。","--员工及其亲属与贷款客户、担保户、中介有异常交易
with loan_cust_acct as (
select t2.aa01ac15
from
(
	select substr(nfabcsid,4) as nfabcsid
    from odsdb.blfmconf --贷款合同文件 
    where nfaacost in ('3','5','7') --合同状态 
    and substr(nfaabrno,1,3) = '902' --机构 
    and del_f = '0' 
    group by substr(nfabcsid,4)
) t1
inner join
(
	select      
        aa01ac15        --账号
		,aa62cfno
	from sjfx_pro.bdfmhqaa_orc 
	where del_f = 0
    and substr(trim(aa47brno),1,3) = '902'     --机构号修改
	and rcstrs1b <>'9'
    AND aa15zhzt ='1'    -- 账户状态 1-正常 2-销户 3-新开户 4-结清
	group by  aa01ac15 ,aa62cfno
) t2
on t1.nfabcsid = t2.aa62cfno
) ,
assure_cust_acct as (
select t2.aa01ac15
from
(
	select asseure_sign
	from xdzx.assure_infomation
	where del_f= '0'
	and assure_state <> '2'
	and substr(create_org,1,3)='902'
	group by asseure_sign
) t1
inner join 
(
	select      
        aa01ac15        --账号
		,aa03csno
	from sjfx_pro.bdfmhqaa_orc 
	where del_f = 0
    and substr(trim(aa47brno),1,3) = '902'     --机构号修改
	and rcstrs1b <>'9'
    AND aa15zhzt ='1'    -- 账户状态 1-正常 2-销户 3-新开户 4-结清
	group by  aa01ac15 ,aa03csno
) t2
on t1.asseure_sign = t2.aa03csno
)
select distinct id_card
from
(
select id_card
	,customer_account_no
from
(
	select t1.id_card
	,customer_account_no
	,amount_dr + amount_cr as trans_amount
	from
	ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and customer_account_no is not null
	union all
	select t1.person_id
	,customer_account_no
	,amount_dr + amount_cr as trans_amount
	from 
	ccdi_staff_fmy_relation t1
	inner join
	ccdi_bank_statement t2
	on t1.relation_cert_no = t2.cret_no
	where t1.status = 1
	and t2.project_id = PROJECT_ID
	and customer_account_no is not null
) group by id_card,customer_account_no
having sum(customer_account_no)>1000
) a
where exists (select 1 from loan_cust_acct b on a.customer_account_no = b.aa01ac15)
or exists (select 1 from assure_cust_acct c on a.customer_account_no = c.aa01ac15)
or exists (select 1 from 中介名单 d on a.customer_account_no = d.中介账号);






--员工亲属低收入但交易金额高

select distinct person_id
from
(
	select person_id
	,relation_cert_no
	,avg(amount_cr) as avg_amount_cr
	from
	(
		select t1.person_id
		,t1.relation_cert_no
		,substr(trx_time,1,7)
		,sum(amount_cr) as amount_cr--收入金额
		from 
			ccdi_staff_fmy_relation t1
			inner join
			ccdi_bank_statement t2
			on t1.relation_cert_no = t2.cret_no
			where t1.status = 1
			and t2.project_id = PROJECT_ID
			and t2.le_account_name <> t2.customer_account_name --排除同名交易
		group by t1.person_id,t1.relation_cert_no,substr(trx_time,1,7)
	)
	group by person_id,relation_cert_no
	having avg(amount_cr)<=3000 ---月均收入不超过3000
) t1
left join
(
	select t1.relation_cert_no
	,sum(amount_cr + amount_dr) as trans_amount
	from 
		ccdi_staff_fmy_relation t1
		inner join
		ccdi_bank_statement t2
		on t1.relation_cert_no = t2.cret_no
		where t1.status = 1
		and t2.project_id = PROJECT_ID
	group by t1.relation_cert_no
	having sum(amount_cr + amount_dr) >= 100000
	or max(amount_cr) >= 100000
	or max(amount_dr) >= 100000
) t2
on t1.relation_cert_no = t2.relation_cert_no
where t2.relation_cert_no is not null
;
",,,,,
3,疑似赌博,"通过多人多次在相近时间有转账、微信转账、支付宝转账发生，且额度在可疑区间。金额区间可在排查设置页面进行设置
大额购买彩票行为
疑似赌球行为
疑似网络赌博行为","1.多人只2人及以上，多次指2次以上，相近时间指同一天。
2.备注或交易摘要、对手有“游戏、抖币、体彩、福彩”等字眼","--员工 疑似赌博
select distinct id_card
from
(
select t1.id_card,trx_time
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and ((amount_dr>= $$$ and amount_dr<=$$$) or (amount_cr>= $$$ and amount_cr<=$$$))  -----转入转出金额区间
and (customer_account_name rlike '转账' or user_memo rlike '转帐|转账|红包|网转|转入' or cash_type rlike '转帐|转账|红包|网转|转入') 
and user_memo not like '%款%'
and t2.le_account_name <> t2.customer_account_name --排除同名交易
group by t1.id_card,trx_time
having count(distinct customer_account_name)>=2 
and count(1)>=2
);


--员工 网络赌博、体彩
select t1.id_card
,amount_dr
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and amount_dr> 0
and (user_memo rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注'
or customer_account_name rlike '游戏|抖币|体彩|福彩|彩票|赌|球|外围|博彩|六合|时时彩|赛车|赌场|筹码|盘口|返水|洗码|庄家|闲家|百家乐|斗牛|炸金花|牌九|麻将|捕鱼|电子游艺|投注')
;
",,,,,
4,可疑关系,除与配偶、子女外发生特殊金额交易，如1314、520。可在排查参数输入页面进行设置,除与配偶、子女外，发生特殊金额交易，如 1314元、520元 等具有特殊含义的金额。,"--员工 可疑关系
select distinct t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
left join 
ccdi_staff_fmy_relation t3
on t1.id_card = t3.person_id
and t2.customer_account_name = t3.relation_name
where t2.project_id = PROJECT_ID
and t3.relation_type not in (配偶，子女) --关系类型按实际数据的码值确定
and (amount_dr in (520,1314) or amount_cr in (520,1314))
;",,,,,
5,可疑兼职,除本行工资收入外，有固定收入,"1.除本行工资收入外，每月有固定收入，固定收入金额自行设置。
2.每季或每年从固定交易对手转入金额，金额可设区间值，如5000-10000。
3.转入资金摘要有“工资”、“分红”、“红利”、“利息（非银行结息）”等收入","--员工 可疑兼职
select t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and bank <> 'ZJRCU'
and (customer_account_name rlike '代发|工资' 
or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees' 
or cash_type rlike '代发|工资|劳务费'  
)
group by t1.id_card
having sum(amount_cr)>0
;

--员工 可疑固定收入
select distinct id_card
from
(
	select id_card
	,customer_account_name
	,count(1) as income_qrt
	,stddev(amount_total) as stddev_amount
	from
	(
		select 
		id_card
		,customer_account_name
		,trans_qrt
		,count(1) as trans_cnt
		,sum(amount_cr) as amount_total
		from
		(
			select t1.id_card
			,customer_account_name
			,amount_cr
			,concat(year(trx_time),'-Q',quarter(trx_time)) as trans_qrt  --每季度的固定收入
			from
			ccdi_base_staff t1
			inner join
			ccdi_bank_statement t2
			on t1.id_card = t2.cret_no
			where project_id = PROJECT_ID
			and amount_cr>0   --每笔收入金额
			and t2.le_account_name <> t2.customer_account_name --排除同名交易
		)
		group by id_card,customer_account_name,trans_qrt
		having count(1) > 3 --每季度大于3笔
		and sum(amount_cr) between 3000 and 10000    ---该季度总收入，区间自行设置
	)
	group by id_card,customer_account_name
	having count(1) >= 2   --2个及以上季度
	and stddev(amount_total)<2000  --标准差小于2000，标识稳定收入
);",,,,,
6,可疑财产,"通过分析车险、房屋险、水电费、燃气费、物业费、车位费、租金、卫生费等缴纳判断车产、房产信息
有转出到售房公司交易，但本人及亲属名下无新增房产
新增住房信息（或有入住新房），但无购房交易、无定金、房款、装修款、设计费记录等
购房资金溯源，是否存在异常收入或向客户借入行为
与家庭收入不匹配的豪华房产","1.购房资金溯源，购房前账户资金来源构成。
2.员工及关系人有购房交易，但名下房产无新增登记。
3.员工及关系人有物业缴费记录，但名下房产无新增登记。
4.员工及关系人有5000元以上的纳税记录，但名下无房产车产新增登记。
5.有新增登记购房，但无相关购房交易记录。
6.入信新房但近期无购房、装修等支出。
7.与家庭年收入不匹配的豪华房产，其评估价值超过家庭年收入的 10倍。","--员工及其亲属购买房产但无资产登记
select t1.id_card
from
(
	select id_card
	,min(trx_time) as trx_time
	from
	(
		select t1.id_card
		,trx_time
		from
		ccdi_base_staff t1
		inner join
		ccdi_bank_statement t2
		on t1.id_card = t2.cret_no
		where project_id = PROJECT_ID
		and (user_memo rlike '(购|买).*房|房款|首付'
		or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
		and amount_dr > 0
		union all
		select t1.person_id
		,trx_time
		from 
		ccdi_staff_fmy_relation t1
		inner join
		ccdi_bank_statement t2
		on t1.relation_cert_no = t2.cret_no
		where t1.status = 1
		and t2.project_id = PROJECT_ID
		and (user_memo rlike '(购|买).*房|房款|首付'
		or customer_account_name rlike '房地产|置业|置地|地产|房产|不动产|链家|贝壳|我爱我家|房管局')
		and amount_dr > 0
	)
	group by id_card
) t1
left join
(
	select person_id
	,max(updated_at) as updated_at
	from ccdi_asset_info
	where asset_main_type = 不动产    --根据具体数据确定码值
	and asset_sub_type in (住宅,商铺) --根据具体数据确定码值
	and asset_status = 正常 --根据具体数据确定码值
	group by person_id
) t2
on t1.id_card = t2.person_id
where t1.trx_time > t2.updated_at --购买时间大于最近一次资产更新时间
or t2.person_id is null;

--有物业缴费记录但无房产登记
select t1.id_card
FROM
(
	select id_card
	from
	(
		select t1.id_card
		,trx_time
		from
		ccdi_base_staff t1
		inner join
		ccdi_bank_statement t2
		on t1.id_card = t2.cret_no
		where project_id = PROJECT_ID
		and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务'
		or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区')
		and amount_dr > 0
		union all
		select t1.person_id
		,trx_time
		from 
		ccdi_staff_fmy_relation t1
		inner join
		ccdi_bank_statement t2
		on t1.relation_cert_no = t2.cret_no
		where t1.status = 1
		and t2.project_id = PROJECT_ID
		and (user_memo rlike '物业|物业费|管理费|物业服务|综合服务'
		or customer_account_name rlike '物业|小区|花园|苑|中心|大厦|业委会|业主委员会|置业|房地产|服务中心|管理处|社区')
		and amount_dr > 0
	)
	group by id_card
) t1
left join
(
	select person_id
	,max(updated_at) as updated_at
	from ccdi_asset_info
	where asset_main_type = 不动产
	and asset_sub_type in (住宅,商铺)
	and asset_status = 正常
	group by person_id
) t2
on t1.id_card = t2.person_id
where t2.person_id is null;

----有5000元以上的纳税记录但无房产登记
select t1.id_card
FROM
(
	select id_card
	from
	(
		select t1.id_card
		,trx_time
		from
		ccdi_base_staff t1
		inner join
		ccdi_bank_statement t2
		on t1.id_card = t2.cret_no
		where project_id = PROJECT_ID
		and (user_memo rlike '税务|缴税|税款'
		or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
		and amount_dr >= 5000
		union all
		select t1.person_id
		,trx_time
		from 
		ccdi_staff_fmy_relation t1
		inner join
		ccdi_bank_statement t2
		on t1.relation_cert_no = t2.cret_no
		where t1.status = 1
		and t2.project_id = PROJECT_ID
		and (user_memo rlike '税务|缴税|税款'
		or customer_account_name rlike '税务|税务局|国库|国家金库|财政')
		and amount_dr >= 5000
	)
	group by id_card
) t1
left join
(
	select person_id
	,max(updated_at) as updated_at
	from ccdi_asset_info
	where asset_main_type = 不动产
	and asset_sub_type in (住宅,商铺)
	and asset_status = 正常
	group by person_id
) t2
on t1.id_card = t2.person_id
where t2.person_id is null;
",,,,,
7,可疑外汇交易,异常购汇、结汇、跨境结汇,单笔购汇、结汇或跨境结汇金额超过限额。,"--员工 可疑外汇交易
select t1.id_card
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and customer_account_name rlike '银行|外汇|售汇|结汇|国家外汇管理局|外汇'
user_memo rlike '购汇|结汇|换汇|外汇|汇率|外币|现汇|结汇水单|外币兑换人民币|结汇入账|外汇结汇|外汇买入|购外币|购买外汇|外币'
group by t1.id_card
having sum(amount_cr)>100000
or sum(amount_dr)>100000  --限额自行设置
;",,,,,
8,可疑付息,客户经理管户的客户在智柜、柜面连续代交利息人数比较多,客户经理管户的客户在智柜、柜面连续 代交利息，且代交人数超过 2人。,"---管户经理与贷款客户有交易往来
with cust_loan_duty as (
	select t1.id_card
	,t2.customer_isn
	from
	ccdi_base_staff t1
	left join
	(
	select customer_isn,creditor_code
	from xdzx.loan_liability
	where status = '1'
	and product_code <> '15AC'
	group by customer_isn,creditor_code
	UNION
	select t2.nfaacsno,t1.primary_principal
	from xdzx.loan_duty t1
	left join odsdb.blfmconf t2
	on t1.contract_no = t2.nfaacono
	where t1.status='1'
	and t1.product_code ='15AC'
	group by t2.nfaacsno,t1.primary_principal
	) t2
	on t1.staff_id = t2.creditor_code
)
select cret_no
FROM
(
	select t1.cret_no,t2.customer_isn
	from ccdi_bank_statement t1
	inner join cust_loan_duty t2
	on t1.cret_no = t2.id_card
	left join 
	(
		select CINOCSNO
			,DFANAC19
			,CDNOAC19
		from odsdb.BWFMDCIM
		where rcstrs1b <> '9'
		and del_f = '0'
		and OWONBRNO like '902%'
		group by CINOCSNO,DFANAC19,CDNOAC19
	) t3
	on t2.customer_isn = t3.CINOCSNO
	where project_id = PROJECT_ID
	and (t1.customer_account_no = t3.DFANAC19--账号
	or t1.customer_account_no = t3.CDNOAC19)--卡号
	group by t1.cret_no,t2.customer_isn
	having t1.amount_cr +t1.amount_dr > 0
)
group by cret_no
having count(customer_isn) > 2 --交易贷款客户超过两人
;",,,,,
9,可疑采购,"1.提示可能化整为零的采购
2.提示向同一企业或同一人实控的企业采购集中度过高的情况",单笔采购金额超过 10万元；提示向同一企业或同一人实控的企业采购集中度过高，单个供应商采购额占总采购额比例超过 70%。,"--单笔采购金额大于10万
select t1.id_card
from ccdi_base_staff t1
inner join
(
select applicant_id
from ccdi_purchase_transaction
where actual_amount>100000
UNION
select purchase_leader_id
from ccdi_purchase_transaction
where actual_amount>100000
) t2
on t1.staff_id = t2.applicant_id
;

----单个供应商采购金额占项目总采购额超百分之70
with project_total as (
	select purchase_id
	,sum(actual_amount) as total_amount
	from ccdi_purchase_transaction
	group by purchase_id
),
supplier_project AS (
	select t1.applicant_id,t1.purchase_leader_id
	from
	(
		select applicant_id
			,purchase_leader_id
			,purchase_id
			,supplier_uscc
			,sum(actual_amount) as supply_amount
		from ccdi_purchase_transaction
		group by applicant_id,purchase_leader_id,purchase_id,supplier_uscc
	) t1
	left join project_total t2
	ON t1.purchase_id = t2.purchase_id
	where t1.supply_amount / t2.total_amount > 0.7
)
select t2.id_card
(
select applicant_id
from supplier_project
union 
select purchase_leader_id
from supplier_project
) t1
inner join
ccdi_base_staff t2
on t1.applicant_id = t2.staff_id;",,,,,
10,异常行为,"1.每天长时间电话、频繁电话、微信电话
2.丰收互联交易IP地址与属地IP地址段不匹配
3.家庭老人、非家庭关系人银证大额转账
4.微信支付宝频繁提现
5.工资发放后立即转出大部分资金的行为
6.工资发放后除代扣项目外，几乎不使用的情况
7.涉诉情况
8.大额炒股
9.操控他人账户交易
","1.每天电话、微信通话时长超过 2小时 或同一对像通话次数超过5次。
2.丰收互联交易IP地址与属地IP地址段不匹配。
3.家庭老人、非家庭关系人银证大额转账，单笔超过设置限额。
4.微信、支付宝单日提现次数超过设置次 或单日累计提现金额超过 设置限额。
5.工资发放后 24小时内 转出超过 80% 的资金。
6.工资发放后除代扣项目外，连续30天 无任何消费或转账记录。
7.大额炒股，单次三方资管交易金额超过 100万元。
8.多次代理他人账户交易，或登录员工手机操作他人丰收互联交易。
","--支付宝微信单日提现金额和笔数
select t1.id_card
	,t2.trx_time
	,count(1) as trans_cnt
	,sum(amount_cr) as trans_amt
from
ccdi_base_staff t1
inner join
ccdi_bank_statement t2
on t1.id_card = t2.cret_no
where project_id = PROJECT_ID
and (user_memo rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现'
or customer_account_name rlike '财付通|微信零钱|微信|wechat|WeChat|Tenpay|支付宝|Alipay|提现')
and amount_cr >= 0
group by t1.id_card,t2.trx_time;

--员工 发工资后1天内转出80%以上
select t1.id_card
from
(
	select t1.id_card
	,t2.trx_time as sala_time
	,t2.amount_cr
	from
	ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and bank = 'ZJRCU'
	and (customer_account_name rlike '代发|工资' 
	or user_memo rlike '代发|工资|分红|红利|奖金|薪酬|薪金|补贴|薪|年终奖|年金|加班费|劳务费|劳务外包|提成|劳务派遣|绩效|酬劳|批量代付|PAYROLL|SALA|CPF|directors.*fees' 
	or cash_type rlike '代发|工资|劳务费'  
	and amount_cr > 0
	)
) t1
left join
(
	select t1.id_card
	,t2.trx_time
	,t2.amount_dr
	from
	ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and bank = 'ZJRCU' 
	and amount_dr > 0
) t2
on t1.id_card = t2.id_card
where t2.trx_time between t1.sala_time and date_add(t1.sala_time,interval 1 day)
group by t1.id_card
having sum(t2.amount_dr) / sum(t1.amount_cr) >0.8
;

--炒股、单次三方资管交易金额超100万
select distinct id_card
FROM
(
select t1.id_card
	,t2.amount_cr
	from
	ccdi_base_staff t1
	inner join
	ccdi_bank_statement t2
	on t1.id_card = t2.cret_no
	where project_id = PROJECT_ID
	and (customer_account_name rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财' 
	or user_memo rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财' 
	or cash_type rlike '证券|国泰君安|中信建投|中金|基金|期货|信托|同花顺|理财'  
	)
	and amount_dr > 1000000
);",,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,
,,,,,,,,,