behavioral-risk-screening-concepts
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseBehavioral risk screening (concepts)
行为风险筛查（概念）
Educational reference only. Heuristic alerts are not proof of crime. Investigate with crypto-investigation-compliance, address-clustering-attribution, and on-chain evidence. For label-based exposure (sanctions, scam tags), see risk-exposure-screening-concepts. Product specifics live in your vendor docs (phalcon-compliance-documentation where applicable).
仅作为教育参考。 启发式警报并非犯罪证据。需结合crypto-investigation-compliance、address-clustering-attribution及链上证据开展调查。如需了解基于标签的风险暴露（制裁、诈骗标签），请参阅risk-exposure-screening-concepts。产品细节请查阅供应商文档（适用情况下请参考phalcon-compliance-documentation）。
Behavioral Risk Engine (idea)
行为风险引擎（理念）
A behavioral risk engine flags suspicious transaction patterns using statistics and rules (thresholds, windows, frequencies) rather than—or in addition to—static address labels. Baselines may be global, peer-group, or customer-specific. False positives are common; triage before escalation.
行为风险引擎通过统计数据和规则（阈值、时间窗口、频率）标记可疑交易模式，可替代或补充静态地址标签。基线可分为全局基线、同组基线或客户特定基线。误报情况较为常见，需先分类筛选再升级处理。
Address-level behavior (common templates)
地址层面行为（常见模板）
Many compliance stacks offer address-centric rules similar to the following:
| Template | What it approximates | Notes |
|---|---|---|
| Large-value transfers | Outbound or aggregate volume far above a typical-user or rolling baseline | Often uses USD notional at observation time; threshold is configurable. |
| High-frequency transfers | Many transfers in a short window, sometimes many just below a reporting or alert threshold (“structuring-like” pattern in traditional AML language) | Requires count and time bounds; may filter by asset. |
| Transit / pass-through | Address receives then sends most funds quickly, acting as an intermediary | Used as a layering-style signal; legitimate payment processors can resemble this—context matters. |
Illustrative scenarios (hypothetical):
- A wallet sends a single outbound transfer whose notional is far above the configured large-value threshold.
- An address sends fifteen transfers of just under a chosen threshold within 24 hours.
- An address receives a large amount and forwards nearly all of it within minutes to other addresses.
Use valid chain identifiers in real work; examples here stay generic to avoid implying real flagged wallets.
许多合规系统提供以下类似的以地址为中心的规则：
| 模板 | 对应行为类型 | 说明 |
|---|---|---|
| 大额转账 | 转出或总交易量远高于普通用户或滚动基线 | 通常采用观测时的美元名义价值；阈值可配置。 |
| 高频转账 | 短时间内发生多笔转账，有时多笔金额略低于报告或警报阈值（传统AML术语中的“类拆分交易”模式） | 需要设置数量和时间限制；可按资产类型过滤。 |
| 中转/过账 | 地址快速接收并转出大部分资金，充当中介角色 | 用作分层洗钱类信号；合法支付处理商的行为可能与此类似——需结合上下文判断。 |
示例场景（假设）：
- 某钱包发起单笔转出交易，其名义价值远高于配置的大额阈值。
- 某地址在24小时内发起15笔金额略低于选定阈值的转账。
- 某地址接收大额资金后，在数分钟内将几乎全部资金转发至其他地址。
实际工作中请使用有效的链标识符；此处示例保持通用化，避免暗示真实被标记钱包。
Transaction-level behavior (common templates)
交易层面行为（常见模板）
At single-transaction granularity, platforms often add:
| Template | What it approximates | Notes |
|---|---|---|
| Large-value transfer | Transfer amount exceeds a user-defined notional cap | May apply per asset, per corridor, or per counterparty class. |
| Rapid transit | Funds leave shortly after arrival along a monitored path (same tx chain or multi-hop within a time window) | “Rapid” is policy-defined (for example within N minutes). Overlaps with transit heuristics at graph level. |
Illustrative scenario: a transfer exceeds a $100k policy threshold, or value moves A → B within five minutes while policy treats ten minutes as the rapid-transit window.
在单笔交易粒度下，平台通常会添加以下规则：
| 模板 | 对应行为类型 | 说明 |
|---|---|---|
| 大额转账 | 转账金额超过用户定义的名义上限 | 可按资产类型、交易通道或交易对手类别应用。 |
| 快速中转 | 资金在监控路径内抵达后不久即转出（同一交易链或时间窗口内的多跳转账） | “快速”由政策定义（例如N分钟内）。与图谱层面的中转启发法存在重叠。 |
示例场景： 转账金额超过10万美元的政策阈值，或资金在5分钟内从A转移至B，而政策将10分钟视为快速中转窗口。
Relationship to exposure screening
与风险暴露筛查的关系
| Engine style | Focus |
|---|---|
| Exposure (see risk-exposure-screening-concepts) | Who the funds touched—labels, hops, taint-style exposure. |
| Behavioral (this skill) | How the address or tx behaves—size, speed, frequency, pass-through timing. |
Both may fire together; analysts should reconcile narratives and avoid double-counting the same fact pattern.
| 引擎类型 | 关注点 |
|---|---|
| 风险暴露筛查（参阅risk-exposure-screening-concepts） | 资金接触过哪些对象——标签、跳数、污染式风险暴露。 |
| 行为筛查（本技能） | 地址或交易表现如何——金额大小、速度、频率、过账时机。 |
两类引擎可能同时触发警报；分析师应整合信息，避免重复统计同一事实模式。
Guardrails
约束规则
- Do not assist with structuring advice to evade reporting thresholds or gaming monitoring rules.
- Do not treat alerts as adverse media or legal findings without case-level review.
- Legitimate businesses (payroll, market makers, bridges) can trigger behavioral rules—use corroboration and off-chain context when available.
Goal: shared vocabulary for behavioral AML-style pattern concepts aligned with common commercial monitoring templates, without binding any specific product configuration.
- 不得协助提供拆分交易建议以规避报告阈值或操纵监控规则。
- 不得未经个案审查即将警报视为负面舆情或法律结论。
- 合法企业（薪资发放、做市商、跨链桥）可能触发行为规则——如有可用信息，请结合佐证材料和链下上下文判断。
目标： 建立与常见商业监控模板一致的AML类行为模式概念共享词汇，不绑定任何特定产品配置。