One article interpretation: Guide you to understand economic investigation work [If public security organs analyze involved funds through big data] In the financial analysis and appraisal work of public security organs, the selection of data analysis methods should be based on the needs of the case (such as cracking down on illegal fundraising, telecommunications fraud, USDT money laundering, tax related crimes, etc.), With the core goal of "restoring the flow of funds, identifying the parties involved, and revealing criminal patterns", commonly used methods can be divided into three categories: basic data processing methods, correlation analysis methods, and feature mining methods. (Content excerpts have been made for security purposes) 1、 Basic data processing methods: ensuring data is "available and reliable" This type of method is a prerequisite for subsequent analysis, mainly solving the problem of "large volume, disorder, and incompleteness" of fund data, ensuring that the data meets the identification standards (in accordance with the requirements of "data integrity verification, preservation and backup" in the "Regulations on the Work Procedure of Public Security Fund Analysis and Identification (Trial)"). （1） Data cleaning and standardization 1. Core function: Remove invalid data (such as duplicate transaction records, incorrectly formatted account information), complete key fields (such as missing transaction time, counterparty account name), and unify data formats (such as naming the transaction flow fields "transaction amount/amount" and "payer/transferee" of different banks uniformly). 2. Application scenario: fraud cases. （2） Data merging and deduplication 1. Core function: Perform "account merging" on related accounts of the same entity (such as multiple personal accounts controlled by the same suspect, shell company accounts), remove duplicate records of the same transaction (such as bank system transactions), and ensure that the analyzed object is "not duplicated or omitted". 2. Application scenario: Illegal fundraising case. （3） Data timeline reconstruction 1. Core function: Sort scattered fund records by "transaction occurrence time", construct a three-dimensional timeline of "account time amount", and restore the time logic of funds from inflow to outflow. 2. Application scenario: Telecommunications fraud cases. 2、 Association analysis method: mining the association relationship between "people, accounts, and funds" This type of method is the core of fund analysis, aiming to reveal the implicit connection between "involved personnel, involved accounts, and fund flow" through data association, and restore the criminal network. （1） Funds Flow Tracking Method (Link Analysis) 1. Core logic: Starting from the "source funds" (such as the victim's transfer account) or "destination funds" (such as the suspect's withdrawal account), track the flow path of funds layer by layer along the "transfer records" to form a "fund chain diagram". 2. Application scenario: Money laundering cases. （2） Account association analysis (extended from social network analysis) 1. Core logic: Regard "accounts" as nodes and "fund transactions" as connections between nodes, and construct an "account association network". By analyzing the "core nodes" (accounts with frequent transactions and large amounts of funds) and "dense subgroups" (small groups with frequent transfers between accounts) in the network, identify the core accounts and associated personnel involved in the case. 2. Application scenario: Underground bank case. （3） Analysis of counterparty profile 1. Core logic: Extract the characteristics of all trading counterparties of a certain account (such as the location, time, industry attributes, and trading habits of the counterparty's account), and determine whether the counterparty is a "suspicious entity" (such as a large number of counterparties being individual accounts in different regions without reasonable transaction background). 2. Application scenario: False issuance of value-added tax invoices. 3、 Feature mining method: identifying "abnormal transactions" and "criminal patterns" This type of method is based on the "normal fund trading rules", and by comparing and discovering abnormal features, it reveals typical patterns of criminal behavior, which is the key transformation from "data" to "criminal clues". （1） Abnormal transaction identification method 1. Core logic: Set a "normal transaction threshold" (such as personal account daily transfer amount, monthly transaction frequency, and nighttime transaction proportion). Transactions exceeding the threshold are considered "abnormal transactions" and require further verification. （2） Analysis of Concentration and Diversification of Funds 1. Core logic: By calculating the "fund collection rate" (the proportion of funds from multiple accounts concentrated in a few accounts) or the "fund dispersion rate" (the proportion of funds from a few accounts split into multiple accounts), identify the "fund pool" or "profit sharing" behavior in crimes. 2. Application scenarios: (1) Illegal fundraising case; (2) Telecom fraud involves dividing the spoils. （3） Pattern matching method (based on crime case base) 1. Core logic: Based on similar cases that have been solved (such as "pig killing" fraud and underground money laundering), extract typical fund transaction patterns (such as "victim → third-party payment account → multi-level personal account → overseas account"), match the fund data of the case to be identified with the "pattern library", and quickly locate suspicious links. 2. Application scenario: Typical mode of "pig killing plate". 4、 Core principles of method application The data analysis methods used in the analysis and appraisal of public security funds must strictly follow the principles of "legality, scientificity, and correlation": • Legitimacy: All data must come from legitimate sources (such as bank statements and third-party payment data provided by the investigating unit), and the analysis process must comply with the Criminal Procedure Law and appraisal procedures; • Scientificity: The selection of methods should match the type of case (such as money laundering cases focusing on link analysis, illegal fundraising cases focusing on re aggregation rate analysis), to avoid "disconnection between methods and objectives"; Relevance: The analysis results should be related to the facts of the case (such as abnormal transactions in a certain account, which should be combined with the suspect's confession and other evidence chains to avoid drawing conclusions solely based on data). Overview: The combination and application of these methods ultimately achieve the identification goal of "restoring criminal behavior from financial data, identifying involved personnel, and fixing evidence", providing key technical support for combating economic crimes. Registration and Management Measures for Public Security Fund Analysis and Appraisal Institutions (Trial) and Registration and Management Measures for Public Security Fund Analysis and Appraisal Personnel (Trial) On August 14th, Shanghai Economic Investigation Bureau interpreted the legal provisions of these two methods one by one, "Financial Analysis as Evidence for Fund Analysis and Appraisal". However, based on the logic of institutional framework construction and the corresponding requirements of the "Regulations on the Work Procedure of Fund Analysis and Appraisal of Public Security Organs (Trial)", they are mainly designed to standardize the registration and management of fund analysis and appraisal institutions and appraisers. The "Regulations on the Procedures for Fund Analysis and Appraisal of Public Security Organs (Trial)" emphasizes that fund analysis and appraisal work should be carried out by appraisal institutions and appraisers with corresponding qualifications, and qualification certificates should be uniformly issued by the Ministry of Public Security, which is responsible for registration and management at the provincial and ministerial levels. The content of the two "Measures" is to formulate specific implementation rules around the registration, qualification verification, change, cancellation, and corresponding regulatory penalties of the above-mentioned institutions and personnel, in order to ensure the standardized construction of appraisal institutions and the professional cultivation of appraisal personnel, and support the effective operation of the fund analysis appraisal system. Overall, one regulation and two measures jointly promote the transformation of public security organs' fund analysis and appraisal from auxiliary investigation tools to statutory appraisal projects. This not only helps public security economic investigation and other police departments to combat fund intensive and multi-party economic crimes, but also provides more reliable scientific evidence support for the entire law enforcement and judicial practice.