credit-due-diligence

Corporate Credit Due Diligence

When the user requests due diligence analysis of a corporate client, execute systematically according to the following steps.

Target Role

• Role: Corporate Account Manager, Credit Approval Officer
• Use Scenarios: Pre-loan investigation stage for a new customer's first loan, an existing customer's loan renewal, or additional credit granting
• Output Purpose: Systematically assess corporate credit risk and provide a basis for credit approval decisions
• Decision Level: Core decision-support document that directly affects credit approval outcomes
• Execution Frequency: Executed once before each credit application

Data Sources

Required Data

Data Item	Source	Acquisition Method	Sensitivity Level
Basic corporate business registration information	ECIF system/business registration data API	API: /api/enterprise/basic	Public
Financial statements for the past three years	User upload/credit system	File upload or imaging system API	Internal
Corporate credit report	PBOC credit reporting system	API access after manual authorization	Confidential
Legal representative's credit report	PBOC credit reporting system	API access after manual authorization	Confidential
Upstream and downstream contracts	Image archive system	API: /api/documents/list	Internal
Utility bills/tax payment vouchers	User upload/imaging system	File upload	Internal
Bank statements	Core system/user upload	API or file upload	Confidential
Industry research reports	Internal knowledge base/external data sources	API or references/	Public

Data Masking Rules

• Personal ID number: show the first 3 and last 4 digits, replacing the middle with *
• Bank account number: show only the last 4 digits
• Legal representative's personal credit report: show only summary information, not details
• Customer trade secret information (such as key customer lists): use "a certain customer" instead in external reports

Fallback Strategy

• If credit reporting data is unavailable: mark "credit reporting dimension not included"; continue the remaining analysis, but explain this in the risk warnings
• If only 1 year of financial statements is available: mark "insufficient data, trend analysis unavailable" and perform only static analysis
• If contracts/invoices/bank statements are missing: mark "operational authenticity verification incomplete", but prominently warn of the risk in the report
• If industry data is unavailable: use the industry benchmark data in references/ and clearly indicate the data source

Workflow

Regulatory basis: "Guidelines for Due Diligence in Credit Business of Commercial Banks", "Guidelines for Loan Risk Classification" (five-category classification), Article 35 of the "Law of the People's Republic of China on Commercial Banks" on loan review requirements, the People's Bank of China's "Regulations on the Administration of the Credit Reporting Industry", and the China Banking Regulatory Commission's "Interim Measures for the Administration of Working Capital Loans"

Execution mode: Step-Gated Workflow

Step 0: Data Confirmation and Verification

Before starting any analysis, the following data confirmation steps must be performed:

1. Read and list all input data files (financial statements, contracts, invoices, transaction records, credit reports, etc.)
2. Confirm the time range of the data (most recent three years) and the accounting standards (CAS/IFRS)
3. Run scripts/validate_due_diligence.py to verify data completeness
4. Begin analysis only after verification passes

Gating conditions：

• ✅ Verification passed → Proceed to Step 1
• ❌ Verification failed → Stop the analysis, report the specific missing items to the user, and request supplementary data
• ⚠️ Partially missing data → Mark the missing items, continue execution, but prominently indicate them in the final report

📋 Data source:user_upload(user-uploaded files) + system_api(ECIF system)

Step 1: File and Document Inventory Enumeration

Query the enterprise's basic business registration information file, list all available documents in the imaging system and file storage, and establish an analysis material inventory.

Gating conditions：

• ✅ Complete document inventory (≥5 categories of documents) → Proceed to Step 2
• ⚠️ Incomplete document inventory (3-4 categories of documents) → Mark the missing document types, proceed to Step 2, but the final report must indicate "due diligence materials incomplete"
• ❌ Severely insufficient document inventory (<3 categories of documents) → Issue a list of missing materials, suspend the analysis, and wait for supplements

📋 Data source:system_api(ECIF system + imaging archive system)

Step 2: Analysis of the Enterprise's Basic Information

Query the enterprise's business registration information, focusing on:

• Registered capital and paid-in ratio (a paid-in ratio < 20% must be marked)
• Years since establishment (< 2 years is a high-risk signal)
• Whether the business scope matches the actual business
• History of changes to the legal representative (any change in the past 2 years must have its reason explained)
• Company scale (number of employees, number of social insurance contributors), historical development
• Key provisions of the company's articles of association (major decision-making mechanisms, shareholder rights agreements)

Gating conditions：

• ✅ Complete business registration data → Proceed to Step 3
• ⚠️ Some fields missing → Mark the missing items and proceed to Step 3
• ❌ Unable to obtain business registration data → Mark "business registration data unavailable, downgraded to using public information" and proceed to Step 3

📋 Data source:system_api(ECIF system/business registration data API)

Step 3: Evaluation of Corporate Governance and Management Team

Evaluate the stability of the enterprise's management and its governance structure:

• Composition of the senior management team: the legal representative, general manager, and person in charge of finance—their years in office, educational background, and industry experience
• Changes in senior management in the past 2 years (frequent changes are a risk signal)
• The actual controller's personal credit status: whether there are personal liabilities, litigation, or records of dishonesty
• Equity concentration assessment: both highly concentrated (single controlling shareholder > 80%) and highly dispersed (no actual controller) must have risks explained

This step must not be skipped; even if the senior management information appears normal, a complete assessment must still be performed and a conclusion output.

Step 4: Review of Affiliated Relationships and Group Structure

Review the network of affiliated enterprises and identify the chain of affiliated risk transmission:

• List the affiliated enterprises under the same actual controller (including shareholding percentage, main business, and date of establishment)
• Analyze whether there are mutual guarantees/joint guarantees among affiliated enterprises
• Check whether there is misappropriation of funds to related parties (abnormal other receivables)
• Debt isolation between parent and subsidiary companies under the group structure

Affiliated Risk Assessment Criteria(See references/risk-rating-policy.md for the complete criteria):

• Other receivables/net assets > 20%: suspected related-party fund occupation
• Affiliated guarantee chain ≥ 3 entities: risk of contagion exists
• Affiliated enterprises have overdue/dishonesty records: must be prominently marked in the report

All affiliated enterprises must be listed, with none omitted. Affiliated enterprises with overdue/dishonesty records must be prominently marked.

Step 5: Industry and Market Environment Analysis

Assess the credit suitability of the industry in which the enterprise operates:

• Position in the industry life cycle (startup/growth/mature/decline)
• Whether it belongs to a restricted or eliminated industry (see references/industry-analysis-guide.md against the NDRC's Catalogue for Guiding Industry Restructuring)
• Industry competitive landscape and the enterprise's competitive position
• Concentration of major downstream customers (top 5 customers accounting for > 60% is a high concentration risk)
• Impact of industry seasonality on funding needs

See references/industry-analysis-guide.md to obtain the industry credit suitability assessment framework and financial benchmark data.

The enterprise's industry classification must be refined to the division or group level in GB/T 4754-2017; broad classifications such as "manufacturing" must not be used alone.

Step 6: Verification of Production, Operations, and Business Authenticity

⚠️ This chapter is the core anti-fraud chapter; business authenticity must be determined through multi-dimensional cross-verification and must not be skipped.

Contract Review：

• Extract upstream and downstream contract information (contract parties, amounts, performance period, payment method)
• Verify the match between contract amounts and reported revenue (deviations > 30% must be marked)
• Check whether contract counterparties are related parties (risk of inflated revenue through related-party transactions)

Review of Utility Invoices and Tax Payment Certificates：

• Extract details of water and electricity invoices (compare average monthly electricity consumption with reported production capacity/area)
• Extract tax payment certificates (verify the tax burden ratio between actual tax paid and reported revenue)
• Industry tax burden ratio reference (see references/industry-analysis-guide.md): the VAT tax burden ratio for manufacturing is generally 1%-3%; if clearly lower, verification is required

Comprehensive Verification of Production and Operations：

• Cross-check contract amounts × approximate unit price against operating revenue
• Cross-check electricity/water usage against reported production capacity
• Compare the tax burden ratio with the industry average to identify anomalies
• Verify operating activity based on the pattern of funds inflow and outflow in bank statements

Gating Conditions：

• ✅ Cross-verification passed (deviation < 30%) → proceed to Step 7
• ⚠️ Some verification anomalies (deviation 30%-50%) → mark the anomalous items, proceed to Step 7, but the final report must highlight them
• ❌ Major anomaly (deviation > 50% or core data missing) → triggers red line D4, marked "Major anomaly found in verification of authenticity of production and operations", recommend suspending credit

📋 Data source:user_upload(contracts, invoices, bank statements uploaded by the user)

Step 7: Financial condition analysis

Obtain and review the financial materials for the past three years, and carry out quantitative analysis:

Asset structure analysis：

• Ratio of current assets/non-current assets and industry suitability
• Accounts receivable aging structure (over 30% aged > 1 year is abnormal)
• Inventory composition and risk of price decline

Liability structure analysis：

• Interest-bearing debt ratio (> 60% is high risk)
• Ratio of short-term to long-term debt and time distribution of debt repayment pressure
• Whether hidden liabilities exist (notes, guarantees)

Cash flow analysis：

• Whether operating cash flow remains consistently positive
• Net cash ratio (operating cash flow/net profit, < 0.5 for 2 consecutive years is a warning signal)
• Free cash flow = operating cash flow - capital expenditure

Profitability analysis：

• Trend of gross profit margin and net profit margin over the past three years
• Comparison with industry average (refer to references/industry-analysis-guide.md, data source or confidence interval must be noted)

Solvency analysis：

• Current ratio (> 1.5 is safe), quick ratio (> 1.0 is safe)
• DSCR (Debt Service Coverage Ratio) = operating cash flow / annual principal and interest repayment (≥ 1.2 is up to standard)
• Interest coverage ratio (> 3 is safe)

Run scripts/validate_due_diligence.py verify the cross-relationships in the financial statements and automatically calculate core indicators.

All figures must show the calculation process, and conclusions must not be given directly. If any indicator does not match expectations, you must stop and analyze the cause, and must not ignore it and continue.

📋 Data source:user_upload(financial statements uploaded by the user)

Step 8: Verification of the entity's creditworthiness and financing status

Enterprise credit check：

• Total outstanding loan balance and details by bank
• Overdue records (any overdue within the past 2 years must be marked with type and amount)
• Guarantee situation (credit status of guaranteed entities)
• Whether there are signals of multiple borrowings (3 or more new loans in the past 6 months is a warning)

Personal credit of the legal representative：

• Personal loans and credit card balances
• Personal overdue records
• Related liabilities of enterprises under their name

Creditworthiness of major shareholders：

• Credit status of shareholders holding > 20%
• Verify capital transactions between shareholders and the enterprise through bank statement details

Gating conditions：

• ✅ Credit data complete → proceed to Step 9
• ⚠️ Some credit data missing → mark the missing items, proceed to Step 9
• ❌ Credit data unavailable → mark "credit dimension not included", proceed to Step 9 but must explain in the risk warning

📋 Data source:system_api(PBOC credit reporting system) 📋 Confirmation mechanism:confirm(requires the account manager to confirm that customer credit authorization has been obtained)

Step 9: Risk assessment and credit recommendation generation

Comprehensive risk assessment：

• Summarize the risk points identified in the previous eight chapters, and grade them as "high/medium/low"
• Impact of the industry cycle position on repayment capacity
• Customer concentration risk (cash flow impact under the scenario of losing the top 5 customers)
• Personal risks of the actual controller (moral hazard, management capability)
• Risk transmission paths of affiliated enterprises

Analysis of the primary repayment source：

• Identify the primary repayment source (main business income/asset disposal/refinancing)
• Quantitative measurement: annual operating cash flow vs annual principal and interest repayment requirements
• Cash flow stress scenario: whether DSCR is still ≥ 1.0 when revenue drops by 20%

Operating performance forecast (next three years)：

• Forecast revenue/profit based on historical growth rate and industry trends
• Clarify forecast assumptions (GDP growth rate/industry prosperity/customer renewal status)
• Provide repayment capacity judgments under three scenarios: optimistic/neutral/pessimistic

Recommended risk mitigation measures：

• Recommended guarantee methods (mortgage/pledge/surety, including reference collateral valuation)
• Recommended loan structure (working capital loan/fixed asset loan/installments, matched to the use of funds)
• Recommended monitoring measures (repayment account, monitoring of use of funds, regular statements)

Comprehensive credit recommendation：

• Recommended credit line (with calculation logic: based on X times annual net operating cash flow as a reference)
• Recommended term and interest rate range
• Additional conditions (e.g., collateral must be provided for the first loan; the latest financial statements must be provided for additional credit)
• Expected business contribution and customer value after loan disbursement

Refer to references/risk-rating-policy.md to obtain the risk level classification standards.

Gating conditions：

• ✅ Risk rating completed → output a complete due diligence report
• ⚠️ Some red lines triggered (D5-D7) → output the report but mark it as "conditionally recommended"
• ❌ Core red lines triggered (D1-D4) → issue a rejection opinion, explain the reasons, and recommend suspending credit

📋 Executing entity:ai→human(AI-generated preliminary assessment → confirmation by the credit approval officer) 📋 Confirmation mechanism:approve(requires the role permission of the credit approval officer)

Compliance Constraints

1. Prohibition of return promises: Under no circumstances may any promissory wording such as "expected to obtain X ten thousand in deposits" or "guaranteed success" be given.
2. Prohibition of data guessing: Missing data = ask the user for it or mark it in the report as "data missing/to be verified"; it is strictly prohibited to replace actual data with industry averages.
3. Substance over form: For financial data provided by the enterprise, it must be cross-verified through bank statements, invoices, contracts, etc., and conclusions must not be drawn solely based on the figures in the statements.
4. Multi-source cross-verification: Core conclusions must be supported by two or more independent information sources; single-source data must be marked as "to be verified".
5. Quantification first: All risk judgments must be accompanied by quantitative indicators (e.g., "accounts receivable turnover days 72 days, exceeding the industry average of 45 days"); purely qualitative statements are prohibited.
6. Primacy of repayment source: The core logic of the report should revolve around "whether the primary repayment source is sufficient, stable, and sustainable," rather than merely evaluating the strengths and weaknesses of the enterprise.
7. Data timeliness: If the data is more than 6 months old, it must be prominently marked at the beginning of the report as "⚠️ Data may be outdated".
8. Prohibition of ultra vires recommendations: This Skill only provides due diligence analysis and credit recommendations; the final approval decision must be made by the credit approval officer.
9. Customer Information Confidentiality: It is strictly prohibited to disclose sensitive customer information to unauthorized personnel; credit reports may only be used within the authorized scope.
10. Do Not Skip Steps: Do not skip any step, even if the results of intermediate steps "appear normal." All numbers must show the calculation process.
11. Veto Implementation: When the D1-D4 red lines are triggered, a veto opinion must be issued, and credit must not continue to be recommended.

Audit Trail

After each due diligence investigation is completed, generate an audit log audit/{企业简称}_{日期}_audit.json：

{
  "skill_name": "credit-due-diligence",
  "skill_version": "1.0.0",
  "execution_time": "2026-05-05T10:30:00+08:00",
  "input_params": {
    "enterprise_name": "企业名称",
    "due_diligence_purpose": "首贷/续贷/追加授信",
    "analysis_depth": "快速/标准/重点核查"
  },
  "operator": "客户经理姓名（工号：XXX）",
  "steps": [
    {
      "step": "档案与文件清单枚举",
      "executor": "ai",
      "data_source": {"type": "system_api", "system": "ECIF系统 + 影像档案系统"},
      "result": "pass",
      "files_count": 15
    },
    {
      "step": "主体资信与融资状况核查",
      "executor": "ai",
      "data_source": {"type": "system_api", "system": "人行征信系统"},
      "confirmation": "confirm",
      "result": "pass"
    }
  ],
  "red_lines_triggered": ["D1", "D3"],
  "warnings": ["经营真实性验证不完整", "财务报表仅有2年数据"],
  "references_used": ["references/industry-analysis-guide.md", "references/risk-rating-policy.md"]
}

Audit Log Retention Period: At least 5 years.

Veto Conditions (Red Lines)

If any of the following conditions is met, it must be marked in the report summary with ared warning, and it is recommended to suspend credit until verification and reassessment.

No.	Red Line Signal	Basis for Judgment
D1	The enterprise or actual controller has unsettled debt evasion or court enforcement records in the credit system	Credit report + court judgment debtor list
D2	The enterprise belongs to the eliminated category or strictly restricted category in the Catalog for Guiding Industrial Structure Adjustment	Current industrial catalog of the NDRC
D3	Operating cash flow has been negative for 3 consecutive years, and interest-bearing liabilities continue to increase	Cash flow statement + liability details
D4	Major abnormalities are found in the verification of production and operation authenticity (such as a severely low tax burden rate, serious mismatch between transaction flows and contracts)	Cross-validation results of Step 6
D5	Related parties have large overdue amounts unpaid, and there is a mutual guarantee relationship with the applicant enterprise	Credit report + guarantee chain verification
D6	High deposits and high loans (monetary funds balance > 20% of total liabilities, while holding large short-term borrowings)	Balance sheet verification
D7	The actual controller has pledged a high proportion of equity in the past year (> 80%) and has no remedial measures	Business equity pledge registration

Gotchas

#1: Industry Classification Is Too Broad

• Symptom: The industry analysis only says "manufacturing" and lacks specificity
• Cause: The GB/T 4754-2017 classification was not refined to the middle or small class
• Solution: Always query the enterprise's precise industry code and refer to references/industry-analysis-guide.md to obtain subdivided industry characteristics

#2: Incomplete Verification of Operating Authenticity

• Symptom: There are only financial statements, with no contracts/invoices/transaction flows, yet a conclusion of "normal operations" is still given
• Cause: The cross-validation requirements of Step 6 were not strictly implemented
• Solution: Step 6 is a mandatory section. When there are only statements but no invoices/contracts/transaction flows, the report must be marked "authenticity verification incomplete"

#3: Financial Indicator Calculation Errors

• Symptom: Key indicators such as DSCR and net cash ratio are calculated incorrectly or omitted
• Cause: Manual calculation is prone to errors, or the meaning of the formula is not understood
• Solution: Run scripts/validate_financials.py to automatically calculate the six core financial indicators

#4: Related-party risk contagion is overlooked

• Symptoms: Only the applicant enterprise itself is analyzed; risk contagion from related enterprises is not identified
• Causes: The chain of mutual guarantees and fund flows among related parties has not been thoroughly mapped
• Solution: Step 4 must list all related enterprises, analyze mutual guarantee relationships and fund occupation, and related enterprises with overdue/dishonesty records must be prominently flagged

#5: Credit recommendations lack a calculation basis

• Symptoms: The recommended limit is given only based on experience, with no clear calculation logic
• Causes: No quantitative calculation was made according to the primary source of repayment
• Solution: Credit recommendations must be accompanied by calculation logic (e.g., "using X times annual net operating cash flow as a reference"); figures must not be given based only on experience

Examples

Example 1: Due diligence for a new customer's first loan

User input：

请对“XX制造有限公司”进行尽职调查。企业成立于2020年，申请首贷3000万元流贷。

Skill execution process：

1. Enumerate files and documents → Obtain business registration records, 2 years of financial statements, upstream and downstream contracts, and bank statements
2. Business registration analysis → Established 2 years ago (high-risk signal), paid-in capital ratio 80%
3. Corporate governance → Senior management team is stable, actual controller has no adverse records
4. Related-party relationships → 2 related enterprises found, with mutual guarantee relationships
5. Industry analysis → Belongs to C3229 nonferrous metal rolling and processing, industry in maturity stage
6. Business authenticity verification → Contract amounts match revenue, tax burden ratio is normal
7. Financial analysis → DSCR=1.3 meets the standard, but operating cash flow fluctuates significantly
8. Credit check → No overdue records, no multiple borrowings
9. Risk assessment → Red line D7 triggered (actual controller's equity pledge 70%)

Output points：

• Core conclusion: The enterprise's fundamentals are good, but it has a short operating history and a high equity pledge ratio by the actual controller
• Red line warning: D7 triggered (equity pledge 70%)
• Credit recommendation: Conditionally recommend RMB 20 million, requiring the actual controller to provide collateral

Example 2: Due diligence for renewal of an existing customer's loan

User input：

请对“YY科技有限公司”进行续贷尽调。存量授信5000万即将到期，申请续贷。

Skill execution process：

1. Read the previous due diligence report for comparison
2. Financial trend analysis → Revenue increased 15%, but net profit decreased 5%
3. Changes in risk signals → 1 new small overdue item (already settled)
4. Business authenticity verification → Water and electricity usage matches production capacity
5. Credit check → 2 new loans in the past 6 months (multiple borrowing warning)

Output points：

• Core conclusion: The enterprise is operating normally, but attention should be paid to the decline in net profit and multiple borrowing signals
• Red line warning: None
• Credit recommendation: Prudently recommend a loan renewal of RMB 50 million, requiring the latest financial statements and explanation of fund usage

Out of Scope

• This Skill does not handle post-loan management reports (please use the post-loan management Skill)
• This Skill does not directly adjust risk classification (five-tier classification)
• This Skill does not handle disposal of non-performing assets
• This Skill does not handle due diligence for personal credit/retail business
• If the user requests the above, clearly inform them and recommend the appropriate Skill or contact the corresponding department

Output Format

The generated due diligence report must include the following sections, and the output format must be structured so that downstream Skills (submit-credit-application, credit-approval-decision) can reliably parse it:

1. Core Conclusion

• Summarize the overall credit assessment conclusion of the enterprise in 2-3 sentences
• Risk level: [AAA/AA/A/BBB/BB/B/CCC/CC/C]
• Credit recommendation: [Strongly recommend/Recommend/Recommend with caution/Recommend with conditions/Recommend deferral/Prohibit credit]

2. Basic Enterprise Information

Field	Value	Data Source
Enterprise Name		Business registration data
Years Since Establishment		Business registration data
Registered Capital		Business registration data
Paid-in Ratio		Business registration data
Industry Classification		GB/T 4754-2017

3-8. Detailed Analysis Sections

(Expanded according to Workflow steps 2-8; each chapter must include quantitative indicators, data source annotations, and risk signals)

9. Risk Assessment and Credit Recommendation

Main Risk Points：

Risk Type	Risk Level	Specific Description

Red Line Check Results：

Red Line Number	Triggered or Not	Explanation
D1	✅/❌
D2	✅/❌
...	...

Primary Repayment Source Analysis：

• Repayment source: [Main business revenue/Asset disposal/Refinancing]
• Annual operating cash flow: [value]
• Annual principal and interest repayment: [value]
• DSCR: [value]

Comprehensive Credit Recommendation：

• Recommended amount: [value] ten thousand yuan
• Recommended term: [value] months
• Recommended interest rate: [range]
• Calculation basis: [specific logic]
• Additional conditions: [if any]

Disclaimer: (Cite assets/disclaimer-template.md or shared/disclaimer-template.md）

---

Template Reference: See assets/due-diligence-report-template.md

Quality Requirements：

1. Full coverage of eight chapters: The complete report must include all 9 chapters (steps 0-9); if any chapter is missing, the reason for skipping must be explained
2. Business authenticity verification cannot be skipped: Step 6 is a mandatory chapter
3. Full coverage of quantitative financial indicators: The six core financial indicators must be calculated item by item
4. Red line self-check: Before output, the 7 red lines (D1-D7) must be checked item by item
5. Explicit annotation of data sources: Each key conclusion must be annotated with its data source
6. Quantification of repayment sources: Specific values must be provided; qualitative description alone is not allowed
7. Downstream compatibility: Key fields must use table/JSON format to ensure downstream Skills can parse them