WALLET CLOSURE: x DAYS AFTER TOPUP

SELECT '2022' AS year, monthNo, 'MIN + FULL' as kyc, Z.risk_catg, 'Custom' as Frequency, COUNT(DISTINCT IF(Z.gap <= Z.limit, Z.wallet_id, NULL)) AS breaches, 'WalletClosureAfterTopup' as rule FROM
    (SELECT month(A.updated_at) AS monthNo, D.user_id, A.wallet_id, B.txn_id as txn_id2, ((UNIX_TIMESTAMP(A.updated_at) - UNIX_TIMESTAMP(B.txnTime))/86400) as gap,
    IF(C.hml_category IS NOT NULL, C.hml_category, 'LOW RISK') AS risk_catg,
    CASE WHEN C.hml_category = 'HIGH RISK' THEN 7 WHEN C.hml_category = 'MEDIUM RISK' THEN 5 ELSE 3 END AS limit FROM
        (SELECT DISTINCT wallet_id, updated_at 
        FROM wallet.wallet_audit
        WHERE year = 2022 AND new_wallet_state = 'DEACTIVATED')A
    INNER JOIN
            (SELECT DISTINCT user_ext_id as user_id, wallet_id FROM users.users WHERE wallet_id IS NOT NULL)D
        ON A.wallet_id = D.wallet_id
    INNER JOIN
        (SELECT DISTINCT senderuserid, transaction_id AS txn_id, transaction_time AS txnTime
        from fraud.transaction_details_v3     
        where year(updated_date) = 2022
        and sendertype = 'INTERNAL_USER' AND workflowtype = 'CONSUMER_TO_MERCHANT'
        and pay_transaction_status = 'COMPLETED' AND errorcode = 'SUCCESS'
        and receiveruser in ('PHONEPEWALLETTOPUP','NEXUSWALLETTOPUP'))B
    ON D.user_id = B.senderuserid AND ((UNIX_TIMESTAMP(A.updated_at) - UNIX_TIMESTAMP(B.txnTime))/86400) BETWEEN 0 AND 7
    LEFT JOIN
        (SELECT DISTINCT senderuserid, hml_category FROM fraud.hml_classification)C
    ON D.user_id = C.senderuserid)Z
GROUP BY Z.risk_catg, Z.monthNo