Alert · reviewed · open
The entity's first transfer, $2,015.45, above the program median, came 0.0 hours after verification.
- Detector
- rapid_onboarding
- Severity
- medium
- Program
- Northwind Payroll (simulated)
- Subject
- transfer acht_sim_nort_2hls8ojn7a
- Transfer
- acht_sim_nort_2hls8ojn7a · $2,015.45 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 0533dfb2-245e-4db4-a035-6989c5aa2d27 fired on transfer acht_sim_nort_2hls8ojn7a, an outgoing ACH credit of $2,015.45 from entity Larch Studio 011 under the Northwind Payroll program. The rapid_onboarding detector flagged that this was the entity's first transfer and it occurred 0.0 hours after verification, against a 24-hour threshold, with the amount above the program median of $1,957.16.
What the evidence shows. The transfer has settled with no return code, indicating no failure or reversal. The entity is BUSINESS-type, verification status VERIFIED, not flagged high risk, not PEP, with no review reasons on file, and was last screened 2026-06-23. The transfer's own risk score is unscored (skoor null, band unscored, confidence null, n=15), so no quantitative scoring signal is available beyond the detector's timing and amount comparison. The program's declared monthly volume is $2,500,000.00; a single $2,015.45 transfer is a small fraction of that. There are no prior dispositions on this entity or alert.
What was checked. Verification status and timestamp, transfer status and return code, entity risk flags (high risk, PEP, review reasons), last screening date, program declared volume and rails/country, transfer scoring band, and prior disposition history. All fields were present in the evidence except the score, which is null and unscored due to low sample size (n=15).
What is recommended. The transfer has already settled, so there is no held transaction to hold or release. The entity is verified with no adverse flags, and the amount is consistent with a normal payroll-program transaction. Absent a hard signal or scoring result, and with no prior alert history to suggest a pattern, this alert does not present evidence requiring further action beyond what has already been checked. Recommend closing the alert, noting the unscored transfer risk as a limitation.
- Recommendation
- close
- Confidence
- 0.62
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer status is SETTLED with no return code, so no funds-movement action applies.
- Entity is VERIFIED, not high risk, not PEP, with no review reasons and recent screening.
- Amount ($2,015.45) is modest relative to declared program volume ($2,500,000.00/month).
- Transfer skoor/band is null/unscored (n=15, confidence null), which limits certainty and is disclosed rather than treated as a negative signal.
- No prior dispositions exist to suggest a recurring or escalating pattern for this entity.
- Rapid onboarding (0.0 hours post-verification) is the detector's core trigger, but by itself, without other adverse flags, does not indicate fraud or structuring on this record.
Evidence
{
"n": 15,
"band": "unscored",
"skoor": null,
"typology": "rapid_onboarding",
"confidence": null,
"thresholds": {
"hours": 24
},
"medianCents": "195716",
"routeReason": "detector not auto-closable",
"hoursSinceVerification": 0
}
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.