Alert · reviewed · open
The entity's first transfer, $2,767.71, above the program median, came 0.0 hours after verification.
- Detector
- rapid_onboarding
- Severity
- medium
- Program
- Northwind Payroll (simulated)
- Subject
- transfer acht_sim_nort_4wk5s2gd8i
- Transfer
- acht_sim_nort_4wk5s2gd8i · $2,767.71 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. The alert fired on transfer acht_sim_nort_4wk5s2gd8i, an outgoing ACH debit of $2,767.71 from entity Grove Co 06, flagged by the rapid_onboarding detector because the transfer occurred 0.0 hours after verification, within the 24-hour threshold, and the amount exceeded the program median of $1,818.09.
What the evidence shows. The transfer has already settled with no return code, indicating no rejection or dispute occurred. The entity is a verified US business, not high risk, not PEP, with no review reasons on file and a screening date of 2026-07-06. The transfer skoor is null/unscored with n=15, so no statistical model backs this alert beyond the raw threshold comparison. The counterparty's country is unknown, which is a gap in the evidence. Prior dispositions for this entity are none, so there is no history of similar flags to indicate a pattern.
What was checked. Program declared monthly volume ($2,500,000.00), transfer status and return code, entity verification status and risk flags, screening date, transfer skoor and band, and prior disposition history. All fields were reviewed as provided; no external data was available.
What is recommended. The transfer has already settled, so holding funds is not an option; this alert concerns a completed transaction rather than one in a holdable state. The entity is verified with no risk flags, the amount is above median but not extreme relative to the declared program volume, and the transfer completed without a return code. The unscored skoor and unknown counterparty country are gaps, but nothing in the evidence indicates a person must intervene now given the transfer already settled and the entity's clean verification profile. A person should still confirm the counterparty country is benign given it is unrecorded here.
- Recommendation
- close
- Confidence
- 0.55
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer status is SETTLED with no return code, indicating no processing issue.
- Entity is VERIFIED, not high risk, not PEP, with no review reasons.
- No prior dispositions exist for this entity, so no pattern is evidenced.
- Transfer skoor is null/unscored (n=15), limiting statistical confidence in this being anomalous beyond the raw threshold trigger.
- Counterparty country is unknown, which is a residual gap not fully resolved by available evidence, tempering confidence.
Evidence
{
"n": 15,
"band": "unscored",
"skoor": null,
"typology": "rapid_onboarding",
"confidence": null,
"thresholds": {
"hours": 24
},
"medianCents": "181809",
"routeReason": "detector not auto-closable",
"hoursSinceVerification": 0
}
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.