Alert · reviewed · open

First transfer to a new counterparty, $905.30, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_5b24cpp773q
Transfer: acht_sim_harb_5b24cpp773q · $905.30 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time counterparty transfer of $905.30 via ACH was flagged because it exceeded the program's 95th percentile amount ($849.81) for a new counterparty relationship. The detector always routes to review regardless of score. What the evidence shows. The transfer skoor is 25, in the clear band, with high confidence (n=1201). The two signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both describing the same first-time large-amount pattern the detector is designed to catch. The transfer has already settled with no return code. The subject entity, Kestrel Partners 110, is verified, not high risk, not PEP, with no open review reasons, screened as recently as 2026-07-05. What was checked. Transfer status and return code, entity verification and risk flags, transfer skoor and band, and program KRIs. Program KRIs show manual_review_aging_hours and ach_unauthorized_return_rate in breach, and hold_aging_hours, pep_flagged_entities, and high_risk_entity_share in watch, but these are program-wide metrics with no linkage in the evidence to this specific transfer or counterparty. No prior dispositions exist for this alert. What is recommended. Close the alert. The transfer has settled, the entity is verified with no risk flags, and the scoring signals reflect only the expected first-time-large pattern the detector is built to surface, not an indication of fraud or policy violation. The program-level KRI breaches are noted for separate monitoring but do not attach to this transfer's evidence.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Skoor 25 is in the clear band with confidence 1 over n=1201.
Both signals present describe the same first-time-large pattern that the detector is designed to flag; no additional adverse signal is present.
Transfer status is SETTLED with no return code, so no funds are pending or reversible via hold/release.
Entity is VERIFIED, not high risk, not PEP, with no open review reasons and recent screening.
Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are program-level and not tied in the evidence to this transfer or counterparty, so they inform monitoring but not this disposition.
No prior dispositions exist to suggest a repeat or escalating pattern for this counterparty or entity.

Evidence

{
  "n": 1201,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (84981)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (84959)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.