First transfer to a new counterparty, $22,200.00, above the program's 95th percentile.

What happened. A first-time-counterparty detector fired on ACH outgoing transfer acht_sim_nort_28ybbqky3s9 for $22,200.00, sent by entity Alder Co 00 under the Northwind Payroll program to a counterparty it had not paid before. The amount is above the program's 95th percentile ($3,788.51) and above 10x the transfer median, and the alert was routed to review because this detector is always reviewed. What the evidence shows. The transfer is ACH outgoing CREDIT, status SETTLED, with no return code, so the funds have already moved and no return has posted. The originating entity, Alder Co 00, is VERIFIED, not high risk, not PEP, screened 2026-07-05, with no open review reasons. The transfer and alert skoor is 45, band review, hard_signal false, driven entirely by first-time-counterparty and large-amount signals (n=1100, confidence=1). The counterparty's country is listed as unknown, which is a gap in the record. Program KRIs show ach_overall_return_rate 1.25% and ach_unauthorized_return_rate 0%, both in the ok range, and sanctioned_country_transfers is 0 across 974 transfers. Program-level manual_review_aging_hours is in breach (1434.7 hours, n=10) and hold_aging_hours and high_risk_entity_share and pep_flagged_entities are flagged watch, but none of these figures are specific to this transfer or this counterparty. What was checked. Detector signals and weights, transfer status and return code, entity verification and screening status, program declared volume and rails, and the program KRI panel for return rates, sanctioned-country activity, and review-aging metrics. No prior dispositions exist for this alert or entity. What is recommended. The transfer has already settled, so there is no held transfer to release. The originating entity is verified with no adverse screening history, the return rate and unauthorized-return metrics are normal, and no sanctioned-country activity is present. The only open item is that the counterparty's country is unrecorded, which a reviewer should note but which does not by itself indicate a need to intervene on a settled transfer. Nothing in the evidence points to a broader pattern beyond this single first-time-large-counterparty event. Close the alert; a person should confirm the counterparty country gap is either populated or immaterial before closing.

{
  "n": 1100,
  "band": "review",
  "skoor": 45,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (378851)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}