Alert · reviewed · open

First transfer to a new counterparty, $3,969.33, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_1hwd4k9u2s1
Transfer: acht_sim_nort_1hwd4k9u2s1 · $3,969.33 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An outgoing ACH credit transfer of $3,969.33 to a new counterparty was flagged because it is the first transaction with this counterparty and the amount exceeds the program's 95th percentile threshold ($3,792.17). What the evidence shows. The transfer settled and carries no return code. The skoor at alert and at transfer level is 25, in the clear band, with high confidence (n=1051, n=444 respectively). The two signals present (first_time and first_time_and_large) total 25 points and reflect the detector's design rather than an anomaly outside program norms. The originating entity, Reconciliation Agent (Northwind), is a verified business, not high risk, not PEP, with no review reasons and screening current as of 2026-08-25. The counterparty's country is unknown, but no sanctioned-country or unauthorized-return signals are present at the program level (sanctioned_country_transfers=0, ach_unauthorized_return_rate=0). The transfer amount is well within the program's declared monthly volume of $2,500,000.00. What was checked. Alert evidence and signal weights, transfer status and return code, entity verification and screening status, and program-level KRIs including velocity_vs_declared (0.20, ok), counterparty_concentration_top1 (0.10, ok), and stale_screening_share (0, ok). Two KRIs show watch or breach status (manual_review_aging_hours=1434.7 hours, breach; hold_aging_hours=518.3, watch; pep_flagged_entities and high_risk_entity_share, watch) but none of these relate to this specific transfer or counterparty. No prior dispositions exist for this alert or entity. What is recommended. The transfer has already settled, so no funds are held pending this review. The evidence is consistent with a routine first-time large payment from a verified entity with no adverse signals. The program-level manual_review_aging_hours breach is noted separately and does not implicate this specific alert. No person action is needed on this transfer.

Recommendation

Confidence

0.78

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Skoor at both alert and transfer level is 25, clear band, with high confidence (n=1051 and n=444).
Transfer status is SETTLED with no return code, so no funds are in a holdable state.
Originating entity is VERIFIED, not high risk, not PEP, with no review reasons and current screening.
Program KRIs directly relevant to this transfer (velocity_vs_declared, counterparty_concentration_top1, sanctioned_country_transfers, ach_unauthorized_return_rate) are all in ok range.
Counterparty country is unknown, which is a gap in the evidence; this lowers confidence but does not by itself indicate risk given verified entity status and clear signals.
Manual_review_aging_hours breach and other watch-level KRIs are program-wide and not tied to this specific alert or counterparty; escalation would require a stated link to this transfer, which the evidence does not provide.

Evidence

{
  "n": 1051,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (379217)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (379186)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.