First transfer to a new counterparty, $5,040.00, above the program's 95th percentile.

What happened. A first-time-counterparty detector fired on ACH outgoing transfer acht_sim_harb_a7kq2o6w9kl for $5,040.00, sent to a new counterparty (cpty_sim_harb_9m7tv4gj9kl) under the Harbor Marketplace Payouts program. The transfer scored 45 (review band, hard_signal false) and was routed to review because the detector is always reviewed. What the evidence shows. The amount ($5,040.00) is above the program's 95th percentile ($849.93 per the p95 field, though evidence lists it as 84993 in cents = $849.93) and is the first transfer with this counterparty, driving signals counterparty.first_time (+10), counterparty.first_time_and_large (+15), and amount.gt_10x_median (+20) for a total skoor of 45. The transfer status is SETTLED with no return code, indicating the payment completed without rejection. The originating entity, Alder Co 10 (enti_sim_harb_3x8shd663uc), is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened recently (2026-09-05). The counterparty's country is unknown, which is a gap but not flagged as sanctioned or high-risk in the evidence provided. What was checked. Reviewed the transfer record, entity verification and screening status, program declared volume and KRIs, and prior dispositions. Program KRIs show two items at breach level (manual_review_aging_hours, ach_unauthorized_return_rate) and several at watch level (pep_flagged_entities, high_risk_entity_share, hold_aging_hours), but none of these are tied specifically to this transfer or this counterparty. No prior dispositions exist for this alert or entity. What is recommended. The transfer has already settled, so no hold or release action applies. The entity is verified and clean, the transfer returned without issue, and the alert is a routine first-time-large-counterparty pattern consistent with the detector's design (always reviewed at this band). There is no evidence in this alert of fraud, sanctions exposure, or entity-level risk that requires further inquiry. Close the alert. Note the counterparty's unknown country as a minor documentation gap for future reference, not a blocking issue.

{
  "n": 1896,
  "band": "review",
  "skoor": 45,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (84993)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}