Alert · reviewed · open
First transfer to a new counterparty, $2,357.31, above the program's 95th percentile.
- Detector
- first_time_counterparty_large
- Severity
- medium
- Program
- Lantern Lending (simulated)
- Subject
- transfer acht_sim_lant_59yo4ag6ckh
- Transfer
- acht_sim_lant_59yo4ag6ckh · $2,357.31 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An outbound ACH transfer of $2,357.31 from entity Grove Co 36 to a new counterparty (cpty_sim_lant_7n7vcvi5cjp) triggered a first-time-counterparty-large alert because the amount exceeds the program's 95th percentile threshold of $1,734.75.
What the evidence shows. The transfer is the first with this counterparty (n=1) and is unscored (band unscored, skoor null). Two signals fired: counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both consistent with the detector's stated logic. The transfer status is SETTLED with no return code, indicating the funds have already moved and no rail-level failure occurred. The subject entity, Grove Co 36, is VERIFIED, not flagged high risk, not PEP, has no review reasons, and was last screened 2026-06-28. The counterparty's country is unknown, but no other adverse data is present. There are no prior dispositions on this entity or counterparty.
What was checked. Alert evidence and signal weights, transfer record (status, amount, rails, return code), program declared volume and threshold context, entity verification and screening status, and prior disposition history. No hard signal was present (hard_signal: false), and the alert was routed to review per the detector's standing rule ("detector always reviewed"), not due to any elevated risk score.
What is recommended. Close the alert. The transfer has already settled, so no funds are pending and a hold or release action does not apply. The entity is verified with no high-risk or PEP flags, screening is current, and no prior alerts exist on this counterparty or entity. The alert reflects a routine first-time/large-amount pattern that the detector reviews by default, not an indication of elevated risk requiring further action. If a similar pattern recurs with this counterparty or entity, escalation would be warranted at that point.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer status is SETTLED with no return code; funds have already moved, so hold/release is not applicable.
- Entity is VERIFIED, not high risk, not PEP, with no review reasons and recent screening (2026-06-28).
- No prior dispositions exist to suggest a broader pattern with this counterparty or entity.
- Alert triggered solely on first-time-counterparty and amount-above-p95 signals, both expected outcomes of the detector's always-review rule rather than an anomaly score (skoor null, unscored band).
- Counterparty country is unknown, which is a minor gap but not sufficient alone to warrant hold or escalation given the entity's clean verification status.
Evidence
{
"n": 1,
"band": "unscored",
"skoor": null,
"signals": [
{
"code": "counterparty.first_time",
"detail": "first transfer with this counterparty",
"weight": 10
},
{
"code": "counterparty.first_time_and_large",
"detail": "amount above the program p95 (173475)",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| counterparty.first_time | +10 | first transfer with this counterparty | |
| counterparty.first_time_and_large | +15 | amount above the program p95 (172886) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.