Alert · reviewed · open

Entity velocity spiked: 1 transfers and $635.76 in 24 hours.

Detector: velocity_spike
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: entity enti_sim_harb_2ag6spru3vs
Transfer: acht_sim_harb_127paj8z3yb · $576.89 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A velocity_spike alert fired on entity enti_sim_harb_2ag6spru3vs (Birch Holdings 113) under the Harbor Marketplace Payouts program. The detector summary cites 1 transfer totaling $635.76 in 24 hours, exceeding twice the program's daily average. What the evidence shows. The only transfer record provided is acht_sim_harb_127paj8z3yb, an ACH outgoing debit of $576.89 USD, status SETTLED, created 2026-07-10T02:11:42.000Z. This amount does not match the $635.76 cited in the alert summary; the evidence provided does not explain the discrepancy. The transfer carries no return code and is already settled, so no funds are currently held. The transfer-level score is unscored (n=0, confidence null), and only one signal fired (velocity.sum_24h_gt_2x_daily_avg, weight 10). The entity is a VERIFIED business, not flagged high risk, not PEP, with no review reasons on file and a recent screening date (2026-06-29). There are no prior dispositions on this entity. What was checked. Transfer status and amount, entity verification status and risk flags, program rails and declared volume, scoring band and signal count, and prior disposition history. No counterparty country or additional transfer history was available for cross-reference. What is recommended. Close the alert. The transfer has already settled, so holding funds is not an option. The entity is verified, not high-risk, has no PEP or adverse screening history, and the alert rests on a single low-weight signal from an unscored model (n=0). The amount discrepancy between the alert summary and the transfer record should be noted for data-quality follow-up but does not itself indicate a risk pattern requiring a person to intervene before this alert closes.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer is already SETTLED, ruling out 'release' as a valid recommendation.
Only one signal fired, weight 10, and the model band is unscored with n=0, indicating thin statistical support for the spike claim.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date.
No prior dispositions exist to suggest a recurring pattern.
The alert summary amount ($635.76) does not match the transfer amount ($576.89) in the evidence provided; this inconsistency is flagged but does not change the disposition since the underlying entity and transfer show no other risk indicators.
Confidence is capped at moderate because of the unexplained amount mismatch and the absence of counterparty country data.

Evidence

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
velocity.sum_24h_gt_2x_daily_avg	+10		24h sum above 2× the program daily average

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.