First transfer to a new counterparty, $3,851.29, above the program's 95th percentile.

What happened. A detector flagged a first-time-counterparty transfer of $3,851.29 on ACH transfer acht_sim_nort_4w2inkdk1vk, opened 2026-09-17, because the amount exceeds the program's 95th percentile ($3,815.30) and the counterparty had no prior transfer history. What the evidence shows. The transfer skoor is 25, placed in the 'clear' band with n=675 and confidence 1. Two signals fired: counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both consistent with the detector's stated logic. The transfer status is SETTLED with no return code, meaning no reversal or rejection occurred. The originating entity, Iris Services 020, is VERIFIED, not high risk, not PEP, with no open review reasons and a screening date of 2026-06-25. The counterparty's country is listed as unknown, which is a data gap but not a flagged risk condition in the evidence provided. Program KRIs are mostly within normal range (ach return rates near zero, reserve coverage 3.02, counterparty concentration 0.13); two KRIs sit in watch status (pep_flagged_entities, high_risk_entity_share) and one is in breach (manual_review_aging_hours=1434.7 hours), but none of these are tied to this specific alert, transfer, or entity in the evidence. What was checked. Detector score and band, transfer status and return code, entity verification and screening status, program KRIs, and prior dispositions (none on record). No evidence was found linking this transfer to sanctioned countries, unauthorized returns, or entity-level risk flags. What is recommended. Close the alert. The transfer has already settled, the entity is verified with no risk flags, and the skoor sits in the clear band. The unknown counterparty country is a data-quality gap worth noting for program monitoring but does not meet the threshold for holding or escalating this alert given the absence of any adverse signal on the transfer itself.

{
  "n": 675,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (381530)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}