The entity's first transfer, $2,666.30, above the program median, came 0.0 hours after verification.

What happened. Alert 3295edf5-73d2-4b28-8a03-9bb5af891399 fired on detector rapid_onboarding (medium severity) for transfer acht_sim_nort_6tnkam5k5y, an outgoing ACH debit of $2,666.30 from entity Fern Studio 017 under the Northwind Payroll program. The transfer was the entity's first, occurred 0.0 hours after verification, and exceeded the program median of $1,638.23. What the evidence shows. The transfer has already settled (status SETTLED, return code none). The entity is VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-06-21. The transfer skoor is unscored (n=0, band unscored, confidence null), meaning there is no scoring history to compare against. The only listed signal is counterparty.first_time(+10). The counterparty's country is unknown. The transfer amount ($2,666.30) is small relative to the program's declared monthly volume ($2,500,000.00). There are no prior dispositions on this entity or transfer. What was checked. Reviewed the transfer status, entity verification and risk flags, program declared volume, threshold basis for the detector (24 hours vs. 0.0 hours observed), the scoring band, and the single signal present (first-time counterparty). No return code, no PEP/high-risk flag, and no prior alert history were found. Counterparty country is listed as unknown, which limits full evaluation of that signal. What is recommended. Close the alert. The transfer has settled, so there are no funds to hold. The entity is verified with no adverse screening, the amount is well below the program's declared monthly volume, and the single first-time-counterparty signal alone does not indicate a pattern absent additional scoring or prior history. The unknown counterparty country is a data gap worth noting for future screening completeness but does not by itself support escalation or hold.

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "163823",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}