Alert · reviewed · held
The entity's first transfer, $2,400.00, above the program median, came 0.0 hours after verification.
- Detector
- rapid_onboarding
- Severity
- medium
- Program
- Meridian Remit (simulated)
- Subject
- transfer acht_sim_meri_6r6oon2pcdx
- Transfer
- acht_sim_meri_6r6oon2pcdx · $2,400.00 · ach outgoing
- Skoor at alert
- 100 hold
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A ach outgoing credit transfer of $2400.00 (acht_sim_meri_6r6oon2pcdx) on program Meridian Remit (simulated) was flagged by detector rapid_onboarding: The entity's first transfer, $2,400.00, above the program median, came 0.0 hours after verification..
What the evidence shows. Transaction Risk Skoor 100 (band hold). Signals: entity.denied (+60, hard), returns.counterparty_prior_unauthorized (+40), amount.gt_3x_median (+10). Entity Denied Origin 2: verification DENIED, PEP no, high risk no, review reasons: sanctions_match. Return code R05 on the transfer.
What was checked. Program KRIs as of the latest snapshot: frozen_accounts ok, hold_aging_hours watch, overdraft_events ok, manual_review_rate ok, card_fraud_declines unmeasured, pep_flagged_entities watch, velocity_vs_declared ok, stale_screening_share ok, high_risk_entity_share ok, reserve_coverage_ratio breach, ach_overall_return_rate ok, verification_denial_rate ok, manual_review_aging_hours breach, ach_unauthorized_return_rate breach, sanctioned_country_transfers breach, ach_administrative_return_rate ok, counterparty_concentration_top1 ok. No prior dispositions on this entity or counterparty.
What is recommended. Recommended: hold. A person decides; this draft was assembled from the evidence without a model (model output did not match the schema).
- Recommendation
- hold
- Confidence
- null (template, no model)
- Model
- none (template)
- Drafted
- 2026-09-17 19:32Z
- Rationale
- Template draft: recommendation follows the band and the hard-signal rule only.
Evidence
{
"n": 755,
"band": "hold",
"skoor": 100,
"autoHold": true,
"typology": "rapid_onboarding",
"confidence": 0.7,
"thresholds": {
"hours": 24
},
"medianCents": "65979",
"routeReason": "detector not auto-closable",
"hoursSinceVerification": 0
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.denied | +60 | yes | entity verification DENIED |
| returns.counterparty_prior_unauthorized | +40 | 1 prior unauthorized return(s) | |
| amount.gt_3x_median | +10 | amount > 3× program median (66220) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.