Alert · reviewed · open

First transfer to a new counterparty, $1,353.58, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_4rze8yq9b2w
Transfer: acht_sim_meri_4rze8yq9b2w · $1,353.58 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time transfer of $1,353.58 was sent via ACH to a new counterparty on 2026-08-11. The detector fired because the amount exceeds the program's 95th percentile threshold of $1,350.46. The alert was opened on 2026-09-17 and routed for review per standing policy for this detector. What the evidence shows. The transfer skoor is 25, band clear, computed against n=513 with confidence 1. The only signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15); hard_signal is false. The transfer status is SETTLED with no return code, indicating no failure or reversal. The subject entity, Alder Co 20, is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-06-21. The counterparty's country is listed as unknown, which is a gap in the evidence but not flagged as a risk signal by the detector or entity record. What was checked. Transfer record, skoor and signal detail, program KRIs, and entity verification status. Program KRIs are largely in the ok range: sanctioned_country_transfers=0, ach_unauthorized_return_rate=0, high_risk_entity_share=0.033, verification_denial_rate=0.033, counterparty_concentration_top1=0.111. Two KRIs are in watch/breach status (hold_aging_hours watch, manual_review_aging_hours breach, pep_flagged_entities watch), but none of these are tied to this specific transfer, entity, or counterparty in the evidence provided. Prior dispositions: none on file. What is recommended. Close the alert. The transfer is settled, the entity is verified with no risk flags, the skoor band is clear, and the only signals are the expected first-time/large-amount triggers that caused the alert to fire. There is no evidence in this alert of a pattern requiring escalation, and no held funds to release.

Recommendation

Confidence

0.70

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Skoor band is clear (25) with hard_signal false, and no additional adverse signals are present beyond the two that triggered the alert.
Subject entity is VERIFIED, not high risk, not PEP, with no review reasons and screening within the last three months.
Transfer status is SETTLED with no return code, so there is no pending fund movement to hold or release.
Counterparty country is unknown, which is a gap in the record; this alone does not meet the bar for escalation or hold given the entity's clean verification status.
Program-level KRI breaches (manual_review_aging_hours, hold_aging_hours, pep_flagged_entities) are noted at the program level but the evidence does not connect them to this transfer, entity, or counterparty specifically.
No prior dispositions exist for this subject to suggest a repeating pattern.

Evidence

{
  "n": 513,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (135046)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (134961)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.