Alert · reviewed · held

Counterparty Receiver 40 entered the hold band (Skoor 90, n=10): counterparty.unauthorized_returns, counterparty.unauthorized_rate, counterparty.return_rate, counterparty.review_share, counterparty.new.

Detector: counterparty_hold
Severity: high
Program: Harbor Marketplace Payouts (simulated)
Subject: counterparty cpty_sim_harb_p034wda4nm
Transfer: —
Skoor at alert: 90 hold
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 3f42d5f0-1a3e-4fa2-872b-1cc9a6bbc373 fired on counterparty cpty_sim_harb_p034wda4nm under the counterparty_hold detector. The counterparty entered the hold band with a Skoor of 90 on a sample of 10 transactions. The alert was auto-held and routed for review; hard signal is false and detector confidence is recorded as 0.24. What the evidence shows. Of 10 observed transactions, 2 were unauthorized returns, giving an unauthorized rate of 2/10 and a return rate of 2/10, both above the network threshold that drives the counterparty.unauthorized_rate and counterparty.return_rate signals (weights 15 and 15). Half of the 10 transactions fall in the review band (counterparty.review_share, weight 10). The counterparty was first seen 0 days ago (counterparty.new, weight 10). The unauthorized-returns signal itself carries the largest weight (40) and reflects the 2 unauthorized returns directly. Combined these five signals produced the Skoor of 90 and the hold band assignment. What was checked. Program-level KRIs for Harbor Marketplace Payouts were reviewed for context. ach_unauthorized_return_rate is flagged breach at 0.0118 across n=507, and manual_review_aging_hours is flagged breach at 1438 hours across n=9. hold_aging_hours (1023.96 hours, n=7), pep_flagged_entities (1 of 30), and high_risk_entity_share (0.067) are flagged watch. No prior dispositions exist for this counterparty. The program-level breaches are aggregate figures across the full counterparty book and are not broken out by this specific counterparty, so they cannot be tied directly to this alert's evidence; they indicate the program is already under strain on unauthorized returns and review aging, which is relevant context but not proof of a linked pattern. What is recommended. Hold. The counterparty is new (0 days), has a 20% unauthorized-return rate on a small sample, and half its activity sits in the review band. The detector's own confidence is low (0.24) and the sample size (n=10) is thin, so this alone does not establish a durable pattern, but the unauthorized-returns signal is a hard count (2 of 10) that a person should review before any further payouts to this counterparty are released. Given the program-wide breach on manual_review_aging_hours, review capacity should be checked so this hold does not sit unresolved.

Recommendation

hold

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Skoor 90 places the counterparty in the hold band per crs-v1 with autoHold true.
2 of 10 transactions were unauthorized returns, a hard count directly cited in the evidence.
Counterparty is first-seen 0 days ago, adding weight via counterparty.new.
Detector confidence is low (0.24) and sample size is small (n=10), so escalation to a broader pattern is not supported by this alert alone.
No prior dispositions exist to corroborate a repeat or systemic issue for this specific counterparty.
Program KRIs show manual_review_aging_hours and ach_unauthorized_return_rate in breach, which supports keeping funds held pending review rather than closing, but does not itself justify escalation absent a counterparty-specific link.

Evidence

{
  "n": 10,
  "band": "hold",
  "skoor": 90,
  "signals": [
    {
      "code": "counterparty.unauthorized_returns",
      "detail": "drew 2 unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "counterparty.unauthorized_rate",
      "detail": "unauthorized rate 2/10 above the network threshold",
      "weight": 15
    },
    {
      "code": "counterparty.return_rate",
      "detail": "return rate 2/10",
      "weight": 15
    },
    {
      "code": "counterparty.review_share",
      "detail": "50% in the review band",
      "weight": 10
    },
    {
      "code": "counterparty.new",
      "detail": "first seen 0d ago",
      "weight": 10
    }
  ],
  "version": "crs-v1",
  "autoHold": true,
  "confidence": 0.24,
  "routeReason": "detector not auto-closable"
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.