Alert · reviewed · open

Agent Settlement Agent (Meridian vendor) moved money on rails outside its declared scope (ach, wire vs ach, realtime).

Detector: agent_out_of_scope
Severity: high
Program: Meridian Remit (simulated)
Subject: counterparty cpty_sim_meri_1obmksl9pv
Transfer: —
Skoor at alert: 30 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Detector agent_out_of_scope raised an alert on counterparty cpty_sim_meri_1obmksl9pv for program Meridian Remit (simulated): Agent Settlement Agent (Meridian vendor) moved money on rails outside its declared scope (ach, wire vs ach, realtime).. What the evidence shows. Transaction Risk Skoor 30 (band review). What was checked. Program KRIs as of the latest snapshot: frozen_accounts ok, hold_aging_hours watch, overdraft_events ok, manual_review_rate ok, card_fraud_declines unmeasured, pep_flagged_entities watch, velocity_vs_declared ok, stale_screening_share ok, high_risk_entity_share ok, reserve_coverage_ratio ok, ach_overall_return_rate ok, verification_denial_rate ok, manual_review_aging_hours breach, ach_unauthorized_return_rate ok, sanctioned_country_transfers ok, ach_administrative_return_rate ok, counterparty_concentration_top1 ok. No prior dispositions on this entity or counterparty. What is recommended. Recommended: escalate. A person decides; this draft was assembled from the evidence without a model (model call failed).

Recommendation

escalate

Confidence

null (template, no model)

Model

none (template)

Drafted

2026-09-17 19:31Z

Rationale

Template draft: recommendation follows the band and the hard-signal rule only.

Evidence

{
  "n": 41,
  "band": "review",
  "actor": "agent",
  "scope": [
    "ach",
    "realtime"
  ],
  "skoor": 30,
  "signals": [
    {
      "code": "counterparty.new",
      "detail": "first seen 0d ago",
      "weight": 10
    },
    {
      "code": "agent.out_of_scope",
      "detail": "activity on wire outside declared scope ach, realtime",
      "weight": 20
    }
  ],
  "version": "ars-v1",
  "railsUsed": [
    "ach",
    "wire"
  ],
  "confidence": 0.674,
  "routeReason": "detector not auto-closable"
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.