Alert · reviewed · held

Transaction Risk Skoor 45 (hold band) on a $9,401.23 ach transfer: amount.gt_3x_median, structuring.pattern.

Detector: skoor_hold
Severity: high
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_5o7ga0n23rl
Transfer: acht_sim_nort_5o7ga0n23rl · $9,401.23 · ach outgoing
Skoor at alert: 45 hold
Hard signal: yes
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A skoor_hold alert fired on outgoing ACH transfer acht_sim_nort_5o7ga0n23rl for $9,401.23 from Northwind Payroll (simulated) to counterparty cpty_sim_nort_1i029r3515d. The transfer scored 45 (hold band) with a hard signal for structuring: two debits just under $10,000 within 24 hours. The transfer status shows SETTLED. What the evidence shows. Two signals drove the score: amount.gt_3x_median (+10, transfer is more than 3x the program median of $1,907.14) and structuring.pattern (+35, hard signal, two debits just under $10,000 in 24 hours). The routeReason confirms the hard signal triggered review. The transfer is marked SETTLED with no return code, meaning funds have already moved despite autoHold:true in the evidence. The entity, Northwind Payroll, is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-17. There are no prior dispositions on this alert or entity. Program KRIs are mostly in the ok/watch range; manual_review_aging_hours shows a breach (1434.7 hours, n=13), which is a program-level backlog issue not specific to this transfer. What was checked. Reviewed the alert evidence, transfer record, program declared volume, entity verification status, and program KRI panel. Confirmed the transfer status is SETTLED rather than held, despite autoHold flag in the evidence. Checked for prior dispositions on this alert or subject: none found. Checked entity risk indicators: verified, no PEP, no high-risk flag, no stale screening. What is recommended. The structuring hard signal (two debits just under the $10,000 CTR threshold within 24 hours) requires a person to review the underlying transaction pattern and counterparty before any further transfers to this counterparty are processed, even though this specific transfer has already settled. Funds movement on this transfer cannot be stopped since it is settled, but the account should not be treated as cleared until a person confirms the structuring pattern is not intentional. Recommend hold for human review of the pattern and counterparty; do not close based on entity verification alone given the hard signal.

Recommendation

hold

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Hard signal structuring.pattern is present and drove auto-routing to review; hard signals require human disposition per detector design.
Transfer is already SETTLED, so no funds are currently at risk of moving from this specific transaction, but the underlying pattern (two sub-$10,000 debits in 24h) has not been explained in the evidence provided.
Entity verification and low-risk profile reduce urgency but do not resolve the structuring flag, which is about behavior pattern, not entity identity.
No prior dispositions exist to indicate this pattern has already been reviewed and cleared.
Program-level KRI breach (manual_review_aging_hours) is noted but is a program-wide backlog metric across 13 cases, not specific evidence of a broader scheme tied to this alert, so escalate is not supported without more linking data.
Release is not applicable since the transfer was never held; it settled independently of the alert's autoHold flag.

Evidence

{
  "n": 1247,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (190714)",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "2 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}

Skoor signals

Signal	Weight	Hard	Detail
amount.gt_3x_median	+10		amount > 3× program median (190556)
structuring.pattern	+35	yes	2 debits just under $10,000 in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.