Alert · reviewed · open

First transfer to a new counterparty, $345.70, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_58xtng9l9qn
Transfer: acht_sim_meri_58xtng9l9qn · $345.70 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time counterparty transfer of $345.70 was flagged because it exceeded the program's 95th percentile threshold ($329.98) for a new counterparty relationship. What the evidence shows. The transfer acht_sim_meri_58xtng9l9qn is an ACH outgoing credit of $345.70 USD, status SETTLED, with no return code. The subject entity, Larch Studio 211, is a verified business, not high risk, not PEP, with no review reasons and a screening date of 2026-06-20. The transfer skoor is unscored (n=1, band unscored, confidence null), and the alert itself carries no hard signal. The only signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both expected outcomes of the detector logic rather than independent risk indicators. What was checked. Reviewed the alert evidence, transfer record, program parameters, entity verification status, and prior dispositions. No prior alerts exist for this entity or counterparty. Counterparty country is listed as unknown, which is noted but not flagged as high risk by the program's country list (US, MX, PH) or entity screening. What is recommended. The transfer has already settled with no return code, the entity is verified with no high-risk or PEP indicators, and the only signals present are the detector's standard first-time/large-amount triggers. Nothing in the evidence indicates a need for further review or hold action. Recommend closing the alert.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, indicating funds already moved without incident.
Entity is VERIFIED, not high risk, not PEP, with no review reasons noted.
Alert hard_signal is false and skoor is unscored, indicating no elevated model-based risk assessment.
Signals present (first_time, first_time_and_large) are structural to the detector's design and do not by themselves indicate suspicious activity.
No prior dispositions exist to suggest a pattern with this entity or counterparty.
Counterparty country is listed as unknown, which is a gap in the evidence but not sufficient alone to warrant escalation given the entity's clean verification profile.

Evidence

{
  "n": 1,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (32998)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.