Alert · reviewed · held

The entity's first transfer, $2,400.00, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_6mf9ak9b9ki
Transfer: acht_sim_harb_6mf9ak9b9ki · $2,400.00 · ach outgoing
Skoor at alert: 90 hold
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A rapid_onboarding alert fired on outgoing ACH transfer acht_sim_harb_6mf9ak9b9ki for $2,400.00 from entity enti_sim_harb_130qwgg53wz, the entity's first transfer, initiated 0.0 hours after verification. The transfer has already settled. What the evidence shows. The entity's verification status is DENIED with review reason sanctions_match, and high_risk is flagged true. The scoring model assigned skoor 90 (band hold) driven by entity.denied (+60, hard signal), entity.high_risk (+20), and amount.gt_3x_median (+10). The transfer amount of $2,400.00 is above the program median of $425.39 and exceeds 3x that median. Despite the hold band and hard signal, the transfer status is SETTLED, meaning funds have already moved and there is no pending transfer to hold or release. Program KRIs show manual_review_aging_hours in breach (1438.04 hours, n=12) and ach_unauthorized_return_rate in breach (0.0081, n=742), alongside watch-level high_risk_entity_share (0.067, n=30) and pep_flagged_entities (1, n=30). What was checked. Alert evidence fields, transfer record, entity verification and risk flags, program KRI snapshot, and prior dispositions for this alert (none found). No additional case notes or sanctions screening detail beyond the review reason were available in this context. What is recommended. This alert cannot be resolved by closing it: a denied entity with a sanctions_match review reason completed a settled outgoing transfer, and the program is separately showing a breach on manual_review_aging_hours and ach_unauthorized_return_rate. This combination suggests a control gap beyond this single alert (settlement occurring despite a denied/sanctions-flagged entity) rather than an isolated false positive. A person should review whether other transfers from this entity or similarly denied entities have settled, and whether the manual_review_aging_hours breach is contributing to delayed action on hard-signal alerts like this one.

Recommendation

escalate

Confidence

0.82

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Entity verification is DENIED with review reason sanctions_match, and entity.denied is a hard signal (+60) driving the skoor to 90 in the hold band.
The associated transfer has already SETTLED, so there is no pending transfer to hold or release; the alert cannot be closed as routine given the hard signal and denied status.
Program KRIs independently show a breach in manual_review_aging_hours (1438.04 hours) and ach_unauthorized_return_rate (0.0081), suggesting delayed handling of high-risk cases at the program level, which is relevant context for this alert.
Amount ($2,400.00) is more than 3x the program median ($425.39), consistent with the amount.gt_3x_median signal (+10), and the transfer occurred at 0.0 hours since verification, matching the rapid_onboarding typology description.
No prior dispositions exist for this alert, so this is the first review point for this entity's activity.
Evidence context is otherwise complete (transfer, entity, program, KRIs all populated), supporting reasonably high confidence in this assessment, though the underlying sanctions_match detail is not elaborated beyond the label.

Evidence

{
  "n": 954,
  "band": "hold",
  "skoor": 90,
  "autoHold": true,
  "typology": "rapid_onboarding",
  "confidence": 0.7,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "42539",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
entity.denied	+60	yes	entity verification DENIED
entity.high_risk	+20		entity marked high risk by screening
returns.counterparty_prior_any	+15		1 prior return(s) other than NSF
amount.gt_3x_median	+10		amount > 3× program median (42539)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.