Transaction Risk Skoor 40 (review band) on a $1,138.15 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing debit transfer of $1,138.15 from acht_sim_nort_c76h9vcx1zt was flagged by the skoor_review detector at a Transaction Risk Skoor of 40 (review band) due to a single signal: the counterparty has one prior unauthorized ACH return on record. The transfer itself settled with no return code. What the evidence shows. The only signal driving the score is returns.counterparty_prior_unauthorized, weighted 40, based on one prior unauthorized return for this counterparty (n=721 population baseline, confidence 0.91). The transfer under review settled with return code none, so no unauthorized return occurred on this specific transaction. The originating entity, Birch Holdings 01, is VERIFIED, not high risk, not PEP, and was screened as recently as 2026-06-23. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=274) and ach_overall_return_rate at 0.73% (n=274), both in the ok range, indicating no broader pattern of unauthorized returns across the program. manual_review_aging_hours shows a breach (1434.67 hours, n=6), but this reflects program-wide review backlog, not a fact specific to this transfer or counterparty. What was checked. Reviewed the transfer record (status, amount, rail, return code), the entity verification status and screening date, the program KRI panel for related patterns (unauthorized return rate, administrative return rate, sanctioned country transfers, high risk entity share), and prior dispositions on this alert, subject, and entity. No prior dispositions exist for this alert. What is recommended. The transfer has already settled; there are no funds in a held state, so a hold or release action does not apply. The triggering signal is a single historical unauthorized return tied to the counterparty, and program-level unauthorized return metrics show no pattern beyond this one alert. Given the entity is verified, not high risk, and the transfer itself cleared without incident, this alert can be closed. If the counterparty accrues additional unauthorized returns, a future alert should escalate rather than close.

{
  "n": 721,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.91,
  "routeReason": "detector not auto-closable"
}