Alert · reviewed · open

Transaction Risk Skoor 55 (review band) on a $564.62 ach transfer: returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

Detector: skoor_review
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_3twfc2a58lz
Transfer: acht_sim_harb_3twfc2a58lz · $564.62 · ach outgoing
Skoor at alert: 55 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 4f5a606c-9851-4577-aec4-c332bdab835d fired on transfer acht_sim_harb_3twfc2a58lz, an outgoing ACH credit of $564.62 to counterparty cpty_sim_harb_7nn77rms57g. The transaction risk skoor was 55, placing it in the review band. Two signals drove the score: 4 prior unauthorized returns tied to this counterparty (weight 40) and the counterparty's country (TR) falling outside the program's declared countries (weight 15, program declares US only). What the evidence shows. The transfer is already SETTLED with return code none, so no return has occurred on this specific transaction. The counterparty entity Harbor Marketplace Payouts is VERIFIED, not high risk, not PEP, screened 2026-07-15, with no review reasons. However, the counterparty history shows 4 prior unauthorized returns, and this transfer moved funds to a country (TR) the program never declared, which is itself a program-level control gap. Program KRIs show two breaches: ach_unauthorized_return_rate at 0.0085 (breach) and manual_review_aging_hours at 1438 hours (breach), alongside watch-level flags on hold_aging_hours, pep_flagged_entities, and high_risk_entity_share. There are no prior dispositions for this alert. What was checked. Transfer status and return code, counterparty verification and screening status, program declared countries and rails, program KRI panel, and prior disposition history. No other alerts or transfers for this counterparty were included in this context. What is recommended. The transfer is already settled, so a hold or release on this specific transaction is not actionable. Given the confirmed pattern of repeated unauthorized returns from this counterparty combined with a transfer to an undeclared country, and corroborating program-level breaches in unauthorized return rate and review aging, this warrants escalation for a person to assess whether the counterparty relationship should be restricted and whether the program's declared-country list needs enforcement at transaction time.

Recommendation

escalate

Confidence

0.68

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is SETTLED with return code none; no funds are in a holdable state for this alert.
Counterparty has 4 prior unauthorized returns, a repeat pattern rather than a one-off.
Transfer moved funds to TR, a country not in the program's declared list (US only), indicating a control gap beyond this single transfer.
Program KRIs show two independent breaches (ach_unauthorized_return_rate, manual_review_aging_hours) that align with the alert's signals, suggesting a broader pattern rather than an isolated event.
Entity-level screening (VERIFIED, not high risk, not PEP) does not offset the transaction-level counterparty return history and geo mismatch.
No prior dispositions exist to indicate this has already been reviewed or resolved.

Evidence

{
  "n": 1848,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "4 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country TR not declared by the program",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		4 prior unauthorized return(s)
geo.outside_declared_countries	+15		counterparty country TR not declared by the program

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.