Transaction Risk Skoor 40 (review band) on a $847.57 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 53f7c3ac-900c-41a2-acfa-8575208bdbf0 fired on transfer acht_sim_nort_4mdmdoi639e, an outgoing ACH credit of $847.57 under program Northwind Payroll. The detector (skoor_review) scored the transfer 40, placing it in the review band, driven by a single signal: the counterparty has 1 prior unauthorized return. What the evidence shows. The transfer itself settled with return code none, so no return occurred on this transaction. The counterparty's history shows one prior unauthorized return, which is the sole basis for the score (weight 40, n=1256, confidence 1). The associated entity, Kestrel Partners 010, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened on 2026-09-09, eight days before the alert opened. Counterparty country is listed as unknown, which is a gap in the record but not flagged as a risk signal by the detector. Program-level KRIs are mostly in the 'ok' range: ach_unauthorized_return_rate is 0.18%, ach_overall_return_rate is 1.27%, sanctioned_country_transfers is 0, and reserve_coverage_ratio is 1.29. Three KRIs sit at 'watch' (hold_aging_hours, pep_flagged_entities, high_risk_entity_share) and one at 'breach' (manual_review_aging_hours, 1434.7 hours, n=10), but none of these are tied to this specific transfer or entity, and this entity is not among the pep or high-risk counts. What was checked. Transfer status and return code, entity verification and screening status, program declared volume and rails, and program-level KRI panel for corroborating patterns. There are no prior dispositions on file for this alert or subject. What is recommended. The transfer has already settled with no return recorded, so there are no funds to hold and release does not apply. The single risk signal is a historical prior unauthorized return on the counterparty, not a current unauthorized return, and the receiving entity is verified with no other review flags. The program-level breach in manual_review_aging_hours is a separate operational metric affecting review queue timing generally, not evidence of a pattern specific to this counterparty or entity. Nothing in the record requires a person to act on this specific transfer. Recommend closing the alert. A person should separately track the manual_review_aging_hours breach as a program-level operational item outside this alert.

{
  "n": 1256,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}