Alert · reviewed · open

A single $9,787.59 ACH debit sits just under the $10,000 reporting threshold with no 24-hour pattern around it.

Detector: amount_just_below_threshold
Severity: low
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_59wpbpcb9jr
Transfer: acht_sim_harb_59wpbpcb9jr · $9,787.59 · ach outgoing
Skoor at alert: 20 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A single outgoing ACH debit of $9,787.59 from Harbor Marketplace Payouts settled on 2026-09-07. The amount sits just under the $10,000 reporting threshold, which triggered the amount_just_below_threshold detector. What the evidence shows. The alert evidence states no 24-hour pattern around this transfer, meaning no cluster of similar sub-threshold transactions was found. The transfer skoor is 20, band clear, with n=1902 and confidence 1. The only contributing signal is amount.gt_10x_median(+20). The transfer has already settled with no return code. The originating entity, Harbor Marketplace Payouts, is VERIFIED, not high risk, not PEP, with no review reasons, last screened 2026-07-15. Program-level KRIs show velocity_vs_declared at 0.089 (ok) and counterparty_concentration_top1 at 0.071 (ok), indicating this transfer is not part of an outsized volume or concentration pattern for the program. What was checked. Transfer status and return code, entity verification and risk flags, transfer skoor and band, presence of a 24-hour transaction pattern, and program-level KRIs for velocity, concentration, and screening staleness. Two program KRIs show breach status (manual_review_aging_hours, ach_unauthorized_return_rate) and several show watch status, but these are program-wide metrics not tied to this specific transfer or entity, and the alert itself carries no hard signal. What is recommended. Close the alert. The transfer is a single settled debit with no pattern of structuring, a clear-band skoor, a verified low-risk entity, and no return or dispute activity. The transfer is already settled, so no hold or release action applies.

Recommendation

Confidence

0.78

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Detector fired on amount proximity to threshold, but evidence explicitly notes no 24-hour pattern around the transaction
Transfer skoor is 20, band clear, confidence 1, hard_signal false
Entity is VERIFIED, not high risk, not PEP, no review reasons, screened within the last two months
Transfer status is SETTLED with no return code, so no funds-movement action is available or needed
Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are program-wide and not linked to this entity or transfer in the evidence provided
No prior dispositions exist for this alert or entity to suggest a recurring issue

Evidence

{
  "n": 1902,
  "band": "clear",
  "skoor": 20,
  "typology": "amount_just_below_threshold",
  "confidence": 1,
  "thresholds": {
    "maxCents": "999999",
    "minCents": "900000"
  },
  "amountCents": "978759",
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
amount.gt_10x_median	+20		amount > 10× program median (42335)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.