Alert · reviewed · open

First transfer to a new counterparty, $2,943.37, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_2s8mc65w4m
Transfer: acht_sim_nort_2s8mc65w4m · $2,943.37 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time ACH outgoing debit transfer of $2,943.37 was flagged because it exceeds the program's 95th percentile threshold for new counterparties. The detector always routes to review for this condition. What the evidence shows. The transfer (acht_sim_nort_2s8mc65w4m) is COMPLETED with no return code, indicating it settled without issue. The subject entity (enti_sim_nort_cb1ugjcd46) is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-08-25. The transfer skoor is unscored (n=1, no history), and the only signals present are counterparty.first_time and counterparty.first_time_and_large, both expected outcomes of a new counterparty relationship at this amount. There is no hard signal and no prior dispositions on this subject. What was checked. Transfer status and return code, entity verification and risk flags, screening recency, alert signals and weights, and program-level KRIs. Program KRIs show manual_review_aging_hours in breach (1434.7 hours, n=10) and three metrics in watch status (hold_aging_hours, pep_flagged_entities, high_risk_entity_share), but none of these are specific to this transfer or entity, and this alert's own transfer has no aging hold since it is already completed. Counterparty country is listed as unknown, which limits full geographic risk assessment. What is recommended. Close the alert. The transfer is completed, the entity is verified with no risk flags, and the alert signals reflect only the expected first-time-large-amount pattern rather than any adverse finding. The unknown counterparty country is a data gap worth noting but does not by itself warrant holding funds that have already settled.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is COMPLETED with no return code, so no funds are pending or reversible via this alert.
Subject entity is VERIFIED, not high risk, not PEP, with no open review reasons and screening within the last month.
Alert signals (counterparty.first_time, counterparty.first_time_and_large) describe the triggering condition itself, not an independent adverse finding.
Transfer skoor is unscored due to n=1, meaning no behavioral history contradicts or supports risk beyond the amount threshold.
Program KRI breach (manual_review_aging_hours) and watch items are program-wide and not tied to this specific transfer or entity, so they do not change the disposition of this alert.
Counterparty country is unknown, which is a data gap; this is noted but does not override the completed, verified status of the transfer and entity.

Evidence

{
  "n": 1,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (147175)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (147175)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.