Alert · reviewed · open

The entity's first transfer, $3,843.18, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_79bsxfnpcm
Transfer: acht_sim_nort_79bsxfnpcm · $3,843.18 · ach outgoing
Skoor at alert: 0 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The rapid_onboarding detector fired on entity Birch Holdings 01's first transfer (acht_sim_nort_79bsxfnpcm), an outgoing ACH credit of $3,843.18 that posted 0.0 hours after the entity's verification completed. The amount exceeds the program median of $2,061.60. The transfer status is COMPLETED with no return code. What the evidence shows. The transfer-level skoor is 0 in the clear band, based on n=78 prior observations, with detector confidence of 0.395. The entity is VERIFIED, not high risk, not PEP, has no review reasons on file, and was last screened 2026-08-26, three weeks before this alert opened. The transfer completed without any ACH return. Program KRIs show ach_overall_return_rate at 1.34% and ach_unauthorized_return_rate at 0.17%, both in the ok band, and counterparty_concentration_top1 at 9.0%, also ok. Some program-level KRIs sit in watch or breach (hold_aging_hours, pep_flagged_entities, high_risk_entity_share, manual_review_aging_hours), but none of these attach specifically to this entity or this transfer. What was checked. Transfer status and return code, entity verification status and screening recency, PEP and high-risk flags, transfer skoor and band, detector confidence and sample size, program KRI panel for related stress signals, and prior dispositions on this alert (none on file). What is recommended. Close the alert. The transfer already completed with no return, the entity is verified with no adverse screening or review history, and the skoor is clear. The only trigger is a timing/amount heuristic (fast first transfer, above median) with low detector confidence and nothing in the entity or program record corroborating risk. Since the transfer is not held, release does not apply.

Recommendation

Confidence

0.68

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is COMPLETED with return code none; no funds are pending a hold decision.
Transfer skoor is 0, band clear, based on n=78, though detector confidence is only 0.395.
Entity is VERIFIED, not high risk, not PEP, no review reasons, screened within the last month.
Program KRIs tied to fraud/return risk (ach_overall_return_rate, ach_unauthorized_return_rate, counterparty_concentration_top1) are all in the ok band.
Some program KRIs show watch/breach status (manual_review_aging_hours, hold_aging_hours, pep_flagged_entities, high_risk_entity_share) but none are linked to this specific entity or transfer, so they do not by themselves justify escalation of this alert.
No prior dispositions exist for this alert to indicate repeat concern.

Evidence

{
  "n": 78,
  "band": "clear",
  "skoor": 0,
  "typology": "rapid_onboarding",
  "confidence": 0.395,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "206160",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.