Alert · reviewed · open
Entity velocity spiked: 3 transfers and $2,337.30 in 24 hours.
- Detector
- velocity_spike
- Severity
- medium
- Program
- Meridian Remit (simulated)
- Subject
- entity enti_sim_meri_5if3mzfr9pn
- Transfer
- acht_sim_meri_7a7d9po99t1 · $497.65 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A velocity_spike alert fired for entity enti_sim_meri_5if3mzfr9pn under program Meridian Remit, indicating 3 transfers totaling $2,337.30 within 24 hours, which exceeds 2x the program daily average.
What the evidence shows. The entity is a BUSINESS named 'High Risk Trading 2', flagged high_risk true, with VERIFIED status and no PEP indication; last screened 2026-06-26. The single referenced transfer is an ACH outgoing CREDIT of $497.65, settled, with a counterparty of unknown country and no return code. The alert carries a signal weight of velocity.sum_24h_gt_2x_daily_avg (+10) and, per the transfer-level signals, entity.high_risk (+20). The alert and transfer are both unscored (band unscored, skoor null), and no hard signal is present. Program KRIs are largely normal: ach_overall_return_rate 0, sanctioned_country_transfers 0, frozen_accounts 0, stale_screening_share 0.033 (ok), high_risk_entity_share 0.033 (ok), reserve_coverage_ratio 126.3 (ok). One watch-level KRI: pep_flagged_entities=1 (n=30). No prior dispositions exist for this entity.
What was checked. Reviewed the alert summary, evidence signals, the one linked transfer record, the entity profile, program declared volume and rails, and the full set of program KRIs. Checked for hard signal status (false), scoring band (unscored), return codes (none), sanctioned-country exposure (0), and prior disposition history (none).
What is recommended. The alert reflects a velocity spike on a verified, high-risk-flagged business entity with one settled ACH transfer showing no adverse return code, and program-level KRIs show no elevated risk pattern. However, the entity's high_risk flag combined with an unscored alert band and unknown counterparty country means a person should confirm the transaction pattern and counterparty details before closing. This does not by itself indicate a broader pattern across the program given normal KRIs, so escalation is not warranted. No transfer hold is in place to release. A person should review before this is closed.
- Recommendation
- hold
- Confidence
- 0.55
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity is flagged high_risk true, which is a standing risk attribute independent of this specific alert.
- Alert band is unscored (skoor null), so no quantitative risk score supports auto-closure.
- Counterparty country is unknown, leaving a gap in verifying cross-border exposure for the associated transfer.
- Program KRIs (return rates, sanctioned-country transfers, frozen accounts, reserve coverage) are all within normal ranges, arguing against escalation to a program-wide pattern.
- No prior dispositions exist for this entity, so there is no established baseline of past reviewed behavior to rely on.
- No transfer is described as held, so 'release' is not applicable.
Evidence
{
"n": 8,
"band": "unscored",
"skoor": null,
"signals": [
{
"code": "velocity.sum_24h_gt_2x_daily_avg",
"detail": "24h sum above 2× the program daily average",
"weight": 10
}
],
"routeReason": "detector not auto-closable"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| velocity.sum_24h_gt_2x_daily_avg | +10 | 24h sum above 2× the program daily average |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.