Alert · reviewed · open

The entity's first transfer, $910.51, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_6hm6srxl9wj
Transfer: acht_sim_meri_6hm6srxl9wj · $910.51 · ach outgoing
Skoor at alert: 10 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An alert fired under detector rapid_onboarding for entity Larch Studio 223 (enti_sim_meri_364qtf9e9p8) tied to transfer acht_sim_meri_6hm6srxl9wj, an outgoing ACH debit of $910.51 USD. The transfer was the entity's first, occurring 0.0 hours after verification, and the amount is above the program median of $654.40. What the evidence shows. The transfer skoor is 10, band clear, with confidence 0.305 and hard_signal false. The only contributing signal is counterparty.first_time(+10). The transfer status is SETTLED with no return code, indicating it completed without rejection. The entity is a VERIFIED US business, not high risk, not PEP, with no review reasons and no prior dispositions on file. The counterparty's country is unknown, but no other risk flags are attached to it. What was checked. I checked the alert evidence block (n=42, band clear, thresholds), the transfer record (status, amount, counterparty, return code), the program profile (declared volume, rails, countries), and the entity verification status and screening date. No prior dispositions exist for this entity to indicate a pattern. What is recommended. The transfer has already settled, so no funds are available to hold or release. The score sits in the clear band with low confidence and no hard signal, the entity is verified with no risk flags, and the only trigger is a first-time counterparty timing signal inherent to the detector's design. Nothing in the evidence requires a person to intervene. Recommend closing the alert.

Recommendation

Confidence

0.74

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED; there is no pending transfer to hold or release.
Skoor band is clear (10) with hard_signal false, indicating the automated risk model did not flag material concern.
Entity is VERIFIED, not high risk, not PEP, with no review reasons listed.
Only one signal fired (counterparty.first_time), which is expected for a rapid-onboarding first transfer and not itself indicative of fraud.
No prior dispositions exist to suggest a broader pattern for this entity.
Confidence is not higher because the detector's own confidence score is low (0.305) and counterparty country is unknown, leaving some residual uncertainty about the counterparty.

Evidence

{
  "n": 42,
  "band": "clear",
  "skoor": 10,
  "typology": "rapid_onboarding",
  "confidence": 0.305,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "65440",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.