Alert · reviewed · open

The entity's first transfer, $3,028.64, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_rmohrnybe
Transfer: acht_sim_nort_rmohrnybe · $3,028.64 · ach outgoing
Skoor at alert: 15 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The entity's first transfer, an outgoing ACH credit of $3,028.64, occurred 0.0 hours after verification, which is above the program median of $2,010.77 and within the rapid_onboarding detector's 24-hour threshold. What the evidence shows. The transfer scored 15 (band clear, confidence 0.3725) with n=69. The transfer itself carries no adverse signal; the score of 15 derives entirely from the entity-level signal entity.pep_potential(+15). The entity, a person flagged as 'Potential Pep 0', is verified, not marked high risk, has no review reasons listed, and was last screened 2026-09-01. The transfer status is COMPLETED with no return code, and counterparty country is unknown. Program KRIs show pep_flagged_entities at 1/33 (watch) and high_risk_entity_share at watch, but no breach-level KRI directly tied to this transfer or entity; manual_review_aging_hours is in breach at the program level but is not specific to this alert. What was checked. Transfer details, entity verification status and screening date, program KRIs, and prior dispositions (none on record). The transfer is already COMPLETED, not held. What is recommended. The alert should be closed. The score sits in the clear band, the transfer has already settled with no return, and the entity is verified with no open review reasons. The pep_potential signal is noted but does not on its own indicate an unresolved issue given the entity's screening is current and verification status is clean. Since the transfer already completed, a release recommendation does not apply.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Skoor 15 falls in the clear band with confidence 0.3725, based on n=69.
The only contributing signal is entity.pep_potential(+15); no transfer-level adverse signal is present.
Entity is VERIFIED, not high risk, with no review reasons and screening current as of 2026-09-01.
Transfer status is COMPLETED with no return code, so hold/release does not apply.
Program KRIs show pep_flagged_entities and high_risk_entity_share at watch, not breach, and are not specific to this entity beyond the noted flag.
Confidence is moderate given the low detector confidence score (0.3725) and thin entity review history (review reasons none).

Evidence

{
  "n": 69,
  "band": "clear",
  "skoor": 15,
  "typology": "rapid_onboarding",
  "confidence": 0.3725,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "201077",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
entity.pep_potential	+15		potential PEP match

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.