Alert · reviewed · open

Entity velocity spiked: 6 transfers and $7,133.91 in 24 hours.

Detector: velocity_spike
Severity: medium
Program: Lantern Lending (simulated)
Subject: entity enti_sim_lant_5ii7h7ipcga
Transfer: acht_sim_lant_f00kyviejw · $1,367.45 · ach outgoing
Skoor at alert: 10 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Detector velocity_spike fired on entity enti_sim_lant_5ii7h7ipcga (Birch Holdings 31) for 6 transfers totaling $7,133.91 in a 24-hour window. Score at alert was 10, band clear, hard signal false. Route was set to reviewed because this detector type is not auto-closable. What the evidence shows. The single transfer supplied as evidence (acht_sim_lant_f00kyviejw) is a settled $1,367.45 ACH credit with no return code, dated 2026-08-30, well before the alert opened on 2026-09-17. The entity is a verified US business, not flagged high risk, not PEP, with no review reasons and screening current as of 2026-08-18. The transfer-level skoor is 10, band clear, with n=587 and confidence 1, consistent with the alert score. Program-level KRI velocity_vs_declared is 0.232 against a declared monthly volume of $900,000, which is well within range and marked ok. Other program KRIs are mostly ok or watch, except manual_review_aging_hours which shows a breach (1433.6 hours, n=6) and hold_aging_hours which is watch; neither KRI is specific to this entity or this alert's transfers. What was checked. Reviewed the alert evidence block, the single supplied transfer and its skoor/signals, the entity's verification and risk flags, the program's declared volume and KRI panel, and prior dispositions. No prior dispositions exist for this alert or entity. What is recommended. Close the alert. The score is clear, the hard signal is false, the entity is verified with no risk or PEP flags, and the velocity-to-declared-volume ratio is within normal range. The manual_review_aging_hours breach is a program-wide metric unrelated to this specific alert and does not by itself indicate a problem with this entity's activity.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Score 10, band clear, hard signal false, consistent with detector's own low-risk assessment.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and recent screening.
velocity_vs_declared KRI (0.232) is marked ok, indicating the spike is small relative to declared program volume.
Only one of the six transfers cited in the velocity count was provided as evidence, and it was already settled with no return code, so the full pattern cannot be independently verified, which limits confidence.
manual_review_aging_hours and hold_aging_hours KRIs show watch/breach status but are program-wide figures, not tied to this entity or these specific transfers, so they do not change the disposition of this alert.
No prior dispositions exist to indicate a recurring pattern for this entity.

Evidence

{
  "n": 587,
  "band": "clear",
  "skoor": 10,
  "signals": [
    {
      "code": "velocity.count_24h_gt_5",
      "detail": "6 transfers in 24h",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
velocity.count_24h_gt_5	+10		6 transfers in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.