Alert · reviewed · open

First transfer to a new counterparty, $3,632.11, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_8hoy1h4x7q
Transfer: acht_sim_nort_8hoy1h4x7q · $3,632.11 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time ACH credit transfer of $3,632.11 was sent to a new counterparty under the Northwind Payroll program. The detector flagged it because the amount exceeds the program's 95th percentile ($2,869.79) and the counterparty had no prior transfer history with this subject. What the evidence shows. The transfer acht_sim_nort_8hoy1h4x7q is ACH outgoing CREDIT, status SETTLED, with no return code. Evidence lists two signals: counterparty.first_time (weight 10) and counterparty.first_time_and_large (weight 15), plus a velocity.sum_24h_gt_2x_daily_avg signal (weight 10) noted at the transfer level. The skoor is null/unscored with n=2, so no model confidence is available. The counterparty's country is unknown. The entity Kestrel Partners 022 is VERIFIED, not high risk, not PEP, with no open review reasons, last screened 2026-06-28. There are no prior dispositions on this subject. What was checked. Transfer status and return code, program declared volume and rails, entity verification and risk flags, screening recency, and prior disposition history. No additional counterparty records or cross-alert linkage were present in the context. What is recommended. The transfer has already settled with no return, the paying entity is verified with no risk flags, and the only signals are threshold-based (first-time, large amount, elevated 24h velocity) with no scoring model confidence to weigh against them. Nothing in the evidence indicates a fraud pattern requiring a person to act now, but the unscored band and unknown counterparty country mean this should not be treated as fully resolved without a documented review.

Recommendation

Confidence

0.58

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code; funds have already moved, so hold/release do not apply.
Entity is VERIFIED, not high risk, not PEP, with no open review reasons and recent screening (2026-06-28).
Signals present (first_time, first_time_and_large, velocity) are threshold-based, not model-scored (skoor null, n=2), limiting the strength of the alert on its own.
Counterparty country is unknown, which is a gap but not evidence of wrongdoing by itself.
No prior dispositions exist to suggest a repeated pattern with this subject or counterparty, so escalation is not supported by the evidence given.

Evidence

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (286979)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
velocity.sum_24h_gt_2x_daily_avg	+10		24h sum above 2× the program daily average

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.