Alert · reviewed · held

Transaction Risk Skoor 55 (hold band) on a $2,192.52 ach transfer: counterparty.first_time, velocity.sum_24h_gt_2x_daily_avg, structuring.pattern.

Detector: skoor_hold
Severity: high
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_8bxyn8oieeb
Transfer: acht_sim_lant_8bxyn8oieeb · $2,192.52 · ach outgoing
Skoor at alert: 55 hold
Hard signal: yes
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A $2,192.52 ACH outgoing debit from Lantern Lending to a first-time counterparty triggered a hold-band risk score of 55, driven by a hard structuring signal. What the evidence shows. The evidence lists three signals: counterparty.first_time (weight 10, first transfer with this counterparty), velocity.sum_24h_gt_2x_daily_avg (weight 10, 24h sum above 2x the program daily average), and structuring.pattern (weight 35, hard signal, detail: 4 debits just under $10,000 in 24h). The hard signal drove autoHold and routeReason 'hard signal' with confidence 1. The transfer itself is already SETTLED with no return code, meaning funds have already moved. The entity Lantern Lending is VERIFIED, not high risk, not PEP, and was screened 2026-07-23, with no review reasons on file. Counterparty country is unknown. Program KRIs are mostly within normal ranges (ach return rates near zero, reserve coverage 1.22, counterparty concentration 11%), except manual_review_aging_hours is in breach (1433.57 hours, n=8) and hold_aging_hours and pep_flagged_entities are in watch status. What was checked. Reviewed the alert evidence, transfer record, entity verification status, program KRIs, and prior dispositions. No prior dispositions exist for this alert or entity. The structuring.pattern signal describes four separate debits just under the $10,000 CTR threshold within 24 hours, which by definition implicates transactions beyond the single transfer named in this alert. What is recommended. Because the settled transfer cannot be held or released, and the hard structuring signal points to a pattern of four sub-threshold debits rather than a single isolated transaction, this warrants escalation for a person to examine the full 24-hour debit sequence, the counterparty relationship, and whether related transfers are still pending. The manual_review_aging_hours breach in program KRIs also indicates existing review backlog that should be factored into prioritization.

Recommendation

escalate

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:33Z

Rationale

Hard signal structuring.pattern (weight 35) explicitly describes 4 debits just under $10,000 in 24h, indicating a pattern spanning multiple transactions, not just this one
Transfer status is SETTLED with no return code, so 'hold' or 'release' actions on this specific transfer are not applicable per definitions given
Entity is VERIFIED, not high-risk, not PEP, with clean screening, which somewhat tempers urgency but does not resolve the structuring evidence
Program KRI manual_review_aging_hours is in breach status (1433.57 hours), suggesting existing review capacity strain relevant to how this escalation should be handled
Counterparty country is unknown, limiting full evidence on cross-border risk exposure
No prior dispositions exist to inform pattern history for this entity or counterparty

Evidence

{
  "n": 761,
  "band": "hold",
  "skoor": 55,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "4 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
velocity.sum_24h_gt_2x_daily_avg	+10		24h sum above 2× the program daily average
structuring.pattern	+35	yes	4 debits just under $10,000 in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.