SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

First transfer to a new counterparty, $14,400.00, above the program's 95th percentile.

Detector
first_time_counterparty_large
Severity
medium
Program
Lantern Lending (simulated)
Subject
transfer acht_sim_lant_3bou9f5ueja
Transfer
acht_sim_lant_3bou9f5ueja · $14,400.00 · ach outgoing
Skoor at alert
60 review
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:31Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. Alert 75e7d69e flagged an outgoing ACH transfer of $14,400.00 from Lantern Lending program to a first-time counterparty, cpty_sim_lant_1gour80xeja, located in NG. The detector first_time_counterparty_large fired because the amount exceeds the program's 95th percentile ($2,497.31). The transfer settled on 2026-09-05, prior to alert review. What the evidence shows. The transfer scored 60 (band review) with four contributing signals: counterparty.first_time (+10), counterparty.first_time_and_large (+15), amount.gt_10x_median (+20), and geo.outside_declared_countries (+15). The program's declared countries are US only, but the counterparty is in NG, so this transfer falls outside the program's declared geographic scope. The originating entity, Alder Co 30, is BUSINESS-verified, not high-risk, not PEP, and was screened 2026-09-02 with no review reasons on file. Program KRIs show sanctioned_country_transfers at 0 (n=592, ok) and stale_screening_share at 0 (n=33, ok), so this does not appear tied to a broader sanctions or screening failure at the program level. However, manual_review_aging_hours is in breach (1433.56 hrs, n=6) and hold_aging_hours is at watch (1406.44 hrs, n=2), indicating reviews and holds in this program are running slow generally. What was checked. Reviewed the alert evidence, transfer record, entity verification status, program KRIs, and prior dispositions. No prior dispositions exist for this alert or entity. The transfer status is SETTLED with no return code, so funds have already moved; there is no held transfer to release. What is recommended. Because the transfer already settled, no hold or release action applies. The combination of first-time counterparty, amount over 10x median, and a transfer to a country outside the program's declared list (NG vs. declared US) is a pattern that a person should examine, particularly given the program-level breach on manual_review_aging_hours. This should be escalated for review of whether the program's declared-country scope needs updating or whether this counterparty requires further screening, rather than closed outright.
Recommendation
escalate
Confidence
0.62
Model
claude-sonnet-5
Drafted
2026-09-17 19:32Z
Rationale
  • Transfer status is SETTLED; no funds are held, so hold/release is not applicable.
  • geo.outside_declared_countries signal indicates the counterparty country (NG) falls outside the program's declared countries (US), a discrepancy not explained by any note in the evidence.
  • Amount signals (first_time_and_large, gt_10x_median) both fired independently, indicating unusual size relative to program history (n=673).
  • Entity verification is current and clean (VERIFIED, not high-risk, not PEP), which weighs against urgent escalation but does not resolve the geo-scope mismatch.
  • Program KRIs show manual_review_aging_hours in breach and hold_aging_hours at watch, suggesting review processes in this program are lagging, which supports escalation rather than closing without a person examining the country-scope question.
  • No prior dispositions exist to indicate this pattern has already been reviewed or explained.

Evidence

{
  "n": 673,
  "band": "review",
  "skoor": 60,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (249731)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

SignalWeightHardDetail
counterparty.first_time+10first transfer with this counterparty
counterparty.first_time_and_large+15amount above the program p95 (249777)
amount.gt_10x_median+20amount > 10× program median (122702)
geo.outside_declared_countries+15counterparty country NG not declared by the program

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.