Alert · reviewed · open

The entity's first transfer, $1,032.26, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_4m9ppdb39qb
Transfer: acht_sim_meri_4m9ppdb39qb · $1,032.26 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An alert fired on transfer acht_sim_meri_4m9ppdb39qb under the rapid_onboarding detector. The entity Kestrel Partners 210 completed its first transfer, $1,032.26, 0.0 hours after verification, which is above the program's median transfer amount of $605.13. What the evidence shows. The transfer is ACH outgoing, status SETTLED, with no return code. The only signal present is amount.gt_3x_median, contributing +10 to an otherwise unscored profile (band unscored, skoor null, n=1, confidence null). The entity is BUSINESS type, VERIFIED, not high risk, not PEP, with no review reasons on file, last screened 2026-07-06. Counterparty country is unknown but no other flags are attached to it. There are no prior dispositions for this entity. What was checked. Transfer status and return code, entity verification and risk flags, program median comparison, detector thresholds (24 hours), and prior disposition history. All fields reviewed trace directly to the alert and linked entity/transfer records; no external information was used. What is recommended. The transfer has already settled, so no funds are pending action. The entity is verified with no risk flags, no PEP status, and no review reasons. The single elevated-amount signal is consistent with the rapid_onboarding detector's design (first transfer shortly after verification) and does not by itself indicate a pattern requiring escalation. This alert can be closed. If a second alert on this entity or counterparty follows, it should be reviewed jointly given the unknown counterparty country.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, so there is no fund movement to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons, per the ENTITY record.
Only one signal (amount.gt_3x_median) is present; band is unscored with n=1, indicating thin evidence rather than a confirmed risk pattern.
No prior dispositions exist for this entity, so there is no historical pattern to support escalation.
Counterparty country is unknown, which is a gap but not itself a red flag absent other signals; noted for awareness rather than escalation.

Evidence

{
  "n": 1,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "60513",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.