Alert · reviewed · open
Entity velocity spiked: 2 transfers and $3,952.20 in 24 hours.
- Detector
- velocity_spike
- Severity
- medium
- Program
- Lantern Lending (simulated)
- Subject
- entity enti_sim_lant_1em2vt14cii
- Transfer
- acht_sim_lant_agt2htkscnp · $558.57 · ach outgoing
- Skoor at alert
- 10 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:32Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A velocity_spike alert fired for entity enti_sim_lant_1em2vt14cii (Juniper LLC 321) under program Lantern Lending, citing 2 transfers totaling $3,952.20 in 24 hours, which exceeded 2x the program daily average.
What the evidence shows. The entity-level skoor is 10, placing it in the clear band, with hard_signal false and a single contributing signal (velocity.sum_24h_gt_2x_daily_avg, weight 10). The referenced transfer, acht_sim_lant_agt2htkscnp, is an ACH outgoing debit of $558.57 USD with status COMPLETED and no return code, so there is no held transfer to release. The entity is VERIFIED, not high risk, not PEP, has no review reasons, and was last screened 2026-08-30. Program-level KRIs are mostly within normal range: velocity_vs_declared is 0.43 (ok), sanctioned_country_transfers is 0, ach return rates are near zero, and reserve_coverage_ratio is 1.58. Two KRIs show watch or breach status (hold_aging_hours watch, manual_review_aging_hours breach), but neither is tied to this specific alert or entity in the evidence provided.
What was checked. Reviewed the alert evidence, the transfer record, the entity profile, program KRIs, and prior dispositions. No prior dispositions exist for this entity. The completed transfer shows no return code or counterparty country flag beyond 'unknown.' No PEP, high-risk, or stale screening flags apply to the entity.
What is recommended. Close the alert. The skoor is in the clear band, the sole signal is a moderate velocity trigger without corroborating high-risk indicators, the entity is verified with no adverse history, and the underlying transfer has already completed with no return. Program-level KRI breaches (manual_review_aging_hours, hold_aging_hours) are not specific to this entity and may warrant separate operational review outside this alert.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- skoor 10 in clear band with hard_signal false
- single signal (velocity spike) at weight 10, no additional corroborating signals
- entity is VERIFIED, not high risk, not PEP, no review reasons, screened recently
- transfer status is COMPLETED with no return code, so no funds are pending or held
- program velocity_vs_declared KRI is 0.43, within normal range, indicating no broader program-level anomaly
- unrelated KRI breaches (manual_review_aging_hours, hold_aging_hours) are program-wide and not linked to this specific alert or entity in the evidence
Evidence
{
"n": 35,
"band": "clear",
"skoor": 10,
"signals": [
{
"code": "velocity.sum_24h_gt_2x_daily_avg",
"detail": "24h sum above 2× the program daily average",
"weight": 10
}
],
"routeReason": "detector not auto-closable"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| velocity.sum_24h_gt_2x_daily_avg | +10 | 24h sum above 2× the program daily average |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.