SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Entity velocity spiked: 2 transfers and $3,952.20 in 24 hours.

Detector
velocity_spike
Severity
medium
Program
Lantern Lending (simulated)
Subject
entity enti_sim_lant_1em2vt14cii
Transfer
acht_sim_lant_agt2htkscnp · $558.57 · ach outgoing
Skoor at alert
10 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:32Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. A velocity_spike alert fired for entity enti_sim_lant_1em2vt14cii (Juniper LLC 321) under program Lantern Lending, citing 2 transfers totaling $3,952.20 in 24 hours, which exceeded 2x the program daily average. What the evidence shows. The entity-level skoor is 10, placing it in the clear band, with hard_signal false and a single contributing signal (velocity.sum_24h_gt_2x_daily_avg, weight 10). The referenced transfer, acht_sim_lant_agt2htkscnp, is an ACH outgoing debit of $558.57 USD with status COMPLETED and no return code, so there is no held transfer to release. The entity is VERIFIED, not high risk, not PEP, has no review reasons, and was last screened 2026-08-30. Program-level KRIs are mostly within normal range: velocity_vs_declared is 0.43 (ok), sanctioned_country_transfers is 0, ach return rates are near zero, and reserve_coverage_ratio is 1.58. Two KRIs show watch or breach status (hold_aging_hours watch, manual_review_aging_hours breach), but neither is tied to this specific alert or entity in the evidence provided. What was checked. Reviewed the alert evidence, the transfer record, the entity profile, program KRIs, and prior dispositions. No prior dispositions exist for this entity. The completed transfer shows no return code or counterparty country flag beyond 'unknown.' No PEP, high-risk, or stale screening flags apply to the entity. What is recommended. Close the alert. The skoor is in the clear band, the sole signal is a moderate velocity trigger without corroborating high-risk indicators, the entity is verified with no adverse history, and the underlying transfer has already completed with no return. Program-level KRI breaches (manual_review_aging_hours, hold_aging_hours) are not specific to this entity and may warrant separate operational review outside this alert.
Recommendation
close
Confidence
0.72
Model
claude-sonnet-5
Drafted
2026-09-17 19:32Z
Rationale
  • skoor 10 in clear band with hard_signal false
  • single signal (velocity spike) at weight 10, no additional corroborating signals
  • entity is VERIFIED, not high risk, not PEP, no review reasons, screened recently
  • transfer status is COMPLETED with no return code, so no funds are pending or held
  • program velocity_vs_declared KRI is 0.43, within normal range, indicating no broader program-level anomaly
  • unrelated KRI breaches (manual_review_aging_hours, hold_aging_hours) are program-wide and not linked to this specific alert or entity in the evidence

Evidence

{
  "n": 35,
  "band": "clear",
  "skoor": 10,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}

Skoor signals

SignalWeightHardDetail
velocity.sum_24h_gt_2x_daily_avg+1024h sum above 2× the program daily average

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.