Alert · reviewed · open

The entity's first transfer, $3,116.55, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_nnupqlk76
Transfer: acht_sim_nort_nnupqlk76 · $3,116.55 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The rapid_onboarding detector fired on the entity's first transfer, an outgoing ACH debit of $3,116.55 that settled 0.0 hours after the entity's verification, exceeding the program's median transaction size of $1,736.10. What the evidence shows. The transfer is already SETTLED with no return code. The entity, Alder Co 024, is VERIFIED, not high risk, not PEP, with no review reasons on file and a screening date of 2026-06-20. The only signal attached to the transfer is counterparty.first_time. The transfer and entity skoor are both null/unscored (n=15, confidence null), so no scoring model has weighed in on this activity. There are no prior dispositions on this entity. What was checked. Transfer status and return code, entity verification status, risk flags (high risk, PEP, review reasons), screening recency, prior disposition history, and the detector's own threshold (24 hours) against the observed 0.0 hours since verification. All fields available in the evidence were reviewed; no external data was assumed. What is recommended. The transfer has already settled, so there is no held transaction to release or hold. The pattern is a single first-time transfer from a verified, non-high-risk business entity with no adverse screening history and no other flagged transfers. Nothing in the evidence points to a need for further review at this time, but the unscored band and null confidence mean the model has not validated this as low-risk either, so this should be closed with a note that scoring was unavailable rather than closed as fully cleared.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, so hold/release does not apply.
Entity is VERIFIED, not high risk, not PEP, with no review reasons.
No prior dispositions exist for this entity to suggest a repeating pattern.
Only one signal (counterparty.first_time) is present; no additional hard signals (hard signal: false).
Skoor and confidence are both null (unscored band), which limits certainty and is noted as a reason for lower confidence rather than a reason to escalate.
Single-transfer, single-entity evidence does not support an escalate recommendation, which requires signs of a broader pattern.

Evidence

{
  "n": 15,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "173610",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.