Alert · reviewed · held
A $2,400.00 ach transfer was initiated for an entity whose verification was denied.
- Detector
- denied_entity_activity
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- transfer acht_sim_harb_6mf9ak9b9ki
- Transfer
- acht_sim_harb_6mf9ak9b9ki · $2,400.00 · ach outgoing
- Skoor at alert
- 90 hold
- Hard signal
- yes
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A $2,400.00 outgoing ACH transfer (acht_sim_harb_6mf9ak9b9ki) was initiated under the Harbor Marketplace Payouts program for entity enti_sim_harb_130qwgg53wz, whose verification status is DENIED. The transfer has already settled.
What the evidence shows. The entity record shows verification DENIED, high risk true, and review reasons including sanctions_match, last screened 2026-06-24. The transfer-level skoor is 90 (band hold, n=954, confidence 0.7) driven by a hard signal entity.denied (+60), entity.high_risk (+20), and amount.gt_3x_median (+10), with autoHold true and routeReason 'hard signal'. Despite the hold band, the transfer status is SETTLED with no return code, meaning funds already moved before or without an effective hold being applied. Program KRIs show verification_denial_rate at 3.3% (ok, n=30), high_risk_entity_share at 6.7% (watch), pep_flagged_entities=1 (watch), manual_review_aging_hours at 1438 hours (breach), and ach_unauthorized_return_rate at 1.24% (breach). No prior dispositions exist for this alert or entity.
What was checked. Alert evidence, transfer record, entity verification record, program KRIs, and prior dispositions were reviewed. No counterparty country or additional transfer history for this entity was available in the context provided.
What is recommended. This transfer cannot be released because it is not in a held state; it has already settled. The combination of a denied-verification entity with a sanctions_match review reason and a settled ACH credit warrants escalation for a person to assess whether this indicates a broader control gap (hold not applied before settlement) and whether related transfers from this entity or program need review. The two KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) support looking beyond this single alert.
- Recommendation
- escalate
- Confidence
- 0.75
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Entity verification is DENIED with a hard signal (entity.denied, weight +60) and sanctions_match listed as a review reason.
- Transfer status is SETTLED despite the alert being routed to hold band with autoHold true, indicating the hold did not prevent settlement.
- Amount was flagged at >3x median (+10), adding to the risk score of 90 in the hold band.
- Program KRIs show two breaches (manual_review_aging_hours, ach_unauthorized_return_rate) suggesting review process delays that could be related.
- No prior dispositions exist, so this is the first review of this entity/transfer pattern.
- Context does not include counterparty country or further transaction history for this entity, limiting certainty on whether this is an isolated event or part of a pattern.
Evidence
{
"n": 954,
"band": "hold",
"skoor": 90,
"signals": [
{
"code": "entity.denied",
"hard": true,
"detail": "entity verification DENIED",
"weight": 60
}
],
"autoHold": true,
"routeReason": "hard signal"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.denied | +60 | yes | entity verification DENIED |
| entity.high_risk | +20 | entity marked high risk by screening | |
| returns.counterparty_prior_any | +15 | 1 prior return(s) other than NSF | |
| amount.gt_3x_median | +10 | amount > 3× program median (42539) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.