Transaction Risk Skoor 35 (hold band) on a $2,118.59 ach transfer: structuring.pattern.

What happened. An alert fired on outgoing ACH credit transfer acht_sim_nort_cexzdp953at for $2,118.59, tied to entity Northwind Payroll (enti_sim_nort_c2pb9mmf0). The detector skoor_hold produced a risk score of 35, landing in the hold band, driven by a single hard signal: structuring.pattern, weighted 35, described as '3 debits just under $10,000 in 24h.' The transfer itself is already in SETTLED status. What the evidence shows. The hard signal description references 3 debits just under $10,000 each within a 24-hour window. The transfer under review is a single credit of $2,118.59, which does not match the amount or transaction type (debit) described in the signal detail. This indicates the structuring signal was likely triggered by other transactions on the entity's account, not by this specific transfer, and the alert record does not include those underlying debit transactions for verification. The transfer has already settled, so no funds are currently held pending this alert despite autoHold:true and route:reviewed. The entity is VERIFIED, not flagged high risk, not PEP, with screening dated 2026-07-17, and no prior dispositions exist for this alert. What was checked. Transfer details (amount, status, counterparty, return code), entity verification and risk flags, program KRIs, and prior dispositions. Counterparty country is unknown. Program KRIs show manual_review_aging_hours in breach (1434.69 hours) and several watch-level KRIs (hold_aging_hours, pep_flagged_entities, high_risk_entity_share), but none of these directly confirm or refute the structuring signal tied to this transfer. No underlying debit transaction records matching the '3 debits just under $10,000' description are present in this context. What is recommended. The transfer has already settled, so there are no funds to hold on this specific transaction. However, the hard structuring signal describes a pattern (three near-$10,000 debits in 24 hours) that does not match this $2,118.59 credit transfer, suggesting the underlying structuring activity involves other transactions not captured in this alert's evidence. This mismatch, combined with a hard signal and the program's breached manual_review_aging_hours KRI, warrants escalation to review the entity's full recent transaction history for the described debit pattern, rather than closing this alert on the settled transfer alone.

{
  "n": 1256,
  "band": "hold",
  "skoor": 35,
  "signals": [
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "3 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}