Entity velocity spiked: 1 transfers and $1,790.97 in 24 hours.

What happened. A velocity_spike alert (medium severity) fired for entity enti_sim_lant_iciax8tcgm on 2026-09-17, reporting 1 transfer totaling $1,790.97 in a 24-hour window that exceeded twice the program's daily average. What the evidence shows. The only transfer record supplied is acht_sim_lant_c6sr48zeclx, an outgoing ACH credit of $2,017.89, completed, with no return code and counterparty country unknown. This amount does not match the $1,790.97 cited in the alert summary, which is a discrepancy in the evidence provided. The entity is a verified PERSON, not flagged high risk, not PEP, with no open review reasons and a screening date of 2026-09-03 (14 days before the alert). The transfer and entity skoor are both null/unscored (n=18), and the alert carries a single weak signal (velocity.sum_24h_gt_2x_daily_avg, weight 10) with no hard signal. Program-level KRIs are mostly within normal range (return rates, sanctioned-country transfers, concentration, verification denial rate all ok), except manual_review_aging_hours (1433.6h, n=8, breach) and hold_aging_hours (1406.4h, n=3, watch), which reflect a program-wide backlog rather than anything specific to this entity or transfer. What was checked. Reviewed the alert evidence, the single transfer tied to the entity, the entity's verification and risk-screening status, program declared volume against the transfer size, and program KRIs for corroborating signals of broader risk (sanctioned-country exposure, return rates, PEP share, high-risk entity share). No prior dispositions exist for this entity or alert. What is recommended. Close the alert. The entity is verified, not high-risk, not PEP, recently screened, and the only signal is a single weak velocity trigger with no hard signal and no adverse transfer outcome (completed, no return code). The transfer amount discrepancy in the alert summary should be corrected in the detector data but does not itself indicate risk requiring a hold. The program-level manual_review_aging_hours breach is not attributable to this alert and should be tracked separately as an operational backlog issue, not as grounds to hold this transfer.

{
  "n": 18,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}