Transaction Risk Skoor 45 (hold band) on a $9,272.04 ach transfer: amount.gt_3x_median, structuring.pattern.

What happened. Alert 8a415ee4-318c-46ac-8797-3df399c21fd6 fired on an outgoing ACH debit of $9,272.04 from Northwind Payroll's account, transaction skoor 45 in the hold band, auto-hold flagged. The alert cites two signals: amount greater than 3x the program median, and a hard structuring signal describing three debits just under $10,000 within 24 hours. The transfer itself is already recorded as status SETTLED, created 2026-09-08, with no return code. What the evidence shows. The structuring.pattern signal is marked hard and carries the largest weight (35 of 45 points), reflecting three debits just under the $10,000 CTR threshold within a 24-hour window. The amount signal adds 10 points for exceeding 3x program median ($190,253 cents = $1,902.53, so $9,272.04 is roughly 4.9x). The transfer has already settled, so this is not a case of funds currently held pending decision. The counterparty entity's country is unknown. The subject entity, Northwind Payroll, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-17. Program-level KRIs are mostly in the 'ok' or 'watch' range, but manual_review_aging_hours shows a breach (1434.7 hours, n=13) and hold_aging_hours is at watch (518.3 hours, n=2), indicating existing backlog in manual review handling separate from this alert. What was checked. Alert evidence and signal weights, transfer status and settlement details, program declared volume against transfer size, entity verification and screening status, program-wide KRI panel, and prior dispositions (none on file for this alert). What is recommended. Because the structuring signal (three sub-$10,000 debits in 24 hours) is a hard signal suggesting a deliberate pattern rather than an isolated amount anomaly, and because the transfer has already settled so no funds can be held, this should go to a person for review of the broader debit pattern across this counterparty and entity, including whether a SAR referral is warranted. This is not a simple close given the hard signal and unknown counterparty country, and it is not a hold since the funds already moved. Release does not apply since the transfer was never held.

{
  "n": 1266,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (190253)",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "3 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}