Transaction Risk Skoor 40 (review band) on a $854.63 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 8b9a9d34-e4e1-4f04-9774-6181c7261a72 fired on ACH outgoing transfer acht_sim_nort_6etmg951227 ($854.63, program Northwind Payroll), flagged by skoor_review at Transaction Risk Skoor 40 (review band). The triggering signal is returns.counterparty_prior_unauthorized, weight 40, based on 1 prior unauthorized return by the counterparty. The transfer itself settled with return code none. What the evidence shows. The transfer status is SETTLED with no return code, meaning this specific transaction was not returned or flagged as unauthorized. The single signal driving the skoor is a historical event tied to the counterparty (cpty_sim_nort_25c8izfo4a), not to this transaction. The debtor entity, Alder Co 00 (enti_sim_nort_ahjigjsxu), is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-05. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=274, ok) and ach_overall_return_rate at 0.0073 (n=274, ok), indicating no broader unauthorized-return pattern in the program. manual_review_aging_hours shows a breach (1434.67 hours, n=6), but this is a general program metric unrelated to the specific signal on this alert. pep_flagged_entities and high_risk_entity_share are at watch level but do not apply to this entity. What was checked. Transfer status and return code, entity verification and risk flags, program-level return-rate and risk-share KRIs, and prior dispositions (none found). The counterparty's country is listed as unknown, which limits full assessment of that party but does not change the settled, unreturned status of this transaction. What is recommended. Close the alert. The transaction settled without a return, the debtor entity is verified and low risk, and program-wide unauthorized-return metrics show no pattern beyond the single historical counterparty event already captured in the signal. No funds are pending, so hold or release do not apply. The manual_review_aging_hours breach is a separate program-level condition that should be tracked independently of this alert.

{
  "n": 734,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}