Alert · reviewed · open

First transfer to a new counterparty, $4,018.81, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_1pei4wx30i
Transfer: acht_sim_nort_1pei4wx30i · $4,018.81 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A ach outgoing debit transfer of $4018.81 (acht_sim_nort_1pei4wx30i) on program Northwind Payroll (simulated) was flagged by detector first_time_counterparty_large: First transfer to a new counterparty, $4,018.81, above the program's 95th percentile.. What the evidence shows. Transaction Risk Skoor 25 (band clear). Signals: counterparty.first_time (+10), counterparty.first_time_and_large (+15). Entity Kestrel Partners 010: verification VERIFIED, PEP no, high risk no. What was checked. Program KRIs as of the latest snapshot: frozen_accounts ok, hold_aging_hours watch, overdraft_events ok, manual_review_rate ok, card_fraud_declines unmeasured, pep_flagged_entities watch, velocity_vs_declared ok, stale_screening_share ok, high_risk_entity_share watch, reserve_coverage_ratio ok, ach_overall_return_rate ok, verification_denial_rate ok, manual_review_aging_hours breach, ach_unauthorized_return_rate ok, sanctioned_country_transfers ok, ach_administrative_return_rate ok, counterparty_concentration_top1 ok. No prior dispositions on this entity or counterparty. What is recommended. Recommended: close. A person decides; this draft was assembled from the evidence without a model (model output did not match the schema).

Recommendation

Confidence

null (template, no model)

Model

none (template)

Drafted

2026-09-17 19:31Z

Rationale

Template draft: recommendation follows the band and the hard-signal rule only.

Evidence

{
  "n": 1152,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (379213)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (379240)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.