Transaction Risk Skoor 65 (hold band) on a $9,714.50 ach transfer: amount.gt_10x_median, velocity.sum_24h_gt_2x_daily_avg, structuring.pattern.

What happened. Alert 8ee67fbd-17b2-4b74-ab9d-a65c5847025a fired on an outgoing ACH transfer (acht_sim_meri_4ycfit82cdu) of $9,714.50 tied to program Meridian Remit. The detector skoor_hold scored the transaction 65 (hold band) and triggered a hard signal for structuring, with auto-hold set. The transfer itself is already in SETTLED status; it was created 2026-09-05T13:15:53.000Z and the alert opened 2026-09-17T19:32:29.752Z. What the evidence shows. Three signals drove the score: amount.gt_10x_median (weight 20, amount exceeds 10x the program median of $674.32), velocity.sum_24h_gt_2x_daily_avg (weight 10), and structuring.pattern (weight 35, hard signal: 3 debits just under $10,000 in 24h). The structuring signal is flagged hard with confidence 1, which is why auto-hold engaged and routeReason is 'hard signal'. The transfer's own skoor matches the alert (65, hold, n=886, confidence 1). The subject entity (enti_sim_meri_zfaci2z9lw) is a verified business, not flagged high risk or PEP, last screened 2026-07-29, with no open review reasons. Counterparty country is unknown. Program-level KRIs show several breaches: reserve_coverage_ratio (0.466, breach), manual_review_aging_hours (1146.9h, breach), ach_unauthorized_return_rate (0.0113, breach), and sanctioned_country_transfers (2 of 971, breach). Hold_aging_hours and pep_flagged_entities are at watch level. There are no prior dispositions on this alert. What was checked. Reviewed the alert evidence block, the transfer record, the entity verification status, and the program KRI snapshot. Confirmed the transfer is settled, not pending, so no funds are currently held by this alert. Confirmed the structuring signal is the hard trigger and that it describes a pattern of three sub-$10,000 debits within 24 hours, consistent with threshold avoidance rather than a single anomalous transaction. Checked for prior dispositions on this alert or entity: none found. Noted that counterparty country is unrecorded, which limits sanctions-country cross-checking for this specific transfer despite the program-level sanctioned_country_transfers breach. What is recommended. The transfer has already settled, so there are no funds to hold or release on this specific alert. However, the hard structuring signal (three sub-$10,000 debits in 24h) combined with program-level breaches in sanctioned_country_transfers, ach_unauthorized_return_rate, reserve_coverage_ratio, and manual_review_aging_hours indicates a pattern that extends beyond this single transaction. This warrants review by a person to determine whether the structuring pattern reflects deliberate threshold evasion and whether related transfers or this counterparty need broader scrutiny, including a filing assessment. Recommend escalation rather than closure given the hard signal and corroborating program KRI breaches.

{
  "n": 886,
  "band": "hold",
  "skoor": 65,
  "signals": [
    {
      "code": "amount.gt_10x_median",
      "detail": "amount > 10× program median (67432)",
      "weight": 20
    },
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "3 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}