Alert · reviewed · open

First transfer to a new counterparty, $9,338.74, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_cxoiujocdk
Transfer: acht_sim_meri_cxoiujocdk · $9,338.74 · ach outgoing
Skoor at alert: 45 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 92bd3a0b flagged a first-time counterparty transfer of $9,338.74 via ACH debit, transfer acht_sim_meri_cxoiujocdk, opened 2026-09-17 for a transfer created 2026-09-04 that has since settled with no return code. What the evidence shows. The transfer scored 45 (review band, hard signal false) driven by three signals: first-time counterparty (+10), first-time-and-large above the program's 95th percentile of $1,361.22 (+15), and amount greater than 10x median (+20). The transfer status is SETTLED with no return code, indicating no reversal or dispute. The counterparty's country is unknown. The originating entity, Meridian Remit, is a verified business, not high risk, not PEP, last screened 2026-07-29, with no review reasons on file. Program-level KRIs show several breaches (reserve_coverage_ratio 0.648, ach_unauthorized_return_rate 0.0115, sanctioned_country_transfers=1 of 746, manual_review_aging_hours 1146.9) but none of these KRI entries reference this specific transfer or counterparty, and the counterparty country field is unknown rather than flagged as sanctioned. What was checked. Reviewed the alert evidence, transfer record, program declaration (volume, rails, countries), entity verification status, and program KRI panel. Checked for a return code (none present), for entity risk flags (none present), and for any explicit link between this transfer and the sanctioned_country_transfers or ach_unauthorized_return_rate KRI breaches (none found in the evidence provided). Checked prior dispositions (none exist for this alert). What is recommended. Close this alert. The transfer is a settled, first-time large payment from a verified, non-high-risk, non-PEP business entity, with no return code and no direct evidence tying it to the program's KRI breaches. Because the transfer has already settled, there is no pending movement to hold. The program-level KRI breaches (reserve_coverage_ratio, ach_unauthorized_return_rate, sanctioned_country_transfers, manual_review_aging_hours) are noted for separate program-level review, as they are not specific to this alert's transfer or counterparty based on the evidence given.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is SETTLED with no return code, so there is no fund movement to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-29.
Alert score (45, review band) is driven entirely by amount-based signals (first-time counterparty, amount above p95, amount >10x median), not by any adverse counterparty or entity signal.
Counterparty country is listed as unknown, not flagged as sanctioned, so no direct link to the sanctioned_country_transfers KRI breach can be established from this evidence.
Program KRI breaches (reserve_coverage_ratio, ach_unauthorized_return_rate, sanctioned_country_transfers, manual_review_aging_hours) are program-wide metrics with no field connecting them to this specific transfer or counterparty; escalation would require additional evidence linking this alert to that pattern.
Prior dispositions are none, so there is no history of repeated concern on this counterparty or entity to weigh.

Evidence

{
  "n": 871,
  "band": "review",
  "skoor": 45,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (136122)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Detail
counterparty.first_time	+10	first transfer with this counterparty
counterparty.first_time_and_large	+15	amount above the program p95 (135865)
amount.gt_10x_median	+20	amount > 10× program median (67172)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.