Transaction Risk Skoor 55 (hold band) on a $9,526.72 ach transfer: amount.gt_10x_median, structuring.pattern.

What happened. Alert 9353d846-a8aa-46ca-8306-a51e4ce0aa4c was generated by the skoor_hold detector on outgoing ACH transfer acht_sim_harb_323d3hwi9k0, a $9,526.72 debit under the Harbor Marketplace Payouts program. The transfer risk skoor was 55, placing it in the hold band, with a hard signal present. The transfer had already settled by the time the alert was reviewed. What the evidence shows. The evidence lists two signals: amount.gt_10x_median (weight 20), noting the transfer amount exceeds 10x the program median of $422.08, and structuring.pattern (weight 35, hard), noting three debits just under $10,000 within a 24-hour window. The hard signal drove routing via routeReason 'hard signal' with confidence 1. The transfer status is SETTLED, meaning the funds have already moved; there is no indication in the record that this transfer was held before settlement. The counterparty cpty_sim_harb_58yvbmu875m has an unknown country and no return code was posted. The entity Harbor Marketplace Payouts is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-15. What was checked. I reviewed the transfer record, the entity verification status, and program-level KRIs. Program KRIs show most metrics in the ok or watch range, but two are in breach: manual_review_aging_hours (1438.05, n=18) and ach_unauthorized_return_rate (0.00899, n=890). Velocity vs declared volume is 0.136 (ok), counterparty concentration top1 is 0.071 (ok), and sanctioned_country_transfers is 0. Prior dispositions for this alert: none. Nothing in the evidence explains the structuring pattern (three near-$10,000 debits in 24h) beyond the flag itself; no supporting detail on the other two debits (amounts, dates, counterparties) is included in this record. What is recommended. The transfer has already settled, so a hold on these funds is not actionable through this alert. However, the hard structuring signal (three debits just under $10,000 in 24 hours) indicates a pattern that extends beyond this single transaction and is not fully explained by the data provided. This should be escalated for review of the related debits and the counterparty, particularly given the concurrent program-level breach in manual_review_aging_hours, which suggests review backlogs elsewhere in the program.

{
  "n": 1927,
  "band": "hold",
  "skoor": 55,
  "signals": [
    {
      "code": "amount.gt_10x_median",
      "detail": "amount > 10× program median (42208)",
      "weight": 20
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "3 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}