Alert · reviewed · open
The entity's first transfer, $721.00, above the program median, came 0.0 hours after verification.
- Detector
- rapid_onboarding
- Severity
- medium
- Program
- Meridian Remit (simulated)
- Subject
- transfer acht_sim_meri_bffhm1qv9sx
- Transfer
- acht_sim_meri_bffhm1qv9sx · $721.00 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 99117f2a-b169-4365-ad92-57e04db7eb8d fired on the rapid_onboarding detector for entity Elm Partners 216 under the Meridian Remit program. The entity's first transfer, an outgoing ACH credit of $721.00 to counterparty cpty_sim_meri_2sb9f259pv, was initiated 0.0 hours after identity verification, against a 24-hour threshold.
What the evidence shows. The transfer amount ($721.00) is above the program median of $588.15 but not extreme. The transfer has already SETTLED with no return code, so no funds are pending or held. The transfer and entity skoor are both unscored (n=8, confidence null), which reflects insufficient volume history rather than an adverse score. The entity is VERIFIED, not flagged high risk, not PEP, and has no review reasons; last screened 2026-07-06. The only contributing signal is counterparty.first_time (+10), and the counterparty's country is unknown. There are no prior dispositions on this entity, and no other alerts are referenced.
What was checked. Detector basis (time-to-first-transfer vs 24-hour threshold), transfer status and return code, program median comparison, entity verification and screening status, scoring band and confidence, and prior disposition history.
What is recommended. The transfer has already settled, so there is nothing to hold or release. The evidence shows a single first-time transfer modestly above median, from a verified, non-high-risk, non-PEP entity, with no adverse screening and no prior alert history. The unscored band reflects low transaction count, not risk. No evidence here points to a broader pattern requiring escalation. Recommend closing the alert; a reviewer may still note the unknown counterparty country for future monitoring if additional alerts accrue.
- Recommendation
- close
- Confidence
- 0.68
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer status is SETTLED with no return code; funds are not held, so hold/release do not apply.
- Entity is VERIFIED, not high risk, not PEP, with no review reasons and no prior dispositions.
- Transfer amount ($721.00) exceeds median ($588.15) but is not an extreme deviation.
- Skoor is unscored due to low transaction count (n=8), not due to an adverse signal.
- Only one contributing signal (counterparty first-time), and counterparty country is unknown but not flagged adverse.
- No prior alerts or dispositions suggest a pattern warranting escalation.
Evidence
{
"n": 8,
"band": "unscored",
"skoor": null,
"typology": "rapid_onboarding",
"confidence": null,
"thresholds": {
"hours": 24
},
"medianCents": "58815",
"routeReason": "detector not auto-closable",
"hoursSinceVerification": 0
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.