Alert · reviewed · open

First transfer to a new counterparty, $872.85, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_2glirj2t7c4
Transfer: acht_sim_harb_2glirj2t7c4 · $872.85 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time ACH outgoing transfer of $872.85 to a new counterparty was flagged because the amount exceeded the program's 95th percentile threshold ($849.27) for a first-time counterparty relationship. What the evidence shows. The transfer skoor is 25, placing it in the 'clear' band with confidence 1.0 across a sample of 1,320 transfers. The only signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both expected for this detector type. Hard signal is false. The transfer status is SETTLED with no return code, indicating no reversal or dispute. The subject entity, Dune LLC 13, is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-02. The counterparty's country is unknown, but no sanctioned-country or geographic risk signal fired on this alert. What was checked. Reviewed the transfer record, skoor evidence, entity verification and screening status, and program KRIs. Program KRIs show two breach-level metrics not tied to this alert: manual_review_aging_hours (1438.0 hours, n=8) and ach_unauthorized_return_rate (0.0104, n=479). Neither KRI references this counterparty, this entity, or this transfer specifically. No prior dispositions exist for this alert or related entities. What is recommended. Close the alert. The evidence is limited to expected first-time-large signals within a clear-band score, the transfer has already settled without a return, and the subject entity is verified with no risk flags. The two KRI breaches are program-wide and not connected to this specific transfer or counterparty in the evidence provided; they do not on their own support escalation of this alert.

Recommendation

Confidence

0.78

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Skoor band is 'clear' with confidence 1.0 (n=1320); hard signal is false.
Only signals present are first_time and first_time_and_large, which are the detector's expected triggers, not independent risk indicators.
Transfer status is SETTLED with return code none, so there is no pending fund movement to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and screening within the past two months.
Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not linked in the evidence to this transfer, counterparty, or entity, so they do not support escalation of this specific alert.
No prior dispositions exist to indicate a repeat pattern for this entity or counterparty.

Evidence

{
  "n": 1320,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (84927)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (84926)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.