Transaction Risk Skoor 40 (review band) on a $2,946.27 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 9f27c248-94d7-44a6-93a7-52852b72e040 fired on outgoing ACH transfer acht_sim_nort_5cczut9m3em, a $2,946.27 credit under program Northwind Payroll. The transfer scored 40 (review band) on the skoor_review detector due to a single signal: the counterparty (cpty_sim_nort_5a6oup6d8m) has one prior unauthorized return on record. What the evidence shows. The transfer itself is SETTLED with return code none, meaning it completed without an unauthorized return or any other return event. The originating entity, Fern Studio 05 (enti_sim_nort_aasic8tu1e), is VERIFIED, not flagged high risk, not PEP, has no open review reasons, and was screened on 2026-08-25. The alert's only signal is the counterparty's single prior unauthorized return; there is no detail on when that prior return occurred or whether it relates to this program. Program-level KRIs are mostly in the ok/watch range: ach_unauthorized_return_rate is 0.0017 (ok), ach_overall_return_rate is 0.0139 (ok), manual_review_rate is 0.0094 (ok). Two items sit outside ok: hold_aging_hours (518.3 hrs, watch, n=1) and manual_review_aging_hours (1434.7 hrs, breach, n=11), plus pep_flagged_entities and high_risk_entity_share at watch. None of these breach/watch KRIs are tied in the evidence to this specific counterparty or transfer. What was checked. Reviewed the transfer status and return code, the counterparty's flagged prior unauthorized return, the entity's verification and screening status, program declared volume and rail scope, and the full set of program KRIs for any linkage to this alert's subject. No prior dispositions exist for this alert. What is recommended. Close this alert. The transfer has already settled cleanly with no return, and the account holder is verified with no other risk indicators. The counterparty's single prior unauthorized return is noted for future monitoring but does not, on its own, indicate a problem with this settled transfer requiring a person to act on funds movement (none are pending). The manual_review_aging_hours breach is a separate program-level condition unrelated in the evidence to this specific alert and should be tracked independently, not as part of this disposition.

{
  "n": 1322,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}