First transfer to a new counterparty, $770.28, above the program's 95th percentile.

What happened. A first-time counterparty transfer of $770.28 on the Harbor Marketplace Payouts program triggered the first_time_counterparty_large detector because the amount exceeded the program's 95th percentile threshold ($756.67). The alert was routed to review per the detector's standing rule (always reviewed), not due to a scored risk signal. What the evidence shows. The transfer acht_sim_harb_cbpryauy3zr is an outgoing ACH credit for $770.28 USD, status SETTLED, with no return code. The evidence block shows two signals: counterparty.first_time (weight 10) and counterparty.first_time_and_large (weight 15), consistent with the detector logic. The transfer-level signal list also includes velocity.sum_24h_gt_2x_daily_avg (weight 10), which is not explained further in the provided context. The skoor is null and the band is unscored (n=4), so no composite risk score is available. Hard signal is false. The counterparty entity, Kestrel Partners 110, is VERIFIED, not high risk, not PEP, with no review reasons on file, last screened 2026-07-05. There are no prior dispositions for this entity or transfer. What was checked. Reviewed the alert evidence, transfer record, program declared volume and rails, and the counterparty entity's verification and screening status. Checked for return codes (none) and prior dispositions (none). Confirmed the transfer status is SETTLED, meaning funds have already moved and there is no pending transfer to hold. What is recommended. The transfer is settled, the counterparty is verified with no high-risk or PEP flags, and no return code or adverse screening result is present. The amount is above the program's p95 but within the stated $4,000,000 monthly program volume and does not by itself indicate a problem. The unexplained velocity signal (sum_24h_gt_2x_daily_avg) is noted but not detailed in the evidence provided, so it cannot be independently verified; this thins the evidentiary basis for further action but does not on its own indicate a pattern requiring escalation. No prior dispositions exist to suggest a recurring issue. Close the alert; a person may still choose to review the velocity signal detail if it becomes available.

{
  "n": 4,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (75667)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}