Alert · reviewed · held

Transaction Risk Skoor 45 (hold band) on a $9,203.67 ach transfer: amount.gt_3x_median, structuring.pattern.

Detector: skoor_hold
Severity: high
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_3odudhhe3s0
Transfer: acht_sim_nort_3odudhhe3s0 · $9,203.67 · ach outgoing
Skoor at alert: 45 hold
Hard signal: yes
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert a51854bf-82f2-4706-aff6-11cc24a913fc fired on transfer acht_sim_nort_3odudhhe3s0, an outgoing ACH debit of $9,203.67 from Northwind Payroll (simulated). The detector skoor_hold scored the transfer 45, placing it in the hold band, with a hard signal present. The transfer status is SETTLED, meaning funds have already moved. What the evidence shows. Two signals drove the score: amount.gt_3x_median (+10), noting the transfer is more than 3 times the program median of $1,850.16, and structuring.pattern (+35, hard), noting 3 debits just under $10,000 within 24 hours. The hard signal drove routing to review regardless of score. The counterparty cpty_sim_nort_1zbzwz4t4a has an unknown country and no return code is present. The originating entity, Northwind Payroll, is VERIFIED, not flagged high risk, not PEP, and was last screened 2026-07-17, one week before the transfer was created. What was checked. Transfer status (SETTLED, no return code), entity verification and screening recency (current), and program-level KRIs. Program KRIs show ach_overall_return_rate, ach_unauthorized_return_rate, sanctioned_country_transfers, and reserve_coverage_ratio within normal range. Two KRIs are flagged: pep_flagged_entities and high_risk_entity_share are at watch level, and manual_review_aging_hours (1434.67 hours, n=6) is in breach. No prior dispositions exist for this alert. What is recommended. The transfer has already settled, so holding funds is not applicable. The hard structuring signal (3 debits just under the $10,000 reporting threshold within 24 hours) indicates a pattern that extends beyond this single transaction and warrants review of the counterparty's related debits for possible structuring activity and SAR consideration. This should go to a person; it should not be closed on the strength of entity verification alone, and it should not be treated as an isolated event given the hard signal and the program's current manual_review_aging_hours breach, which suggests review capacity constraints.

Recommendation

escalate

Confidence

0.70

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Hard signal structuring.pattern (weight 35) triggered automatic routing to review, indicating the detector treats this as high-confidence evidence of a pattern, not a single anomalous amount.
Transfer status is SETTLED; funds have already moved, so hold/release actions do not apply to this transfer.
Entity verification is current and the entity is not flagged high risk or PEP, which weighs against urgent entity-level action but does not resolve the structuring signal tied to the counterparty's transaction pattern.
Counterparty country is unknown, limiting the ability to rule out cross-border risk factors.
Program KRI manual_review_aging_hours is in breach (1434.67 hours), suggesting review backlogs that support escalating rather than routing into standard queue.
No prior dispositions exist to indicate this pattern has already been reviewed and cleared.

Evidence

{
  "n": 390,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (185016)",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "3 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 0.805,
  "routeReason": "hard signal"
}

Skoor signals

Signal	Weight	Hard	Detail
amount.gt_3x_median	+10		amount > 3× program median (185819)
structuring.pattern	+35	yes	3 debits just under $10,000 in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.