Alert · reviewed · open

The entity's first transfer, $1,242.29, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_837f7yrm9sk
Transfer: acht_sim_meri_837f7yrm9sk · $1,242.29 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An automated rapid_onboarding detector flagged the entity's first transfer, an ACH outgoing credit of $1,242.29, which settled 0.0 hours after the entity's verification and is above the program's median transfer size of $568.58. What the evidence shows. The transfer acht_sim_meri_837f7yrm9sk is SETTLED with no return code, indicating it completed without rejection. The entity Grove Co 26 is VERIFIED, not flagged high risk, not PEP, has no review reasons, and was last screened 2026-07-06. The transfer and entity skoor are both unscored (n=16, confidence null), so no model-based risk signal is available. The hard_signal field is false, meaning no rule-based confirmation of wrongdoing accompanies this alert. There are no prior dispositions on this entity or transfer. What was checked. Reviewed the alert summary, transfer record (status, amount, return code, counterparty), program declared volume and rails, entity verification and screening status, and prior disposition history. No additional transaction history beyond this single transfer is present in the evidence provided. What is recommended. Because the transfer has already settled, there are no funds to hold or release. The only evidence supporting escalation is a single transfer above the program median occurring immediately after verification, which is the expected trigger condition for this detector and not itself indicative of a broader pattern given n=16 and no scoring available. No adverse entity or counterparty information is present. Recommend closing the alert, noting the thin scoring data limits certainty.

Recommendation

Confidence

0.58

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code; there is no pending transfer to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date.
hard_signal is false and skoor/band are unscored (confidence null), so no elevated risk signal is confirmed beyond the detector's trigger condition.
Single transfer above median immediately after verification is the defined trigger for rapid_onboarding and does not by itself indicate a pattern, especially with no prior dispositions.
Counterparty country is unknown, which is a data gap rather than a positive risk indicator; no other counterparty red flags are present in evidence.
Confidence is moderated because the transfer and entity risk scores are unscored, limiting the strength of the evidence base.

Evidence

{
  "n": 16,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "56858",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.