The program's ach unauthorized return rate is 1.14% over 440 originated debits, above the 0.5% network threshold.

What happened. Alert a901856c-c765-469b-846e-afa9b1e0df71 fired on detector return_rate_breach for program 48915275-d6d2-4068-8e62-f51a51f9da77 (Meridian Remit). The program's ACH unauthorized return rate reached 1.14% (0.011363636363636364) over 440 originated debits, above the 0.5% network threshold. Severity is high, route is 'reviewed' per detector default, and there is no hard signal flag. No prior dispositions exist for this program. What the evidence shows. The unauthorized return rate KRI shows status breach at n=440, consistent with the alert summary. The same evidence snapshot shows three other KRIs in breach status for this program: reserve_coverage_ratio at 0.467 (n=440), manual_review_aging_hours at 1151.6 (n=3), and sanctioned_country_transfers at 2 (n=966). Two additional KRIs sit at watch: hold_aging_hours (1369.7 hours, n=5) and pep_flagged_entities (1, n=30). The overall ACH return rate (2.5%, n=440) and administrative return rate (0.45%, n=440) are within normal range, indicating the breach is specific to unauthorized returns rather than a broad ACH processing issue. What was checked. Reviewed the alert evidence block for the triggering KRI and threshold. Reviewed the full program KRI panel for co-occurring signals. Checked for prior dispositions on this program (none found) and for a hard signal or existing skoor band (none present, band unscored). Confirmed this alert concerns a rate metric, not a specific held transfer, so no transfer-release action applies. What is recommended. Escalate. The unauthorized return rate breach does not stand alone: it co-occurs with a reserve coverage breach, a manual review aging breach, and two sanctioned country transfers on the same program within the same evidence window. This combination points to a pattern broader than a single KRI threshold crossing and warrants review beyond this individual alert, including the underlying originator files driving unauthorized returns and the sanctioned-country transfer records.

{
  "n": 440,
  "kri": "ach_unauthorized_return_rate",
  "unit": "ratio",
  "value": 0.011363636363636364,
  "status": "breach",
  "threshold": 0.005,
  "routeReason": "detector always reviewed"
}