First transfer to a new counterparty, $3,886.85, above the program's 95th percentile.

What happened. A first-time transfer of $3,886.85 was sent via ACH debit from Northwind Payroll to a new counterparty (cpty_sim_nort_bmr5wknx4a). The detector flagged it because the amount exceeds the program's 95th percentile threshold ($2,869.79) and because it is the first transfer with this counterparty. What the evidence shows. The transfer settled with no return code, indicating the transaction cleared without dispute or rejection. The transfer-level scoring is unscored (skoor null, band unscored, n=2), so no composite risk score is available to weigh the signals. Three signals fired: counterparty.first_time (+10), counterparty.first_time_and_large (+15), and velocity.sum_24h_gt_2x_daily_avg (+10), the last of which was not mentioned in the alert summary but appears in the transfer's signal list. The paying entity, Elm Partners 016, is VERIFIED, not flagged high risk, not PEP, has no open review reasons, and was last screened on 2026-07-08, two days before the transfer. There are no prior dispositions on this entity or counterparty in the record. What was checked. Reviewed the alert evidence, the transfer record (status, amount, return code), the program's declared volume and rails, the entity's verification and screening status, and prior disposition history. No additional counterparty history, sanctions hits, or geographic risk data were present (counterparty country is listed as unknown). What is recommended. The transfer has already settled, so no funds are available to hold. The entity is verified with no risk flags and no prior alerts, and the settlement completed without a return code. The velocity signal is present but not scored or explained further in the evidence, and no corroborating pattern (e.g., multiple large first-time counterparties, repeat entity alerts) is documented. Based on the evidence provided, this alert does not show grounds for further action beyond documentation. A person should confirm there is no unscored velocity concern before closing, given the unscored band and the extra signal not covered in the summary.

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (286979)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}