Alert · reviewed · held

Transaction Risk Skoor 75 (hold band) on a $493.22 ach transfer: entity.high_risk, returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

Detector: skoor_hold
Severity: high
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_56ewy3mr65h
Transfer: acht_sim_harb_56ewy3mr65h · $493.22 · ach outgoing
Skoor at alert: 75 hold
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An ACH outgoing credit of $493.22 to counterparty cpty_sim_harb_7nn77rms57g (TR) triggered detector skoor_hold with a Transaction Risk Skoor of 75, placing it in the hold band. The transfer was created 2026-08-04T21:28:09.000Z and has since settled. Three signals fired: entity.high_risk (weight 20), returns.counterparty_prior_unauthorized (weight 40, one prior unauthorized return), and geo.outside_declared_countries (weight 15, counterparty country TR is not in the program's declared country list of US only). What the evidence shows. The transfer status is SETTLED, meaning funds have already moved; there is no pending hold to release. The entity, High Risk Trading 1, is VERIFIED but flagged high_risk with no open review reasons and last screened 2026-06-26. Program KRIs show two breaches: manual_review_aging_hours at 1438.03 hours (n=5) and ach_unauthorized_return_rate at 0.85% (n=236), both flagged breach. high_risk_entity_share (6.7%, n=30) and pep_flagged_entities (1, n=30) are flagged watch. The transfer's counterparty country (TR) falls outside the program's declared operating countries (US only), which is a program-scope discrepancy rather than a single-transfer anomaly. What was checked. Reviewed the alert evidence payload, the transfer record, the program declaration, the entity record, and the program KRI panel. No prior dispositions exist for this alert. Confidence field on the skoor evidence is 0.895 (n=791). No hard signal was present (hard signal: false), and autoHold is true in the evidence though the transfer itself already shows SETTLED status, meaning the hold did not prevent settlement or this alert is being reviewed after the fact. What is recommended. Because the transfer has already settled, there are no funds to hold or release on this specific transfer; a person should review whether the settlement occurred despite the hold band and whether recovery or counterparty offboarding action is warranted given the prior unauthorized return and current geo-scope mismatch. Separately, the combination of a breach-level ach_unauthorized_return_rate, a breach-level manual_review_aging_hours, and a transfer to a country outside the program's declared footprint indicates a pattern that extends beyond this single alert and should be escalated for program-level review, including whether TR-country activity is occurring elsewhere in the portfolio and whether declared countries need updating or enforcement.

Recommendation

escalate

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Transfer status is SETTLED; recommendation cannot be 'release' since that applies only to transfers already held, and there is no evidence of an active hold state on this transfer despite autoHold:true in the evidence.
Skoor 75 sits in the hold band with three converging signals (high risk entity, prior unauthorized return, undeclared country), which under normal handling would warrant a hold, but the settlement fact changes the disposition need to after-the-fact review rather than fund control.
Program KRI panel shows two breach-level metrics (manual_review_aging_hours=1438.03h, ach_unauthorized_return_rate=0.85%) concurrent with this alert, suggesting the underlying issue (unauthorized returns, review backlog) is broader than one transfer.
Program declares countries as US only, but the counterparty is in TR; this is a program-scope mismatch, not merely a transaction-level flag, supporting escalation over closure.
Entity is VERIFIED with no open review reasons, and pep is 'no', which limits the case for treating this as a fresh, isolated finding on the entity itself.
Confidence is moderate (0.62) because context does not explain why an autoHold transfer nonetheless settled, and this gap should be clarified by a person before final closure.

Evidence

{
  "n": 791,
  "band": "hold",
  "skoor": 75,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    },
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country TR not declared by the program",
      "weight": 15
    }
  ],
  "autoHold": true,
  "confidence": 0.895,
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Detail
entity.high_risk	+20	entity marked high risk by screening
returns.counterparty_prior_unauthorized	+40	1 prior unauthorized return(s)
geo.outside_declared_countries	+15	counterparty country TR not declared by the program

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.