Transaction Risk Skoor 55 (hold band) on a $9,151.01 ach transfer: amount.gt_10x_median, structuring.pattern.

What happened. Alert aea18f4d-b942-4513-86ac-b70ba9c74167 fired on outgoing ACH transfer acht_sim_harb_89wj4vha9jx for $9,151.01 from Harbor Marketplace Payouts. The detector skoor_hold placed the transaction in the hold band at skoor 55 with a hard signal present, and routing occurred because of that hard signal. What the evidence shows. Two signals drove the score: amount.gt_10x_median (weight 20), noting the transfer is more than 10 times the program median of $422.98, and structuring.pattern (weight 35, hard), noting two debits just under $10,000 within 24 hours. The transfer itself shows status SETTLED with no return code, meaning the funds have already moved. The entity, Harbor Marketplace Payouts, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-15. Program KRIs show two breaches: manual_review_aging_hours (1438.05, n=18) and ach_unauthorized_return_rate (0.00899, n=890), alongside several signals in watch status (hold_aging_hours, overdraft_events, card_fraud_declines, pep_flagged_entities, high_risk_entity_share). Prior dispositions for this alert: none. What was checked. Reviewed the alert evidence block, the transfer record, the program record, the entity verification status, and the program KRI panel. Confirmed the transfer status is SETTLED, not pending or held, so no funds are currently stoppable on this alert. Confirmed the structuring signal is hard and independently sufficient for hold-band routing. Checked for prior dispositions on this alert; found none. What is recommended. Because the transfer has already settled, there is nothing to hold or release on this specific transaction. The hard structuring signal (two debits just under $10,000 in 24 hours) combined with an amount far above program median indicates a pattern that a single alert does not fully capture. This should go to a person to review the counterparty's full transfer history for a structuring pattern across multiple transactions, particularly given the concurrent KRI breaches in manual_review_aging_hours and ach_unauthorized_return_rate, which suggest review capacity and return-handling issues in the same program.

{
  "n": 1915,
  "band": "hold",
  "skoor": 55,
  "signals": [
    {
      "code": "amount.gt_10x_median",
      "detail": "amount > 10× program median (42298)",
      "weight": 20
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "2 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}