Alert · reviewed · open

The entity's first transfer, $542.10, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_8rbf775y417
Transfer: acht_sim_harb_8rbf775y417 · $542.10 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The rapid_onboarding detector flagged the entity's first transfer, an ACH debit of $542.10, because it occurred 0.0 hours after verification and exceeds the program's median transfer amount of $463.32. What the evidence shows. The transfer acht_sim_harb_8rbf775y417 settled with no return code. The entity Harbor Marketplace Payouts is VERIFIED, not flagged high risk, not PEP, and has no review reasons on file, with last screening dated 2026-05-20. The transfer-level and entity-level skoor are both null and unscored, based on a small sample size (n=4), and confidence is null throughout. The alert has no hard signal. There are no prior dispositions on this entity. What was checked. Transfer status and return code, entity verification and risk flags, program declared volume and rails, threshold basis for the detector (24-hour window), and scoring/confidence fields at both transfer and entity level. What is recommended. The transfer has already settled with no return code and no adverse entity indicators. Scoring is unscored due to thin history (n=4), which limits confidence but does not itself indicate a problem. Given the absence of any hard signal, high-risk flag, or return code, no person needs to intervene on this specific alert. Recommend closing, noting the thin evidentiary base for future reference if similar rapid-onboarding alerts recur on this entity.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, indicating no processing or counterparty failure.
Entity is VERIFIED, not high risk, not PEP, with no open review reasons.
No hard signal on the alert.
Scoring is unscored (skoor null, n=4), which limits certainty and caps confidence rather than driving escalation.
No prior dispositions exist to suggest a recurring pattern warranting escalation.
Transfer is not in a held state, so release is not applicable.

Evidence

{
  "n": 4,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "46332",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.