Alert · reviewed · open

First transfer to a new counterparty, $2,426.27, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_6hlgtsgecoh
Transfer: acht_sim_lant_6hlgtsgecoh · $2,426.27 · ach outgoing
Skoor at alert: 25 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The detector flagged a first-time counterparty transfer of $2,426.27 on transfer acht_sim_lant_6hlgtsgecoh, an outgoing ACH debit, because the amount exceeds the program's 95th percentile threshold of $2,402.70. What the evidence shows. The transfer skoor is 25, band clear, hard_signal false, computed from n=30 with a stated confidence of 0.29. The only signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15), both expected outcomes of a new counterparty above the p95 amount. The transfer status is SETTLED with no return code, indicating no rail-level failure or reversal. The counterparty's country is unknown, but there is no other adverse data on it. The originating entity, Cedar Services 314, is VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-06-20. Prior dispositions show no history on this entity or counterparty. What was checked. Alert evidence, transfer record and status, program declared volume, entity verification and screening status, transfer skoor and signal detail, and prior disposition history. No other alerts or patterns are present in the provided context. What is recommended. Close the alert. The transfer has already settled, so holding funds is not applicable, and there is no basis to recommend release since this alert does not concern a held transfer. Nothing in the entity, counterparty, or transfer evidence indicates a need for further review beyond the detector's threshold trigger. The low sample size (n=30) and stated confidence of 0.29 mean this disposition rests on thin statistical history, which lowers certainty but does not itself justify holding a settled transfer.

Recommendation

Confidence

0.68

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Skoor band is clear and hard_signal is false.
Only signals present are first-time and first-time-large, both explained by the detector's own logic rather than independent suspicious activity.
Transfer status is SETTLED with no return code, so there is no fraud or dispute indicator from the rail.
Entity is VERIFIED, not high risk, not PEP, with no review reasons.
Counterparty country is unknown, which is a minor gap but not paired with any other adverse signal.
Sample size for the skoor (n=30) and its stated confidence (0.29) are low, which limits certainty in this disposition.

Evidence

{
  "n": 30,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (240270)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (240778)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.