Alert · reviewed · open
Entity velocity spiked: 1 transfers and $2,943.37 in 24 hours.
- Detector
- velocity_spike
- Severity
- medium
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_cb1ugjcd46
- Transfer
- acht_sim_nort_1juz487w5i · $2,272.60 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A velocity_spike alert (medium severity) was raised on entity enti_sim_nort_cb1ugjcd46 for a reported 24-hour total of $2,943.37 across 1 transfer, exceeding 2x the program's daily average.
What the evidence shows. The only transfer supplied is acht_sim_nort_1juz487w5i, an outgoing ACH credit of $2,272.60, status SETTLED, no return code, created 2026-07-09, which predates the alert open date (2026-09-17) by over two months and does not match the alert's stated $2,943.37 figure. The entity is a VERIFIED business, not flagged high risk, not PEP, with no review reasons and a screening date of 2026-06-28. The single signal present is velocity.sum_24h_gt_2x_daily_avg (weight 10); hard_signal is false and the alert/transfer scoring band is unscored (skoor null, n=0). The program's declared monthly volume is $2,500,000.00, against which a $2,943.37 24h spike is a small fraction (roughly 0.12%).
What was checked. Reviewed the alert summary and signal list, the linked transfer's status and counterparty detail, the entity's verification and risk flags, the program's declared volume, and prior dispositions (none on file). Noted the mismatch between the transfer's creation date and the alert's 24h window, and the absence of any scoring band or additional supporting transfers in the evidence provided.
What is recommended. Close the alert as a benign velocity signal. The entity is verified with no risk flags, the transfer settled cleanly with no return code, the dollar amount is immaterial against the program's declared monthly volume, and no hard signal or additional pattern is present. A person should still be aware that the transfer date does not align with the alert window and only one transfer was provided as evidence, so if additional transfers exist outside this record they were not reviewed here.
- Recommendation
- close
- Confidence
- 0.55
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity is VERIFIED, not high risk, not PEP, with no review reasons.
- hard_signal is false and only one low-weight signal (velocity.sum_24h_gt_2x_daily_avg, weight 10) is present.
- The referenced transfer settled with no return code and no adverse counterparty information beyond an unknown country.
- The alleged 24h spike ($2,943.37) is immaterial relative to the program's $2,500,000.00 declared monthly volume.
- Scoring is unscored (skoor null, n=0), and the single transfer's creation date does not match the alert's 24h window, indicating the underlying evidence is thin; this should be flagged to a reviewer rather than treated as fully resolved.
- No prior dispositions exist to indicate a recurring pattern.
Evidence
{
"n": 0,
"band": "unscored",
"skoor": null,
"signals": [
{
"code": "velocity.sum_24h_gt_2x_daily_avg",
"detail": "24h sum above 2× the program daily average",
"weight": 10
}
],
"routeReason": "detector not auto-closable"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| velocity.sum_24h_gt_2x_daily_avg | +10 | 24h sum above 2× the program daily average |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.