Alert · reviewed · held

Transaction Risk Skoor 45 (hold band) on a $9,500.00 ach transfer: amount.gt_3x_median, structuring.pattern.

Detector: skoor_hold
Severity: high
Program: Northwind Payroll (simulated)
Subject: transfer acht_sb_369a4cf950d56226
Transfer: acht_sb_369a4cf950d56226 · $9,500.00 · ach outgoing
Skoor at alert: 45 hold
Hard signal: yes
Policy: policy-v1
Opened: 2026-09-17 23:15Z
Closed: —
Decision clock: standard · due 2026-09-18 23:15Z due 2026-09-18 23:15Z
Escalated: —

Draft narrative

What happened. An ACH outgoing debit of $9,500.00 (transfer acht_sb_369a4cf950d56226) from Northwind Payroll was scored at skoor 45 (hold band) and auto-held. The alert fired on two signals: amount greater than 3x the program median, and a structuring pattern hard signal describing two debits just under $10,000 within 24 hours. What the evidence shows. The structuring signal is flagged as hard (weight 35) and is the stated reason the alert routed to review (routeReason: hard signal). The evidence detail specifies two debits just under $10,000 in a 24-hour window, which is a pattern independent of this single transfer's own verification status. The transfer itself is status INITIATED with no return code, and autoHold is true, meaning funds have not moved. The entity (Sandbox Structurer, enti_sb_b97299e172269885) is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-09-15. There are no prior dispositions on this subject. What was checked. Reviewed the alert signals and weights, the transfer record (amount, status, return code, counterparty), the entity verification and screening status, and program KRIs. Program KRIs show hold_aging_hours at watch (521.8h) and manual_review_aging_hours in breach (1438.2h), indicating the review queue is running behind, but neither KRI is specific to this alert. Other KRIs (frozen_accounts, overdraft_events, sanctioned_country_transfers, return rates) are at ok levels and do not add independent concern here. What is recommended. Hold the transfer. The hard structuring signal (two debits just under $10,000 in 24 hours) is not resolved by the entity's clean verification status and requires a person to review the underlying debit history before any release decision. The transfer is already held per autoHold, so no fund movement is pending release; a reviewer should confirm the two-debit pattern against the account's transaction history and determine whether this reflects deliberate structuring or coincidental timing before deciding to release or file.

Recommendation

hold

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 23:15Z

Rationale

Hard signal present (structuring.pattern, weight 35) with a specific factual detail (two debits just under $10,000 in 24h) that has not been reviewed by a person.
Skoor 45 falls in the hold band and autoHold is true, consistent with funds not moving pending review.
Entity verification, PEP, and high-risk flags are clean, which reduces but does not eliminate concern given the hard structuring signal itself is transaction-pattern based, not entity based.
No prior dispositions exist on this subject, so there is no history to indicate this is a resolved or recurring false positive.
Program KRI manual_review_aging_hours is in breach (1438.2h, n=13), which is a program-level condition worth noting to the reviewing team but does not change the disposition of this specific alert.
Context on the actual dates/amounts of the two structuring debits is not included in this alert payload, which limits full confidence; a person with account history access should verify the pattern directly.

Evidence

{
  "n": 1478,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (190253)",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "2 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 0.73,
  "routeReason": "hard signal"
}

Skoor signals

Signal	Weight	Hard	Detail
amount.gt_3x_median	+10		amount > 3× program median (190253)
structuring.pattern	+35	yes	2 debits just under $10,000 in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.