Alert · reviewed · held

Transaction Risk Skoor 45 (hold band) on a $9,434.53 ach transfer: amount.gt_3x_median, structuring.pattern.

Detector: skoor_hold
Severity: high
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_4rwkpipfej1
Transfer: acht_sim_lant_4rwkpipfej1 · $9,434.53 · ach outgoing
Skoor at alert: 45 hold
Hard signal: yes
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert ba8fbb8a-c978-43a4-afbf-d196d0008ca9 fired on outgoing ACH transfer acht_sim_lant_4rwkpipfej1, a $9,434.53 debit from Lantern Lending, opened 2026-09-17T19:32:06.222Z. The transfer settled on 2026-09-11T23:22:53.000Z, before the alert was opened. Skoor Transaction Risk score is 45 (hold band), with autoHold true and a hard signal present. What the evidence shows. Two signals drove the score: amount.gt_3x_median (weight 10), noting the $9,434.53 debit is more than 3x the program median of $1,227.02, and structuring.pattern (weight 35, hard), noting two debits just under $10,000 within 24 hours. The structuring signal is marked hard and drove routing (routeReason: hard signal, confidence 1.0). The entity, Lantern Lending, is verified, not flagged high risk, not PEP, with no open review reasons, last screened 2026-07-23. Program KRIs show most metrics in the 'ok' range, but manual_review_aging_hours is in breach (1433.6 hours, n=8) and hold_aging_hours and pep_flagged_entities are in watch status. No prior dispositions exist for this entity or transfer. What was checked. Transfer status, counterparty, entity verification and screening history, program KRIs, and prior disposition history. Counterparty country is unknown and no return code is present. There is no record in this context of the second sub-$10,000 debit referenced by the structuring signal, so the pattern cannot be independently verified from the fields provided here. What is recommended. The structuring signal is a hard signal indicating two debits deliberately or coincidentally placed just under the $10,000 reporting threshold within 24 hours, which is a pattern that extends beyond this single transfer. Because the transfer has already settled, a hold on this transfer is not actionable, but the pattern warrants review beyond this alert, including the paired debit referenced in the signal detail. This should be escalated for a person to examine the full 24-hour debit pattern for this entity, given the hard structuring signal and the concurrent manual_review_aging_hours breach in program KRIs.

Recommendation

escalate

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

structuring.pattern is a hard signal (weight 35) describing two debits just under $10,000 in 24 hours, a pattern indicator rather than a single-transaction anomaly
the alert's own routeReason is 'hard signal' with detector confidence 1.0
the transfer is already SETTLED, so 'hold' or 'release' actions do not apply to this specific transfer
the entity itself shows no independent risk flags (verified, not high risk, not PEP, no review reasons), which limits confidence that this reflects entity-level bad intent versus program-level pattern needing review
program KRI manual_review_aging_hours is in breach (1433.6 hrs, n=8), suggesting review capacity constraints that support escalation rather than close
the second debit referenced in the structuring detail is not itself present in this context, so the full pattern cannot be confirmed from the evidence given, lowering confidence

Evidence

{
  "n": 752,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (122702)",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "2 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}

Skoor signals

Signal	Weight	Hard	Detail
amount.gt_3x_median	+10		amount > 3× program median (123562)
structuring.pattern	+35	yes	2 debits just under $10,000 in 24h

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.