A single $9,664.70 ACH debit sits just under the $10,000 reporting threshold with no 24-hour pattern around it.

What happened. A single outgoing ACH debit of $9,664.70 from Harbor Marketplace Payouts to counterparty cpty_sim_harb_9a1a9pcv46d was flagged by the amount_just_below_threshold detector because the amount sits just under the $10,000 reporting threshold. The alert was opened 2026-09-17 for a transfer created and settled 2026-07-26. What the evidence shows. The transfer status is SETTLED with no return code. The transfer-level skoor is 20, band clear, with one contributing signal, amount.gt_10x_median(+20), confidence 0.835 on n=505. The evidence block confirms the amount ($966,470 cents) falls between the configured min ($900,000) and max ($999,999) threshold band. The summary states no 24-hour pattern of similar transfers around this one. The entity, Harbor Marketplace Payouts, is VERIFIED, not high risk, not PEP, last screened 2026-07-15, country US. Counterparty country is unknown, and there is no other adverse information on the counterparty in the record. No prior dispositions exist for this entity or transfer. What was checked. Transfer status and return code, transfer skoor and band, entity verification and risk flags, presence of a 24-hour clustering pattern, and program-level KRIs. Program KRIs are mostly within normal range: frozen_accounts, overdraft_events, ach return rates, sanctioned_country_transfers, stale_screening_share, and reserve_coverage_ratio all show 'ok'. Two KRIs show 'watch' (pep_flagged_entities 1/30, high_risk_entity_share 0.067), and one shows 'breach' (manual_review_aging_hours=1438 hours, n=2), but none of these are tied to this specific transfer or entity in the evidence provided, and the n counts are thin. What is recommended. Close the alert. The transfer is a single, already-settled ACH debit with no return, no clustering pattern, a clear-band score, and a verified low-risk entity. There is no basis in the evidence for holding funds since the transfer has already settled, and no pattern here suggests a broader typology beyond this one transaction. The program-level manual_review_aging_hours breach is noted but is based on n=2 and not connected to this alert's subject; it should be tracked separately at the program level rather than driving this disposition.

{
  "n": 505,
  "band": "clear",
  "skoor": 20,
  "typology": "amount_just_below_threshold",
  "confidence": 0.835,
  "thresholds": {
    "maxCents": "999999",
    "minCents": "900000"
  },
  "amountCents": "966470",
  "routeReason": "detector not auto-closable"
}