SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Entity velocity spiked: 6 transfers and $3,817.26 in 24 hours.

Detector
velocity_spike
Severity
medium
Program
Meridian Remit (simulated)
Subject
entity enti_sim_meri_4gund5k49mu
Transfer
acht_sim_meri_4rjq8a5ocem · $598.96 · ach outgoing
Skoor at alert
25 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:32Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. A velocity_spike detector fired on entity enti_sim_meri_4gund5k49mu (Birch Holdings 21) after the entity generated 6 transfers totaling $3,817.26 in 24 hours. The alert scored 25, banded clear, with hard_signal false, and was routed to review only because the detector is not auto-closable. What the evidence shows. The only contributing signal at the transfer level is velocity.count_24h_gt_5 (+10) plus a returns.counterparty_prior_any (+15) signal tied to counterparty cpty_sim_meri_x6mpxf19pv, whose country is unknown. The one sampled transfer (acht_sim_meri_4rjq8a5ocem, $598.96 ACH outgoing credit) settled with no return code. The entity is verified, not high risk, not PEP, has no review reasons, and was screened 2026-09-03. Program KRI velocity_vs_declared is 0.35 (ok), meaning this entity's activity is well within the program's declared monthly volume of $1,200,000.00. Program-level KRIs show some breaches (reserve_coverage_ratio, manual_review_aging_hours, ach_unauthorized_return_rate, sanctioned_country_transfers), but none of these are tied to this entity or this transfer in the evidence provided. What was checked. Reviewed the alert evidence, the single sampled transfer and its signals, the entity's verification and risk flags, the program's declared volume and countries, and the program KRI panel for any entity-specific linkage. No prior dispositions exist for this entity. What is recommended. No red flags attach to this entity beyond the velocity count itself, the entity is verified with no PEP or high-risk designation, the sampled transfer settled cleanly, and activity remains well under declared program volume. The program-level KRI breaches are not shown to involve this entity or this transfer, so they do not change the disposition of this specific alert. Close the alert as reviewed with no further action needed on this entity from this evidence.
Recommendation
close
Confidence
0.70
Model
claude-sonnet-5
Drafted
2026-09-17 19:32Z
Rationale
  • Alert scored 25, band clear, hard_signal false.
  • Entity is VERIFIED, not high risk, not PEP, no review reasons.
  • Sampled transfer settled with no return code.
  • velocity_vs_declared KRI is 0.35 (ok), indicating volume is within declared program limits.
  • Program-level KRI breaches (sanctioned_country_transfers, ach_unauthorized_return_rate, reserve_coverage_ratio, manual_review_aging_hours) are not linked to this entity or transfer in the evidence.
  • Only one transfer of six was provided as evidence, so confidence is limited by sample size.

Evidence

{
  "n": 1005,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "velocity.count_24h_gt_5",
      "detail": "6 transfers in 24h",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}

Skoor signals

SignalWeightHardDetail
returns.counterparty_prior_any+151 prior return(s) other than NSF
velocity.count_24h_gt_5+106 transfers in 24h

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.