Alert · reviewed · open
Entity velocity spiked: 6 transfers and $3,817.26 in 24 hours.
- Detector
- velocity_spike
- Severity
- medium
- Program
- Meridian Remit (simulated)
- Subject
- entity enti_sim_meri_4gund5k49mu
- Transfer
- acht_sim_meri_4rjq8a5ocem · $598.96 · ach outgoing
- Skoor at alert
- 25 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:32Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A velocity_spike detector fired on entity enti_sim_meri_4gund5k49mu (Birch Holdings 21) after the entity generated 6 transfers totaling $3,817.26 in 24 hours. The alert scored 25, banded clear, with hard_signal false, and was routed to review only because the detector is not auto-closable.
What the evidence shows. The only contributing signal at the transfer level is velocity.count_24h_gt_5 (+10) plus a returns.counterparty_prior_any (+15) signal tied to counterparty cpty_sim_meri_x6mpxf19pv, whose country is unknown. The one sampled transfer (acht_sim_meri_4rjq8a5ocem, $598.96 ACH outgoing credit) settled with no return code. The entity is verified, not high risk, not PEP, has no review reasons, and was screened 2026-09-03. Program KRI velocity_vs_declared is 0.35 (ok), meaning this entity's activity is well within the program's declared monthly volume of $1,200,000.00. Program-level KRIs show some breaches (reserve_coverage_ratio, manual_review_aging_hours, ach_unauthorized_return_rate, sanctioned_country_transfers), but none of these are tied to this entity or this transfer in the evidence provided.
What was checked. Reviewed the alert evidence, the single sampled transfer and its signals, the entity's verification and risk flags, the program's declared volume and countries, and the program KRI panel for any entity-specific linkage. No prior dispositions exist for this entity.
What is recommended. No red flags attach to this entity beyond the velocity count itself, the entity is verified with no PEP or high-risk designation, the sampled transfer settled cleanly, and activity remains well under declared program volume. The program-level KRI breaches are not shown to involve this entity or this transfer, so they do not change the disposition of this specific alert. Close the alert as reviewed with no further action needed on this entity from this evidence.
- Recommendation
- close
- Confidence
- 0.70
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- Alert scored 25, band clear, hard_signal false.
- Entity is VERIFIED, not high risk, not PEP, no review reasons.
- Sampled transfer settled with no return code.
- velocity_vs_declared KRI is 0.35 (ok), indicating volume is within declared program limits.
- Program-level KRI breaches (sanctioned_country_transfers, ach_unauthorized_return_rate, reserve_coverage_ratio, manual_review_aging_hours) are not linked to this entity or transfer in the evidence.
- Only one transfer of six was provided as evidence, so confidence is limited by sample size.
Evidence
{
"n": 1005,
"band": "clear",
"skoor": 25,
"signals": [
{
"code": "velocity.count_24h_gt_5",
"detail": "6 transfers in 24h",
"weight": 10
}
],
"routeReason": "detector not auto-closable"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| returns.counterparty_prior_any | +15 | 1 prior return(s) other than NSF | |
| velocity.count_24h_gt_5 | +10 | 6 transfers in 24h |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.