Alert · reviewed · open

The entity's first transfer, $2,107.92, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_86uo8xie8m
Transfer: acht_sim_nort_86uo8xie8m · $2,107.92 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The alert fired on the rapid_onboarding detector for entity Cedar Services 026 under program Northwind Payroll. The entity's first transfer, an ACH outgoing debit of $2,107.92, settled 0.0 hours after verification, which is above the detector's 24-hour threshold and above the program median transfer of $2,006.09. What the evidence shows. The transfer acht_sim_nort_86uo8xie8m is already in SETTLED status with no return code, so no funds are currently held. The entity is VERIFIED, not flagged high risk, not PEP, and has no review reasons on file. The only signal attached to the transfer is counterparty.first_time(+10), which is expected on any entity's first transfer. The transfer skoor is null with band unscored and n=15, meaning the scoring model did not have enough data to produce a confidence-rated score. There are no prior dispositions on this entity. What was checked. I checked the transfer status and return code, the entity's verification, risk, and PEP flags, the program's declared volume and rails, the signal list attached to the transfer, and the scoring band and sample size. I also checked for prior dispositions, of which there are none. What is recommended. Because the transfer has already settled, there is nothing to hold. The entity is verified with no risk flags, and the only elevated indicator is the timing pattern intrinsic to the rapid_onboarding detector itself, which is not corroborated by any independent risk signal. The evidence is thin (unscored, small sample), so this should be closed with the sample-size limitation noted rather than treated as a confirmed low-risk case.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code; there are no funds to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons.
Only attached signal is counterparty.first_time(+10), which is inherent to any first transfer and not a distinct risk indicator.
Transfer amount ($2,107.92) is only modestly above the program median ($2,006.09), not a large outlier.
Skoor is null/unscored with n=15, indicating limited data; this lowers confidence but does not by itself justify escalation absent other evidence.
No prior dispositions or pattern across multiple alerts exist to support escalation.

Evidence

{
  "n": 15,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "200609",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.