Transaction Risk Skoor 100 (hold band) on a $2,400.00 ach transfer: entity.denied, returns.counterparty_prior_unauthorized, amount.gt_3x_median.

What happened. Alert c7cec36f fired on an outgoing ACH transfer of $2,400.00 (acht_sim_meri_6r6oon2pcdx) under program Meridian Remit. The transfer skoor reached 100 (hold band) driven by a hard signal: entity verification DENIED, plus a prior unauthorized return on the counterparty and an amount over 3x the program median ($664.57). The transfer's current status is RETURNED with code R05 (unauthorized). What the evidence shows. The originating entity (enti_sim_meri_3qusu9s29pg, "Denied Origin 2") failed verification with review reason sanctions_match, last screened 2026-06-24. This is flagged as a hard signal (weight 60) and alone justifies the hold band. The counterparty has one prior unauthorized return, and this transfer itself returned as R05 (unauthorized), consistent with that history. The amount is roughly 3.6x the program's median transaction size. Confidence on the skoor model is 0.70 with n=755, an adequate sample. What was checked. Program KRIs were reviewed alongside the alert. Three are in breach: sanctioned_country_transfers=1 (n=746), reserve_coverage_ratio=0.648 (n=347), and ach_unauthorized_return_rate=0.0115 (n=347). manual_review_aging_hours=1146.9 (n=2) is also in breach. pep_flagged_entities=1 (n=30) and hold_aging_hours=1364.97 (n=4) are in watch status. Other KRIs (frozen_accounts, overdraft_events, manual_review_rate, velocity_vs_declared, stale_screening_share, high_risk_entity_share, verification_denial_rate, ach_overall_return_rate, ach_administrative_return_rate, counterparty_concentration_top1) are within normal range. No prior dispositions exist for this alert or entity in the record provided. What is recommended. The transfer itself has already returned (R05), so there are no funds in transit to hold or release on this alert. The entity-level finding is the material issue: verification denied for sanctions_match is a hard signal that, combined with a program-level sanctioned_country_transfers breach and a prior unauthorized return on this same counterparty, points to a pattern beyond this single transaction. This should go to a person for entity-level review (sanctions disposition, potential counterparty-wide restriction) rather than be closed at the transaction level.

{
  "n": 755,
  "band": "hold",
  "skoor": 100,
  "signals": [
    {
      "code": "entity.denied",
      "hard": true,
      "detail": "entity verification DENIED",
      "weight": 60
    },
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "amount.gt_3x_median",
      "detail": "amount > 3× program median (66457)",
      "weight": 10
    }
  ],
  "autoHold": true,
  "confidence": 0.7,
  "routeReason": "hard signal"
}