Alert · reviewed · open

First transfer to a new counterparty, $756.60, above the program's 95th percentile.

Detector: first_time_counterparty_large
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_6undfbg39s0
Transfer: acht_sim_meri_6undfbg39s0 · $756.60 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A first-time counterparty transfer of $756.60 was flagged because it exceeds the program's 95th percentile threshold. The transfer (acht_sim_meri_6undfbg39s0) is an outgoing ACH debit that has already settled, with no return code recorded. What the evidence shows. The transfer carries four signals: entity.high_risk (+20), counterparty.first_time (+10), counterparty.first_time_and_large (+15), and velocity.sum_24h_gt_2x_daily_avg (+10), summing to 55 in weight, yet the transfer skoor is null and the band is unscored (n=1, confidence null). The originating entity, 'High Risk Trading 2' (enti_sim_meri_5if3mzfr9pn), is flagged high_risk=true, though it is VERIFIED, not PEP, and shows no review reasons, last screened 2026-06-26. The counterparty's country is unknown. There are no prior dispositions on this entity or counterparty in the record provided. What was checked. Alert evidence, transfer record, program profile (Meridian Remit, declared monthly volume $1,200,000.00, rails ACH/wire/SWIFT, countries US/MX/PH), entity verification status, and prior disposition history. No counterparty country, no historical transfer pattern beyond n=1, and no return code are available to assess further. What is recommended. The transfer has already settled, so it cannot be held or released. Given the combination of a high-risk entity flag, an unscored risk band despite meaningful signal weight, an unknown counterparty country, and an elevated 24h velocity signal, this warrants a person's review of the entity's broader transfer history and counterparty screening rather than closing outright.

Recommendation

escalate

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, so hold/release actions do not apply.
Entity is flagged high_risk=true despite VERIFIED status, and the transfer's own risk band is unscored despite a signal weight sum of 55, which is inconsistent and unexplained in the evidence provided.
Counterparty country is unknown and this is a first-time, above-p95 transfer, which combined with a velocity signal (sum_24h_gt_2x_daily_avg) suggests a pattern that a single alert disposition cannot fully evaluate.
No prior dispositions exist for this entity or counterparty, so there is no history to indicate this is a benign recurring pattern.
Evidence is otherwise thin (n=1, confidence null), which limits certainty and supports routing to a person rather than closing.

Evidence

{
  "n": 1,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (32998)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Detail
entity.high_risk	+20	entity marked high risk by screening
counterparty.first_time	+10	first transfer with this counterparty
velocity.sum_24h_gt_2x_daily_avg	+10	24h sum above 2× the program daily average

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.