Alert · reviewed · open

Transaction Risk Skoor 40 (review band) on a $427.04 ach transfer: returns.counterparty_prior_unauthorized.

Detector: skoor_review
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_3zig14nb545
Transfer: acht_sim_harb_3zig14nb545 · $427.04 · ach outgoing
Skoor at alert: 40 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert flagged a $427.04 ACH outgoing debit transfer (acht_sim_harb_3zig14nb545) under Harbor Marketplace Payouts for a Skoor review-band score of 40, driven solely by one signal: the counterparty has a prior unauthorized ACH return on record. What the evidence shows. The transfer itself settled with no return code (return code: none, status: SETTLED). The single contributing signal is returns.counterparty_prior_unauthorized, weighted 40, based on one prior unauthorized return by counterparty cpty_sim_harb_gzii64r41f; counterparty country is unknown. The subject entity, Juniper LLC 121, is VERIFIED, not high risk, not PEP, has no review reasons, and was screened 2026-07-01. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=72, ok) and ach_overall_return_rate at 0 (n=72, ok), so this counterparty's history is not reflected in a current program-wide return problem. One KRI, manual_review_aging_hours, is in breach (1438 hours, n=2), which points to a review-queue timing issue at the program level, not to this specific transfer. What was checked. Reviewed transfer status and return code, the single signal driving the Skoor, entity verification and screening status, and program KRI panel for corroborating patterns (return rates, sanctioned-country transfers, high-risk entity share, concentration). No prior dispositions exist for this alert. What is recommended. Close the alert. The transfer already settled with no return, the flagged entity is verified with no other risk indicators, and program-wide return-rate KRIs are at zero, giving no basis to hold or escalate this specific transfer. The manual_review_aging_hours breach is a separate program-level queue issue that should be tracked outside this alert, not resolved through this disposition.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Transfer status is SETTLED with return code none; there is no pending movement of funds to hold or release.
Sole signal (counterparty_prior_unauthorized) reflects one historical return event, not a pattern in this transfer or in program return-rate KRIs (all at 0, n=72).
Subject entity is VERIFIED, not high risk, not PEP, with no open review reasons and recent screening (2026-07-01).
Program KRI manual_review_aging_hours is in breach but is a queue-timing metric unrelated to the substance of this specific alert; it does not by itself justify holding or escalating this transfer.
Confidence is moderated because counterparty country is unknown and no detail on the prior unauthorized return (date, amount, resolution) is provided in the evidence.

Evidence

{
  "n": 388,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.97,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		2 prior unauthorized return(s)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.