Alert · reviewed · open

Entity velocity spiked: 2 transfers and $2,630.68 in 24 hours.

Detector: velocity_spike
Severity: medium
Program: Northwind Payroll (simulated)
Subject: entity enti_sim_nort_bx5vibcw2r
Transfer: acht_sim_nort_13e9nzpm4u · $1,204.53 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A velocity_spike alert fired on entity enti_sim_nort_bx5vibcw2r (Grove Co 018) after the system recorded 2 transfers totaling $2,630.68 within 24 hours, which exceeded 2x the program's average daily volume. What the evidence shows. The only signal present is velocity.sum_24h_gt_2x_daily_avg with a weight of 10; the alert is unscored (band unscored, skoor null, n=0) and hard_signal is false. The single transfer detail provided (acht_sim_nort_13e9nzpm4u) is an outgoing ACH credit of $1,204.53, status SETTLED, with no return code and a counterparty of unknown country. The entity is a VERIFIED business, not flagged high risk, not PEP, with no review reasons, screened as recently as 2026-07-07. The program (Northwind Payroll) declares $2,500,000 in monthly volume, against which this $2,630.68 in 24-hour activity is a small fraction (about 0.1%). There are no prior dispositions on this entity. What was checked. Detector output and severity, transfer status and return code, entity verification and risk flags, program declared volume for context, and prior disposition history. No additional signals, sanctions hits, or adverse history are present in the evidence provided. What is recommended. Close the alert. The transfer has already settled with no return code, the entity is verified with no risk flags or prior issues, and the velocity spike is small relative to the program's declared monthly volume. Nothing in the evidence indicates a need for a person to intervene before funds move, since the funds have already moved and settled without incident.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Single unscored signal (velocity.sum_24h_gt_2x_daily_avg, weight 10) with hard_signal false and no corroborating signals.
Transfer status is SETTLED with no return code, so there is no pending transfer to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date.
Alert amount ($2,630.68) is negligible relative to the program's declared monthly volume ($2,500,000.00).
No prior dispositions exist to suggest a recurring or escalating pattern.
Counterparty country is unknown, which is a minor evidentiary gap but not itself a risk signal in this context, lowering confidence slightly rather than changing the recommendation.

Evidence

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
velocity.sum_24h_gt_2x_daily_avg	+10		24h sum above 2× the program daily average

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.