Transaction Risk Skoor 55 (review band) on a $540.09 ach transfer: returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

What happened. On 2026-08-04 transfer acht_sim_harb_ad3m3st602 moved $540.09 by ACH as an outgoing credit under Harbor Marketplace Payouts. The transfer settled with no return code. The skoor_review detector scored the transfer 55 (review band) and opened this alert on 2026-09-17, citing two signals: a prior unauthorized return from this counterparty and a counterparty country (TR) outside the program's declared country list (US only). What the evidence shows. The transfer risk skoor is 55 in the review band, driven by two weighted signals: returns.counterparty_prior_unauthorized (weight 40, one prior unauthorized return on file for this counterparty) and geo.outside_declared_countries (weight 15, counterparty located in TR, not in the program's declared US-only footprint). The transfer status is SETTLED with return code none, meaning funds already moved and there is no held transfer to act on. The receiving entity, Dune LLC 13, is verified, not high risk, not PEP, and was last screened 2026-07-02. Program KRIs show two breaches: manual_review_aging_hours at 1438 hours (n=5) and ach_unauthorized_return_rate at 0.85% (n=236), both flagged breach. Two other KRIs are at watch: pep_flagged_entities (1 of 30) and high_risk_entity_share (6.67%). Other KRIs, including sanctioned_country_transfers and stale_screening_share, are ok. There are no prior dispositions on this alert. What was checked. Reviewed the alert evidence, transfer record, program declared footprint, counterparty screening state via the linked entity, and program KRI panel. Confirmed transfer status is SETTLED with no return code, meaning this is a closed transaction rather than a pending hold. Confirmed the entity attached to the transfer is verified and not flagged high risk or PEP. Confirmed the geo signal is factual: TR is not in the program's declared countries (US only). Confirmed the KRI breaches on manual_review_aging_hours and ach_unauthorized_return_rate are program-wide figures, not specific to this single transfer, indicating this alert may not be an isolated case. What is recommended. This transfer already settled, so there is no held transfer to release. Given a program-level breach in ach_unauthorized_return_rate and a documented prior unauthorized return tied to this same counterparty, combined with a geo mismatch against the program's declared footprint, this looks like it may be part of a broader pattern rather than an isolated single-transfer issue. Recommend escalation for a person to review whether other transfers to this counterparty or other TR-based counterparties under this program show the same unauthorized-return and geo-mismatch pattern, and whether the program's declared country list needs updating or the counterparty relationship needs to be reassessed.

{
  "n": 781,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country TR not declared by the program",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}