Alert · reviewed · open

The entity's first transfer, $1,697.96, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_7868mqi0cws
Transfer: acht_sim_lant_7868mqi0cws · $1,697.96 · ach outgoing
Skoor at alert: 0 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A rapid_onboarding alert fired on entity Dune LLC 33 (enti_sim_lant_9yb6hmwocgi) because its first transfer, an outgoing ACH credit of $1,697.96 on transfer acht_sim_lant_7868mqi0cws, occurred 0.0 hours after verification, against a 24-hour threshold, and the amount exceeds the program median of $1,329.66. What the evidence shows. The transfer is SETTLED with no return code, so no funds are currently held or reversible. The transfer-level skoor is 0, band clear, with n=112 and model confidence 0.48. The entity is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-07. Program KRIs show no frozen accounts, no overdraft events, low high-risk entity share (3.0%), low stale screening share (9.1%), and low verification denial rate (3.0%); several KRIs (velocity_vs_declared, reserve_coverage_ratio, ach return rates) are unmeasured (n=0). There are no prior dispositions on this entity. What was checked. Reviewed transfer status, return code, and settlement state; entity verification and risk flags; program-level KRIs for concentration or systemic issues; and prior disposition history. Confirmed the alert's own risk score places it in the clear band with a stated model confidence of 0.48, which is a property of the detector's evidentiary basis (n=112) rather than an indicator of elevated risk. What is recommended. Close the alert. The transfer has already settled and cannot be held or released. The entity is verified with no adverse flags, the transfer skoor is in the clear band, and no program KRI or prior disposition suggests a broader pattern. The model confidence of 0.48 reflects a modest sample size for this typology and should be noted, but nothing in the evidence calls for a person to intervene before funds move, since they have already moved.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, so hold/release actions do not apply.
Transfer skoor is 0, band clear, consistent with no elevated risk despite the rapid-onboarding trigger.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and screening current within the past year.
Program KRIs (frozen_accounts, overdraft_events, high_risk_entity_share, stale_screening_share, verification_denial_rate) are all in normal ranges.
No prior dispositions exist for this entity, and no evidence points to a pattern across other alerts.
Model confidence of 0.48 (n=112) is noted as a limitation of the detector's evidentiary base, warranting a slightly reduced confidence in this disposition rather than escalation, since no other evidence supports elevated risk.

Evidence

{
  "n": 112,
  "band": "clear",
  "skoor": 0,
  "typology": "rapid_onboarding",
  "confidence": 0.48,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "132966",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.