Alert · reviewed · open

The entity's first transfer, $1,676.12, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_2cdkesljcl9
Transfer: acht_sim_lant_2cdkesljcl9 · $1,676.12 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The alert fired on entity Cedar Services 314's first transfer through Lantern Lending, an outgoing ACH credit of $1,676.12, initiated 0.0 hours after the entity's identity verification completed. The amount exceeds the program's median transfer size of $1,265.56, and the detector flagged this as rapid onboarding activity. What the evidence shows. The transfer has already settled, with no return code recorded. The entity is verified, not flagged high risk, not a PEP, and has no review reasons on file; it was last screened 2026-06-20. The only signals present are the timing (0 hours since verification, against a 24-hour threshold) and a first-time counterparty flag. The transfer and entity risk scores are both unscored (band unscored, skoor null, n=12), so no model-based risk signal is available. The counterparty's country is unknown, but there is no adverse data tied to it beyond being first-time. This is the entity's only transfer on record; there are no prior dispositions to indicate a repeat pattern. What was checked. Verification status and timestamp, transfer status and return code, entity risk flags (high risk, PEP, review reasons), screening recency, counterparty history, program declared volume against transfer size, and prior dispositions for this entity or program. What is recommended. The transfer has already settled, so holding funds is not an option here. Given a verified US business entity with no high-risk or PEP flags, a clean return code, and only the expected rapid-onboarding timing signal with no corroborating adverse data, this alert does not show evidence requiring further action. Recommend closing the alert. If additional transfers from this entity or counterparty show similar rapid-onboarding patterns, that would warrant escalation at that time.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with no return code, so no funds-movement decision is pending.
Entity is VERIFIED, not high risk, not PEP, with no review reasons.
Only signals present are timing (0 hours since verification) and counterparty.first_time; both are expected artifacts of a new business relationship, not independently adverse.
Transfer and entity risk scores are unscored (skoor null, band unscored), meaning no model signal supports elevated concern, but this also means the alert carries limited quantitative backing, which caps confidence.
No prior dispositions exist for this entity, so there is no evidence of a recurring or escalating pattern.
Counterparty country is unknown, which is a data gap rather than a red flag; it does not on its own justify escalation or hold given the settled status and clean entity profile.

Evidence

{
  "n": 12,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "126556",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.