Alert · reviewed · open

The entity's first transfer, $838.46, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Meridian Remit (simulated)
Subject: transfer acht_sim_meri_4cx0x8li9pv
Transfer: acht_sim_meri_4cx0x8li9pv · $838.46 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The rapid_onboarding detector fired on the entity's first transfer, an outgoing ACH credit of $838.46 to counterparty cpty_sim_meri_1ocy5o979pv, which posted 0.0 hours after identity verification. The transfer amount is above the program median of $407.86. The alert was routed to review because the detector is not auto-closable, not because of a hard signal. What the evidence shows. The transfer has already settled with no return code, so there are no funds in a held state. The entity, a person named Grove Co 218, is VERIFIED, not flagged high risk, not PEP, has no review reasons, and was last screened 2026-06-23. The transfer-level score is unscored with n=0 and no confidence value, meaning there is no prior transfer history to compare against. The only additional signal present is counterparty.first_time (+10), and the counterparty's country is listed as unknown. There are no prior dispositions on this entity or transfer. What was checked. Reviewed the alert evidence block (band, skoor, thresholds, hoursSinceVerification), the transfer record (status, amount, return code), the program declared volume and rails, the entity verification and risk flags, and prior disposition history. No hard signal is present and the transfer status is SETTLED, not held. What is recommended. Close this alert. The transfer has already settled, the entity is verified with no risk flags or review reasons, and the only elevated data point is a first-time counterparty with an unknown country, which by itself does not indicate a pattern requiring escalation. A person should note the unknown counterparty country for future screening but no fund action is possible or warranted since settlement already occurred.

Recommendation

Confidence

0.58

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED; there is no held balance to act on, so hold/release do not apply.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date.
No hard signal was raised; route reason is only 'detector not auto-closable,' not a substantive risk finding.
Transfer skoor is unscored with n=0, meaning there is no comparative history to support escalation to a broader pattern.
Counterparty country is unknown and this is a first-time counterparty, which lowers confidence slightly and should be noted but does not on its own justify escalation.
No prior dispositions exist to indicate a recurring or systemic issue with this entity or program.

Evidence

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "40786",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty
counterparty.first_time_and_large	+15		amount above the program p95 (61803)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.