Alert · reviewed · open

The entity's first transfer, $2,349.46, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_b4xuquscnl
Transfer: acht_sim_lant_b4xuquscnl · $2,349.46 · ach outgoing
Skoor at alert: 0 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The system opened a rapid_onboarding alert on entity Elm Partners 316 because its first transfer, an outgoing ACH credit of $2,349.46, occurred 0.0 hours after verification and exceeded the program median transfer size of $1,635.17. The alert was routed to review because the detector is not auto-closable, not because the score indicated risk. What the evidence shows. The transfer skoor is 0 in the clear band (n=33, confidence 0.2825), and the hard_signal flag is false. The transfer acht_sim_lant_b4xuquscnl completed with no return code. The entity is VERIFIED, not flagged high risk, not PEP, has no review reasons on file, and was last screened 2026-09-03. The counterparty's country is unknown, which is a gap but not itself a risk indicator in the evidence provided. Program-level KRIs are mostly ok; two items show watch status (hold_aging_hours, pep_flagged_entities) and one shows breach (manual_review_aging_hours), but none of these are tied to this entity or this transfer in the evidence. What was checked. Reviewed the transfer status and return code, the entity's verification and screening status, the transfer skoor and its confidence/sample size, the program KRI panel for related signals, and prior dispositions on this alert (none exist). What is recommended. Close the alert. The transfer completed without a return, the score is clear, the entity carries no adverse flags, and there is no prior disposition suggesting a pattern. The counterparty country gap and the low model confidence (0.2825, n=33) are noted for the record but do not on their own justify holding funds that have already settled.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer skoor is 0, band clear, hard_signal false.
Transfer status is COMPLETED with no return code; funds are not in a state that can be held or released.
Entity is VERIFIED, not high risk, not PEP, no open review reasons, screened as recently as 2026-09-03.
Model confidence for the skoor is low (0.2825) on n=33, and counterparty country is unknown, which limits certainty but does not by itself indicate a problem.
Program KRI breaches (manual_review_aging_hours) and watch items (hold_aging_hours, pep_flagged_entities) are program-wide and not linked in the evidence to this entity or transfer, so they do not change the disposition of this specific alert.
No prior dispositions exist to suggest a recurring pattern for this entity.

Evidence

{
  "n": 33,
  "band": "clear",
  "skoor": 0,
  "typology": "rapid_onboarding",
  "confidence": 0.2825,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "163517",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.