Alert · reviewed · open
The entity's first transfer, $485.73, above the program median, came 0.0 hours after verification.
- Detector
- rapid_onboarding
- Severity
- medium
- Program
- Meridian Remit (simulated)
- Subject
- transfer acht_sim_meri_2efa0oa69rb
- Transfer
- acht_sim_meri_2efa0oa69rb · $485.73 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert d936b25a-1442-4dc9-b11a-989a7fbdb7d6 fired on the rapid_onboarding detector for transfer acht_sim_meri_2efa0oa69rb, a $485.73 outgoing ACH credit from entity Meridian Remit. The transfer is the entity's first, occurring 0.0 hours after verification, against a 24-hour threshold, and the amount is above the program median of $329.98.
What the evidence shows. The transfer is SETTLED with no return code, meaning funds have already moved and there is nothing pending to hold. The transfer skoor is unscored (n=0, confidence null), and the only listed signal is counterparty.first_time. The entity is BUSINESS, VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-05-20. The counterparty's country is unknown, but no other flags (sanctions, high-risk country, prior alerts) are present. There are no prior dispositions on this entity.
What was checked. Reviewed transfer status and return code (SETTLED, none), program declared volume and rails, entity verification and risk flags, transfer scoring band, and prior disposition history. No hard signal is set, and severity is medium rather than high.
What is recommended. Because the transfer has already settled and no hard signal, high-risk flag, or scoring data supports further concern, no fund action is possible or warranted. The single first-time-counterparty signal on a verified, non-high-risk business does not by itself indicate a pattern requiring escalation. Evidence is thin (unscored, n=0), which limits confidence, but nothing here requires a person to intervene before money moves since it already has. Recommend closing the alert, with a note to watch for a second rapid or above-median transfer from this entity that could support pattern analysis.
- Recommendation
- close
- Confidence
- 0.62
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer status is SETTLED with no return code; funds have already moved, so hold/release does not apply.
- No hard signal, entity is VERIFIED and not flagged high risk or PEP.
- Only one signal present (counterparty.first_time); scoring is unscored with n=0, indicating thin data rather than confirmed risk.
- No prior dispositions exist to suggest a broader pattern warranting escalation.
- Rapid onboarding (0 hours) and above-median first transfer are consistent with the detector's design intent but are not independently corroborated by other risk indicators in this record.
Evidence
{
"n": 0,
"band": "unscored",
"skoor": null,
"typology": "rapid_onboarding",
"confidence": null,
"thresholds": {
"hours": 24
},
"medianCents": "32998",
"routeReason": "detector not auto-closable",
"hoursSinceVerification": 0
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| counterparty.first_time | +10 | first transfer with this counterparty | |
| counterparty.first_time_and_large | +15 | amount above the program p95 (32998) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.