SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

The entity's first transfer, $485.73, above the program median, came 0.0 hours after verification.

Detector
rapid_onboarding
Severity
medium
Program
Meridian Remit (simulated)
Subject
transfer acht_sim_meri_2efa0oa69rb
Transfer
acht_sim_meri_2efa0oa69rb · $485.73 · ach outgoing
Skoor at alert
null unscored
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. Alert d936b25a-1442-4dc9-b11a-989a7fbdb7d6 fired on the rapid_onboarding detector for transfer acht_sim_meri_2efa0oa69rb, a $485.73 outgoing ACH credit from entity Meridian Remit. The transfer is the entity's first, occurring 0.0 hours after verification, against a 24-hour threshold, and the amount is above the program median of $329.98. What the evidence shows. The transfer is SETTLED with no return code, meaning funds have already moved and there is nothing pending to hold. The transfer skoor is unscored (n=0, confidence null), and the only listed signal is counterparty.first_time. The entity is BUSINESS, VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-05-20. The counterparty's country is unknown, but no other flags (sanctions, high-risk country, prior alerts) are present. There are no prior dispositions on this entity. What was checked. Reviewed transfer status and return code (SETTLED, none), program declared volume and rails, entity verification and risk flags, transfer scoring band, and prior disposition history. No hard signal is set, and severity is medium rather than high. What is recommended. Because the transfer has already settled and no hard signal, high-risk flag, or scoring data supports further concern, no fund action is possible or warranted. The single first-time-counterparty signal on a verified, non-high-risk business does not by itself indicate a pattern requiring escalation. Evidence is thin (unscored, n=0), which limits confidence, but nothing here requires a person to intervene before money moves since it already has. Recommend closing the alert, with a note to watch for a second rapid or above-median transfer from this entity that could support pattern analysis.
Recommendation
close
Confidence
0.62
Model
claude-sonnet-5
Drafted
2026-09-17 19:30Z
Rationale
  • Transfer status is SETTLED with no return code; funds have already moved, so hold/release does not apply.
  • No hard signal, entity is VERIFIED and not flagged high risk or PEP.
  • Only one signal present (counterparty.first_time); scoring is unscored with n=0, indicating thin data rather than confirmed risk.
  • No prior dispositions exist to suggest a broader pattern warranting escalation.
  • Rapid onboarding (0 hours) and above-median first transfer are consistent with the detector's design intent but are not independently corroborated by other risk indicators in this record.

Evidence

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "32998",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

SignalWeightHardDetail
counterparty.first_time+10first transfer with this counterparty
counterparty.first_time_and_large+15amount above the program p95 (32998)

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.