Alert · reviewed · open

The entity's first transfer, $675.29, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_bmgqv5t344o
Transfer: acht_sim_harb_bmgqv5t344o · $675.29 · ach outgoing
Skoor at alert: 0 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. The rapid_onboarding detector fired on the entity's first transfer, an outgoing ACH credit of $675.29, which posted 0.0 hours after the entity's verification completed. The transfer has already settled. What the evidence shows. The transfer skoor is 0, band clear, with confidence 0.3 on n=40. The amount ($675.29) exceeds the program median ($481.55) but is not flagged as high risk. The entity is BUSINESS Alder Co 112, verification status VERIFIED, not high risk, not PEP, no review reasons, last screened 2026-06-29. The transfer status is SETTLED with no return code, so there is no unresolved return or reversal signal. Counterparty country is unknown but no sanctioned-country or high-risk-country signal is present in the evidence. Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level, but neither applies to this entity per its own record. No prior dispositions exist for this alert or entity. What was checked. Detector fields (typology, thresholds, hoursSinceVerification), transfer status and return code, entity verification/high-risk/PEP status and screening date, program declared volume and KRI panel, and prior disposition history. What is recommended. No action beyond this review. The transfer has already settled, the score band is clear, the entity is verified with no adverse flags, and the only evidence supporting the alert is a same-day first transfer above median, which the detector's own confidence (0.3) marks as weak. Nothing in the record indicates a pattern requiring escalation or a hold, and the transfer is not in a held state that would call for release.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Score band clear with skoor 0, though detector confidence is only 0.3 (thin evidentiary base).
Transfer status is SETTLED with no return code, so there is no pending movement to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and screening within the last three months.
Amount above median is the only anomaly cited; no independent corroborating signal (e.g., high-risk country, PEP, prior alerts) is present.
Program KRIs flagging pep_flagged_entities and high_risk_entity_share are at watch, but do not apply to this specific entity, so they do not support escalation on this alert.
No prior dispositions exist, so there is no pattern across alerts on this entity to escalate.

Evidence

{
  "n": 40,
  "band": "clear",
  "skoor": 0,
  "typology": "rapid_onboarding",
  "confidence": 0.3,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "48155",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.