Entity velocity spiked: 1 transfers and $2,666.30 in 24 hours.

What happened. A velocity_spike alert fired for entity enti_sim_nort_1te2fh6b2n (Fern Studio 017) under the Northwind Payroll program, citing 1 transfer totaling $2,666.30 in a 24-hour window, opened 2026-09-17T19:30:07.186Z. What the evidence shows. The only linked transfer record, acht_sim_nort_8facmus85q, is an ACH outgoing credit of $1,124.38, status SETTLED, created 2026-07-10T05:48:50.000Z. This amount and date do not match the alert summary's $2,666.30 / 24-hour figures, and no other transfer records were provided despite evidence.n listing 2. The transfer itself carries no return code and is already settled. The alert score is null (unscored band), with a single contributing signal, velocity.sum_24h_gt_2x_daily_avg, weight 10, and hard_signal is false. Route reason is only 'detector not auto-closable,' not an elevated-risk finding. What was checked. Entity enti_sim_nort_1te2fh6b2n: PERSON, verification VERIFIED, high_risk false, pep no, no review reasons, last screened 2026-06-21T11:03:38.000Z, country US. Program Northwind Payroll: declared monthly volume $2,500,000.00, rails ACH, countries US, consistent with a single $1,124.38 ACH credit. No prior dispositions exist for this alert or entity. Counterparty cpty_sim_nort_25c8izfo4a has an unknown country but no adverse flags noted. What is recommended. The evidence package is thin and internally inconsistent: the cited velocity amount and transaction count do not reconcile with the single transfer record supplied, and the transfer is already settled with no return or dispute. The entity is verified, not high-risk, not PEP, and recently screened with no review reasons. There is no basis in the evidence for holding funds (transfer is settled, not pending) or for pattern escalation (single low-weight signal, unscored). Given the entity's clean profile and the absence of any corroborating adverse signal, this alert can be closed, but the discrepancy between the alert summary and the attached transfer detail should be flagged for a person to confirm the underlying data linkage before closure is finalized.

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}