Transaction Risk Skoor 45 (hold band) on a $434.00 ach transfer: velocity.sum_24h_gt_2x_daily_avg, structuring.pattern.

What happened. An automated risk detector (skoor_hold) flagged a $434.00 outgoing ACH transfer (acht_sim_meri_bh8doszrbz6) under the Meridian Remit program. The alert fired at Skoor 45, which falls in the hold band, and carries a hard signal (structuring.pattern) with autoHold=true and routeReason 'hard signal'. What the evidence shows. Two signals contributed: velocity.sum_24h_gt_2x_daily_avg (+10, 24h sum over 2x program daily average) and structuring.pattern (+35, hard signal, described as '4 debits just under $10,000 in 24h'). The structuring signal is hard and drove the alert's routing. However, the transfer record shows status SETTLED, meaning the funds have already moved despite autoHold being set at the detector level. The counterparty country is listed as unknown. The entity (Meridian Remit, BUSINESS) is VERIFIED, not high risk, not PEP, with no open review reasons and a screening date (2026-07-29) that is not stale. Program KRIs show several breaches unrelated in isolation to this single transfer but relevant to program context: reserve_coverage_ratio (0.466, breach), manual_review_aging_hours (1146.9, breach), ach_unauthorized_return_rate (0.0113, breach), and sanctioned_country_transfers=2 (breach, n=971). Hold_aging_hours and pep_flagged_entities are at watch level. No prior dispositions exist for this alert or entity. What was checked. Reviewed the alert evidence payload, the transfer record status and counterparty details, the program's declared volume and rails, the entity's verification and screening status, and the current program KRI snapshot. Confirmed the structuring signal is hard and confirmed the transfer is already settled rather than pending or held. What is recommended. This alert should be escalated for review beyond a single-transfer disposition. The hard structuring signal (four debits just under $10,000 in 24h) indicates a pattern that this single $434.00 credit transfer does not fully explain; the underlying debit activity described in the signal detail is not present in the transfer record provided and needs to be traced. This, combined with program-level breaches in sanctioned_country_transfers, ach_unauthorized_return_rate, and reserve_coverage_ratio, suggests the issue may extend beyond this one alert. Because the transfer has already settled, there is no transfer to place on hold or release; a person should review the associated debit activity and the program KRI breaches together.

{
  "n": 886,
  "band": "hold",
  "skoor": 45,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    },
    {
      "code": "structuring.pattern",
      "hard": true,
      "detail": "4 debits just under $10,000 in 24h",
      "weight": 35
    }
  ],
  "autoHold": true,
  "confidence": 1,
  "routeReason": "hard signal"
}