Transaction Risk Skoor 40 (review band) on a $1,710.86 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert e6a78e83-d19b-405f-8e71-5bf3cd22ad89 was opened on 2026-09-17 for transfer acht_sim_nort_3e8p8tpr23d, an outgoing ACH debit of $1,710.86 under program Northwind Payroll. The detector skoor_review fired a Transaction Risk Skoor of 40 (review band, hard_signal false) on a single signal: one prior unauthorized return by the counterparty (weight 40). What the evidence shows. The transfer itself is SETTLED with return code none, meaning this specific transaction completed without an unauthorized return. The signal reflects the counterparty's history, not an outcome on this transfer. The transfer-level skoor matches the alert-level skoor (40, review band, n=771, confidence 1), and no additional signals are present. The entity behind the transfer, Grove Co 018, is VERIFIED, not high risk, not PEP, has no review reasons, and was screened 2026-07-07. Program KRIs are mostly within normal range: ach_unauthorized_return_rate is 0 (n=302, ok), ach_overall_return_rate 0.99% (ok), sanctioned_country_transfers 0 (ok), stale_screening_share 0 (ok). Two KRIs show watch-level values (pep_flagged_entities=1, high_risk_entity_share=6.06%) and one shows a breach (manual_review_aging_hours=1434.67 hours, n=7), but none of these are tied to this specific transfer or counterparty in the evidence provided. What was checked. Reviewed the alert evidence, the transfer record (status, return code, amount, dates), the entity verification status and screening history, and the program-level KRI snapshot. No prior dispositions exist for this alert. Counterparty country is listed as unknown; no further counterparty-level detail (name, other transfer history) is provided in this context. What is recommended. Close the alert. The transfer settled without a return, the entity is verified and carries no elevated risk flags, and the single signal driving the skoor is historical counterparty information rather than an outcome on this transaction. The manual_review_aging_hours breach at the program level is unrelated to this specific transfer and does not by itself indicate a pattern connected to this alert; it may warrant separate operational attention outside this disposition.

{
  "n": 762,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}