Alert · reviewed · open

The entity's first transfer, $1,815.08, above the program median, came 0.0 hours after verification.

Detector: rapid_onboarding
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_60s1wfmh8a
Transfer: acht_sim_nort_60s1wfmh8a · $1,815.08 · ach outgoing
Skoor at alert: null unscored
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert f790014f-20b5-41d7-a398-6a3e295fa95d fired on rapid_onboarding detector (severity medium) for entity Heath Holdings 019 under the Northwind Payroll program. The entity's first transfer, an outgoing ACH debit of $1,815.08 to counterparty cpty_sim_nort_4o9jw7ca8a, occurred 0.0 hours after verification, which is above the program median of $1,657.12. What the evidence shows. The transfer settled with no return code. The entity is VERIFIED, not flagged high risk, not PEP, has no review reasons, and was last screened 2026-06-26. The counterparty's country is unknown and this is the counterparty's first transaction with the entity (signal: counterparty.first_time +10). The transfer-level and alert-level skoor are both null/unscored with n=2, meaning there is not yet enough transaction history for the scoring model to produce a confidence figure. Route reason is 'detector not auto-closable,' meaning this alert requires manual disposition by policy rather than because of adverse findings. There are no prior dispositions on this entity. What was checked. Verification status and screening date, high-risk/PEP flags, review reasons, transfer status and return code, counterparty history, program declared volume ($2,500,000.00/month) versus transfer size, and the alert's scoring band and confidence. What is recommended. Close the alert. The transfer has already settled with no return, the entity is verified with no adverse flags, and the only signal present (first-time counterparty) is expected for an entity's first transaction. There is no evidence in this alert of fraud, mule activity, or a broader pattern. Because scoring is unscored (n=2) and the counterparty's country is unknown, confidence is limited; a reviewer should confirm no unresolved KYC gap exists on the counterparty before closing.

Recommendation

Confidence

0.55

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Transfer status is SETTLED with return code none, so funds have already moved; a hold recommendation would not change that.
Entity is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date.
The only risk signal present is counterparty.first_time, which is inherent to any first transfer and not itself adverse.
Skoor and confidence are null with n=2, indicating insufficient transaction history for the model rather than an elevated risk score.
Route reason is a policy trigger ('detector not auto-closable'), not a specific adverse finding, supporting closure absent other evidence.
Counterparty country is unknown, which is a minor evidence gap; this lowers confidence but does not by itself justify hold or escalate.

Evidence

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "165712",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

Signal	Weight	Hard	Detail
counterparty.first_time	+10		first transfer with this counterparty

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.