First transfer to a new counterparty, $485.73, above the program's 95th percentile.

What happened. A first-time ACH credit transfer of $485.73 to a new counterparty (cpty_sim_meri_8e7x9pk09pv) was flagged because the amount exceeds the program's 95th percentile ($329.98) for first-time counterparties, per the first_time_counterparty_large detector. What the evidence shows. The transfer acht_sim_meri_2efa0oa69rb is an outgoing ACH credit of $485.73 USD, status COMPLETED, with no return code. The only signals present are counterparty.first_time (+10) and counterparty.first_time_and_large (+15); skoor is unscored (band unscored, n=1, confidence null). The originating entity, Meridian Remit, is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date (2026-07-29). The counterparty's country is unknown, but no sanctioned-country or high-risk flag is attached to this specific transfer. What was checked. Transfer status and return code (COMPLETED, none), entity verification and risk flags (verified, not high risk, no PEP), program KRIs for context. Program-level KRIs show breaches in reserve_coverage_ratio, ach_unauthorized_return_rate, and sanctioned_country_transfers (n=815), and watch-level flags on hold_aging_hours and manual_review_aging_hours, and pep_flagged_entities. None of these program-level metrics are tied to this specific transfer or counterparty in the evidence provided. Prior dispositions: none. What is recommended. Close this alert. The transfer has already completed with no return, the originating entity is verified with no adverse flags, and the only signals are a first-time counterparty and an amount above the program's 95th percentile, which the program's own detector always routes for review regardless of severity. There is no evidence here indicating fraud, sanctions exposure, or a pattern specific to this counterparty or entity. The program-level KRI breaches (reserve coverage, unauthorized returns, sanctioned-country transfers) are noted but are aggregate metrics not linked to this alert's transfer or counterparty, and warrant separate program-level review rather than action on this alert.

{
  "n": 1,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "counterparty.first_time",
      "detail": "first transfer with this counterparty",
      "weight": 10
    },
    {
      "code": "counterparty.first_time_and_large",
      "detail": "amount above the program p95 (32998)",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}