Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_skonrvy3x6
- Transfer
- acht_sim_harb_5wvskf654iz · $272.18 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 04720a9a-07aa-4d42-9015-73ecf6ffc5b9 was opened by the sanctions_or_pep detector on entity enti_sim_harb_skonrvy3x6 under the Harbor Marketplace Payouts program. The detector routes to review on every hit by design (routeReason: detector always reviewed), independent of score.
What the evidence shows. The alert skoor is 20, placing it in the clear band, and hard_signal is false. The single contributing signal is entity.high_risk (weight 20), driven by the screening system's high-risk flag on this entity. The entity record shows verification VERIFIED, pep no, review reasons none, and last screened 2026-06-26. The associated transfer (acht_sim_harb_5wvskf654iz) is a $272.18 outgoing ACH credit that has already SETTLED, with no return code. The counterparty's country is unknown but there is no sanctioned-country or unauthorized-return signal attached to this transfer.
What was checked. Entity screening status and PEP flag, transfer status and return code, transfer-level skoor and band, program KRIs, and prior dispositions. Program KRIs show pep_flagged_entities (1/30) and high_risk_entity_share (0.067) at watch level, but stale_screening_share, verification_denial_rate, frozen_accounts, and overdraft_events are all in ok range. Several KRIs (hold_aging_hours, manual_review_rate, velocity_vs_declared, sanctioned_country_transfers, and the ACH return-rate metrics) are unmeasured (n=0), limiting how far the program-level picture can be verified. No prior dispositions exist for this alert or entity.
What is recommended. No hold is warranted: the transfer has already settled, carries no return code, and the transfer-level skoor is in the clear band with no hard signal. The entity is verified, not PEP, and has no open review reasons. The watch-level KRIs (pep_flagged_entities, high_risk_entity_share) reflect a small sample size (n=30) and are not tied to any adverse finding on this specific entity or transfer. Close this alert. A person should still confirm periodically that the program-level watch KRIs do not trend further, since several related metrics remain unmeasured (n=0).
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Transfer skoor is 20, band clear, hard_signal false.
- Entity is VERIFIED, pep no, review reasons none, last screened 2026-06-26 (screening not stale per stale_screening_share=0).
- Transfer already SETTLED with no return code; nothing to hold.
- Alert routing is procedural ('detector always reviewed'), not based on an elevated score.
- Program KRIs pep_flagged_entities and high_risk_entity_share are at watch but based on small n=30 and not specifically linked to this entity's transfer activity.
- Several program KRIs are unmeasured (n=0), so confidence is not higher than 0.78 pending broader data.
Evidence
{
"n": 186,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.