Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_4qvwmj68655 · $576.09 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An outbound ACH credit transfer of $576.09 was flagged because the counterparty entity enti_sim_harb_azbiyidj3x2 carries a potential PEP screening match. The detector routes all PEP-potential entities to review regardless of score, and this alert scored 15, which falls in the clear band with hard_signal false.
What the evidence shows. The entity is a verified PERSON, high_risk is false, and review reasons are listed as none. Last screening occurred 2026-06-25, and the program-wide stale_screening_share KRI is 0 (ok), so this entity's screening is current. The transfer itself settled with no return code, and counterparty country is unknown but there is no sanctioned_country_transfers signal tied to this alert (program KRI sanctioned_country_transfers=0, n=638, ok). The single signal present is entity.pep_potential weighted at 15, with no additional corroborating signals in the evidence block.
What was checked. I reviewed the alert score and band, the entity verification status and PEP flag, the transfer settlement status and return code, and the program KRIs for related risk indicators (sanctioned_country_transfers, stale_screening_share, high_risk_entity_share, pep_flagged_entities). The program shows pep_flagged_entities=1 of 30 (watch) and high_risk_entity_share=0.067 (watch), but these are portfolio-level metrics, not specific findings against this entity. Two KRIs show breach status: manual_review_aging_hours (1438 hours, n=5) and ach_unauthorized_return_rate (0.0109, n=638). Neither breach is linked in the evidence to this specific transfer or entity.
What is recommended. Close this alert on its own facts: the entity is verified, not flagged high risk, has no review reasons, and screening is current. The transfer is settled with no return. Separately, a person should review why manual_review_aging_hours and ach_unauthorized_return_rate are in breach at the program level, since that pattern is broader than this single alert and is not resolved by closing it.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Alert score 15 falls in the clear band with hard_signal false, per the evidence block.
- Entity is VERIFIED, high_risk false, review reasons none, and last screened 2026-06-25 with stale_screening_share KRI at 0 (ok).
- Transfer acht_sim_harb_4qvwmj68655 is SETTLED with return code none, indicating no processing exception.
- No sanctions or country-risk signal is attached to this alert; sanctioned_country_transfers KRI is 0 (ok).
- Program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not tied to this entity or transfer in the evidence, so they do not change the disposition of this specific alert but warrant separate attention.
- Prior dispositions: none, so there is no history of repeated flags on this entity to suggest an escalating pattern.
Evidence
{
"n": 826,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.