SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Activity on an entity flagged by screening (PEP status potential).

Detector
sanctions_or_pep
Severity
high
Program
Harbor Marketplace Payouts (simulated)
Subject
entity enti_sim_harb_azbiyidj3x2
Transfer
acht_sim_harb_4qvwmj68655 · $576.09 · ach outgoing
Skoor at alert
15 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. An outbound ACH credit transfer of $576.09 was flagged because the counterparty entity enti_sim_harb_azbiyidj3x2 carries a potential PEP screening match. The detector routes all PEP-potential entities to review regardless of score, and this alert scored 15, which falls in the clear band with hard_signal false. What the evidence shows. The entity is a verified PERSON, high_risk is false, and review reasons are listed as none. Last screening occurred 2026-06-25, and the program-wide stale_screening_share KRI is 0 (ok), so this entity's screening is current. The transfer itself settled with no return code, and counterparty country is unknown but there is no sanctioned_country_transfers signal tied to this alert (program KRI sanctioned_country_transfers=0, n=638, ok). The single signal present is entity.pep_potential weighted at 15, with no additional corroborating signals in the evidence block. What was checked. I reviewed the alert score and band, the entity verification status and PEP flag, the transfer settlement status and return code, and the program KRIs for related risk indicators (sanctioned_country_transfers, stale_screening_share, high_risk_entity_share, pep_flagged_entities). The program shows pep_flagged_entities=1 of 30 (watch) and high_risk_entity_share=0.067 (watch), but these are portfolio-level metrics, not specific findings against this entity. Two KRIs show breach status: manual_review_aging_hours (1438 hours, n=5) and ach_unauthorized_return_rate (0.0109, n=638). Neither breach is linked in the evidence to this specific transfer or entity. What is recommended. Close this alert on its own facts: the entity is verified, not flagged high risk, has no review reasons, and screening is current. The transfer is settled with no return. Separately, a person should review why manual_review_aging_hours and ach_unauthorized_return_rate are in breach at the program level, since that pattern is broader than this single alert and is not resolved by closing it.
Recommendation
close
Confidence
0.72
Model
claude-sonnet-5
Drafted
2026-09-17 19:31Z
Rationale
  • Alert score 15 falls in the clear band with hard_signal false, per the evidence block.
  • Entity is VERIFIED, high_risk false, review reasons none, and last screened 2026-06-25 with stale_screening_share KRI at 0 (ok).
  • Transfer acht_sim_harb_4qvwmj68655 is SETTLED with return code none, indicating no processing exception.
  • No sanctions or country-risk signal is attached to this alert; sanctioned_country_transfers KRI is 0 (ok).
  • Program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not tied to this entity or transfer in the evidence, so they do not change the disposition of this specific alert but warrant separate attention.
  • Prior dispositions: none, so there is no history of repeated flags on this entity to suggest an escalating pattern.

Evidence

{
  "n": 826,
  "band": "clear",
  "skoor": 15,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

SignalWeightHardDetail
entity.pep_potential+15potential PEP match

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.