Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_2eeblfvs38k · $934.65 · ach outgoing
- Skoor at alert
- 30 review
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Sanctions/PEP screening flagged entity enti_sim_nort_sr7cv2o3u for a potential PEP match, triggering review of a single outgoing ACH credit of $934.65 (transfer acht_sim_nort_2eeblfvs38k) settled on 2026-09-07 under the Northwind Payroll program.
What the evidence shows. The alert scored 30, placing it in the review band with hard_signal false. The entity is VERIFIED, marked high_risk false, has pep_potential flagged but review reasons list is empty, and was last screened 2026-09-01, sixteen days before the alert opened. The transfer is SETTLED with no return code, so no failure or reversal occurred. The signal list shows entity.pep_potential(+15) and returns.counterparty_prior_any(+15), the latter indicating a prior return history for this counterparty, but the current transfer itself carries no return code. Program-level KRIs show pep_flagged_entities at 1 of 33 (watch) and high_risk_entity_share at 6% (watch), both within a monitored but not breached range. manual_review_aging_hours is in breach (1434.7 hours, n=10), which reflects a program-wide backlog rather than evidence specific to this entity or transfer.
What was checked. Reviewed the alert evidence, transfer detail, entity verification status and screening date, program KRIs, and prior dispositions. No prior dispositions exist for this subject. No sanctioned-country transfers are recorded for the program. Counterparty country is listed as unknown, which is a gap but not itself a signal of elevated risk on this record.
What is recommended. Close the alert. The entity is verified with no open review reasons, screening is current, and the associated transfer settled without a return. The counterparty_prior_any signal warrants a note for pattern tracking but does not on its own indicate action is needed on this transfer, which has already settled and cannot be held or released.
- Recommendation
- close
- Confidence
- 0.68
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- Entity verification status is VERIFIED with high_risk=false and review_reasons=none, indicating screening did not surface a confirmed adverse match.
- Last screened date (2026-09-01) is recent relative to alert open date, so screening currency is not a concern.
- Transfer is already SETTLED with no return code; there is no pending fund movement to hold or release.
- Score of 30 sits at the review band threshold with hard_signal false, consistent with a low-severity, name-match-type flag rather than a confirmed PEP hit.
- Counterparty's unknown country and prior-return signal are noted but not corroborated by any sanctioned-country or return-rate breach at the program level.
- Program-level manual_review_aging_hours breach is a separate operational metric not tied to this specific entity or transfer and does not change the disposition of this alert.
Evidence
{
"n": 1232,
"band": "review",
"skoor": 30,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| returns.counterparty_prior_any | +15 | 1 prior return(s) other than NSF |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.