Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 0e8bcb80-9660-47d5-85bd-1e4dc9cff3c9 fired from the sanctions_or_pep detector on entity enti_sim_nort_91eod4q93y after an outgoing ACH debit of $1740.45 settled on 2026-08-25. The detector routes to review by policy on every trigger, regardless of score. What the evidence shows. The entity is marked high risk by screening but pep is no, verification status is VERIFIED, and review reasons are none. Last screening was 2026-08-18, 8 days before the transfer, so screening is current. The alert skoor is 20, which falls in the clear band, and hard_signal is false. The transfer itself settled normally with no return code and a counterparty in an unknown country but no sanctioned-country flag raised. Transfer-level skoor is also 20, clear band, driven solely by the entity.high_risk signal (+20), with no additional signals present. Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level (1/33 and 6.06%), which reflects portfolio composition, not activity on this specific transfer. Manual_review_aging_hours is in breach (1434.7 hours, n=8), but this is a program-level operational metric unrelated to the transaction facts in this alert. What was checked. Entity verification status, PEP status, review reasons, and screening recency were checked against the alert evidence. Transfer status, amount, rail, and return code were checked. Program-level KRIs were reviewed for corroborating patterns. Prior dispositions were checked and none exist for this alert. What is recommended. Close the alert. The entity is verified, not PEP, has no open review reasons, and was screened within the last two weeks. The triggering transfer settled without any return or sanctioned-country signal, and both the alert and transfer scores are in the clear band with no hard signal. No fact in the evidence indicates a person needs to intervene on this specific alert. The program-level manual_review_aging_hours breach should be tracked separately as an operational metric, not as grounds to hold this transfer.

{
  "n": 956,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}