Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 0f2ea6bb-8dc1-4947-8b4c-e377d19b631a was opened on 2026-09-17 for entity enti_sim_lant_6uvwvng8cjh under the sanctions_or_pep detector, following screening that marked the entity high risk. The alert scored 30 (review band, hard_signal false) and was routed for review because the detector is always reviewed. The linked transfer is acht_sim_lant_1ndaab0bdg2, an outgoing ACH debit of $881.78 USD, created 2026-08-09 and already SETTLED with no return code. What the evidence shows. The entity is a verified US business, high risk true, PEP no, with no review reasons listed and last screened 2026-06-26. The only signals driving the alert score are entity.high_risk (+20) and counterparty.first_time (+10), totaling 30, which is the low end of the review band. The counterparty's country is unknown but there is no sanctioned-country flag, no unauthorized or administrative return, and the transfer settled normally. Program-level KRIs are mostly ok: ach_overall_return_rate 0.9%, ach_unauthorized_return_rate 0%, sanctioned_country_transfers 0, high_risk_entity_share 3.0%, stale_screening_share 6.1%. Two KRIs show elevated levels not specific to this entity: manual_review_aging_hours is in breach (1433.5 hours, n=3) and hold_aging_hours and pep_flagged_entities are in watch status, but none of these are tied to this transfer or entity in the evidence provided. What was checked. Reviewed the alert signals and score, the entity's screening status (verified, PEP no, no review reasons), the transfer status (settled, no return code), and program-level KRIs for related patterns (return rates, sanctioned-country transfers, high-risk entity share, manual review aging). No prior dispositions exist for this alert. What is recommended. The transfer already settled with no return code and no unauthorized or sanctioned-country indicators. The entity is verified with no PEP flag and no listed review reasons. The score sits at the low end of the review band driven only by a generic high-risk marker and a first-time counterparty. Nothing in the evidence requires holding funds, since the transfer is not pending. The manual_review_aging_hours breach is a program-level condition, not specific to this alert, and does not by itself indicate a pattern larger than this single alert. Recommend closing this alert; the aging-hours breach and watch-level KRIs may warrant separate program-level attention outside this alert.

{
  "n": 349,
  "band": "review",
  "skoor": 30,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}