Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 0f30eb02-fea6-4f6c-ae46-00ed2b33f1cc fired on entity enti_sim_nort_91eod4q93y (Northwind Payroll program) because screening marked the entity high risk. The alert is tied to one ACH outgoing credit transfer (acht_sim_nort_7wprqow83e6) for $2,139.50, settled with no return code. What the evidence shows. The alert score is 20, banded clear, with hard_signal false. The only contributing signal is entity.high_risk (weight 20). The entity record shows PEP status no, review reasons none, verification status VERIFIED, and last screened 2026-08-18, which is within a normal screening cycle. The transfer itself carries the same clear-band score (20) with no additional signals, settled status, and no return code, and its amount ($2,139.50) is small relative to the program's declared monthly volume ($2,500,000.00). There are no prior dispositions on this entity or alert. What was checked. Reviewed the alert evidence and routing reason (detector always reviewed, not risk-driven routing). Reviewed the entity screening record for PEP and review-reason fields. Reviewed the transfer record for return code and status. Reviewed program KRIs: high_risk_entity_share (0.061, watch) and pep_flagged_entities (1/33, watch) are elevated but within a watch band, not breach. manual_review_aging_hours (1434.7 hours, breach) is a program-level metric not specific to this entity or transfer and has no direct evidentiary link to this alert's transaction. What is recommended. Close this alert. The transfer is settled, carries no return code, and the entity is verified with no PEP flag and no review reasons. The high-risk flag alone, at clear band with no hard signal, does not indicate a condition requiring a person to act on this specific transfer. The program-level manual_review_aging_hours breach should be tracked separately as a program KRI issue, not as grounds to hold this transfer.

{
  "n": 1296,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}