Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_91eod4q93y
- Transfer
- acht_sim_nort_b7ujluqu1k1 · $888.64 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An ACH outgoing debit of $888.64 from entity enti_sim_nort_91eod4q93y under the Northwind Payroll program settled on 2026-08-03. The sanctions_or_pep detector fired because the entity is flagged high risk by screening; this route always sends such entities to review regardless of score.
What the evidence shows. The alert and transfer both score 20, band clear, driven solely by the entity.high_risk signal (weight 20). PEP status is no, review reasons are none, and the entity is VERIFIED with last screening on 2026-06-26. The transfer settled with no return code, indicating no rail-level failure. Counterparty country is unknown, which limits assessment of cross-border risk. No prior dispositions exist for this entity or alert.
What was checked. Program KRIs were reviewed: high_risk_entity_share is 0.061 (watch) and pep_flagged_entities is 1 (watch), both on a small base (n=33), consistent with this entity contributing to those metrics but not indicating a broader breach. manual_review_aging_hours shows a breach (1434.7 hours, n=3), which reflects review queue timeliness rather than this specific transaction's risk. ach_overall_return_rate, sanctioned_country_transfers, and verification_denial_rate are all in normal range. No sanctioned-country transfer signal is present. The transfer already settled, so no hold is in effect.
What is recommended. Close this alert. The entity's high-risk flag is the only driver, PEP status is negative, verification is current, and the transfer settled without incident. The manual_review_aging_hours breach is a program-level queue timing issue, not specific evidence tying to this transfer, and should be tracked separately rather than held against this alert. The counterparty country being unknown is a minor gap but does not by itself warrant holding a settled transfer.
- Recommendation
- close
- Confidence
- 0.68
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Score is 20, band clear, single signal (entity.high_risk) with no additional risk signals such as PEP match, sanctioned country, or return code.
- Entity is VERIFIED, PEP is no, review reasons none, and screening was current as of 2026-06-26.
- Transfer has already SETTLED with no return code, so there is no fund movement to hold; 'release' does not apply since no hold is in effect.
- Program KRIs show only watch-level items (high_risk_entity_share, pep_flagged_entities) on a small denominator (n=33), not indicative of a pattern requiring escalation.
- manual_review_aging_hours breach (n=3) reflects review queue delay, a separate operational issue, not evidence against this specific alert.
- Counterparty country unknown is a data gap, noted but not sufficient alone to hold a settled transfer with no other risk signal.
Evidence
{
"n": 524,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.