SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Activity on an entity flagged by screening (PEP status no, high risk).

Detector
sanctions_or_pep
Severity
high
Program
Northwind Payroll (simulated)
Subject
entity enti_sim_nort_91eod4q93y
Transfer
acht_sim_nort_b7ujluqu1k1 · $888.64 · ach outgoing
Skoor at alert
20 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. An ACH outgoing debit of $888.64 from entity enti_sim_nort_91eod4q93y under the Northwind Payroll program settled on 2026-08-03. The sanctions_or_pep detector fired because the entity is flagged high risk by screening; this route always sends such entities to review regardless of score. What the evidence shows. The alert and transfer both score 20, band clear, driven solely by the entity.high_risk signal (weight 20). PEP status is no, review reasons are none, and the entity is VERIFIED with last screening on 2026-06-26. The transfer settled with no return code, indicating no rail-level failure. Counterparty country is unknown, which limits assessment of cross-border risk. No prior dispositions exist for this entity or alert. What was checked. Program KRIs were reviewed: high_risk_entity_share is 0.061 (watch) and pep_flagged_entities is 1 (watch), both on a small base (n=33), consistent with this entity contributing to those metrics but not indicating a broader breach. manual_review_aging_hours shows a breach (1434.7 hours, n=3), which reflects review queue timeliness rather than this specific transaction's risk. ach_overall_return_rate, sanctioned_country_transfers, and verification_denial_rate are all in normal range. No sanctioned-country transfer signal is present. The transfer already settled, so no hold is in effect. What is recommended. Close this alert. The entity's high-risk flag is the only driver, PEP status is negative, verification is current, and the transfer settled without incident. The manual_review_aging_hours breach is a program-level queue timing issue, not specific evidence tying to this transfer, and should be tracked separately rather than held against this alert. The counterparty country being unknown is a minor gap but does not by itself warrant holding a settled transfer.
Recommendation
close
Confidence
0.68
Model
claude-sonnet-5
Drafted
2026-09-17 19:30Z
Rationale
  • Score is 20, band clear, single signal (entity.high_risk) with no additional risk signals such as PEP match, sanctioned country, or return code.
  • Entity is VERIFIED, PEP is no, review reasons none, and screening was current as of 2026-06-26.
  • Transfer has already SETTLED with no return code, so there is no fund movement to hold; 'release' does not apply since no hold is in effect.
  • Program KRIs show only watch-level items (high_risk_entity_share, pep_flagged_entities) on a small denominator (n=33), not indicative of a pattern requiring escalation.
  • manual_review_aging_hours breach (n=3) reflects review queue delay, a separate operational issue, not evidence against this specific alert.
  • Counterparty country unknown is a data gap, noted but not sufficient alone to hold a settled transfer with no other risk signal.

Evidence

{
  "n": 524,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

SignalWeightHardDetail
entity.high_risk+20entity marked high risk by screening

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.