Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 18d4b793-1546-4bce-be47-0e090bbd4ee3 fired on the sanctions_or_pep detector for entity enti_sim_nort_91eod4q93y, tied to a single ACH outgoing credit of $984.12 (acht_sim_nort_8d3hnz1w154) under the Northwind Payroll program. The detector routes to review by default whenever an entity carries a high-risk screening flag. What the evidence shows. The entity score is 20, band clear, with hard_signal false. The only contributing signal is entity.high_risk (+20); there is no PEP match (pep: no) and no listed review reasons. The entity is VERIFIED, business type, US country, last screened 2026-06-26. The transfer itself scored 20/clear as well, with the same single signal, settled with no return code. Counterparty country is unknown but the program's sanctioned_country_transfers KRI is 0 (n=164, ok), and ach return rates are all normal. Program-level KRIs show pep_flagged_entities and high_risk_entity_share at watch level, and manual_review_aging_hours in breach (1434.7 hours, n=3), but these are aggregate program metrics, not specific to this entity's alert, and no prior dispositions exist to indicate a repeat pattern on this subject. What was checked. Reviewed the alert score and band, the entity's verification and PEP status, the single associated transfer's status and return code, and the program KRI panel for corroborating signals such as sanctioned-country activity, unauthorized returns, or elevated screening staleness. All of these came back clear or unmeasured with no direct link to this entity beyond the high-risk flag. What is recommended. Close this alert. The evidence is limited to a single low-weight screening flag with no PEP hit, no review reasons, a verified entity, and a normally settled transfer. The manual_review_aging_hours breach at the program level is worth flagging separately to the team managing review queues, but it does not change the disposition of this specific alert, which shows no signal requiring a hold on funds or further escalation.

{
  "n": 334,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}