Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_skonrvy3x6
- Transfer
- acht_sim_harb_29gdzg2f6q6 · $344.90 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert opened by the sanctions_or_pep detector on entity enti_sim_harb_skonrvy3x6 because screening marked the entity high risk. The detector always routes to review regardless of score. The single associated transfer is an ACH outgoing credit of $344.90 USD, settled, with no return code.
What the evidence shows. The entity is VERIFIED, PEP status is no, review reasons are none, and it was last screened 2026-06-26. The alert-level skoor is 20 in the clear band with hard_signal false, driven solely by the entity.high_risk signal (+20). The transfer itself carries the same skoor of 20, clear band, with confidence 0.94 and n=1067. The transfer settled with no return code, and the counterparty country is unknown but there is no sanctioned-country signal raised (sanctioned_country_transfers=0 at program level, n=825). No prior dispositions exist for this entity or transfer.
What was checked. Entity screening fields (verification, PEP, review reasons, last screened date), transfer status and return code, alert and transfer skoor/band/signals, and program-level KRIs. Program KRIs show high_risk_entity_share=0.067 (watch), pep_flagged_entities=1 (watch), manual_review_aging_hours=1438 (breach), and ach_unauthorized_return_rate=0.0115 (breach). None of these breach/watch KRIs are tied by the evidence to this specific entity or transfer; they describe program-wide conditions, not this alert.
What is recommended. Close this alert. The entity is verified, not PEP, has no open review reasons, and was screened within the last three months. The only transfer tied to the alert settled cleanly with no return code and a clear-band skoor. Nothing in the entity or transfer evidence requires holding funds or escalating this specific alert. The program-level manual_review_aging_hours and ach_unauthorized_return_rate breaches are noted for separate program monitoring but do not attach to this entity or transfer in the evidence provided.
- Recommendation
- close
- Confidence
- 0.82
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Entity is VERIFIED, PEP=no, review reasons=none, last screened 2026-06-26 (recent).
- Alert and transfer skoor both 20, band clear, hard_signal false; single signal is entity.high_risk with weight 20.
- Transfer acht_sim_harb_29gdzg2f6q6 is SETTLED, return code none, amount $344.90, no sanctioned-country signal.
- Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are program-wide and not linked in evidence to this entity or transfer.
- No prior dispositions exist to suggest a recurring pattern for this entity.
Evidence
{
"n": 1067,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| returns.counterparty_prior_unauthorized | +40 | 1 prior unauthorized return(s) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.