Activity on an entity flagged by screening (PEP status no, high risk).

What happened. An alert fired on entity enti_sim_harb_skonrvy3x6 ("High Risk Trading 1"), flagged by the sanctions_or_pep detector because screening marked it high risk. The associated transfer is a single settled ACH outgoing credit of $633.75 dated 2026-07-19, already settled with no return code. What the evidence shows. The entity is VERIFIED, PEP status is no, and there are no review reasons listed. The only scoring signal is entity.high_risk (+20), producing a skoor of 20 in the clear band with hard_signal false. Screening was last done 2026-06-26, within a normal window, and stale_screening_share for the program is 0. The transfer itself settled normally with no return code, and program-level ACH return rates (overall, unauthorized, administrative) are all 0. Sanctioned_country_transfers is 0. Program KRIs show high_risk_entity_share at 0.067 and pep_flagged_entities=1 (both marked watch, small n of 30), and manual_review_aging_hours is in breach (1438 hours, n=1), but this last metric is unmeasured-scale (n=1) and not tied to this specific transfer or entity. What was checked. Reviewed the entity's verification status, PEP flag, review reasons, and last screening date. Reviewed the transfer's status, return code, and amount against the program's declared monthly volume. Reviewed program KRIs for sanctioned-country exposure, return rates, and screening staleness. Confirmed hard_signal is false and skoor band is clear. Checked prior dispositions: none exist for this entity. What is recommended. No evidence in this alert indicates unresolved sanctions or PEP concern requiring a hold on this settled transfer. The entity is verified, not PEP, and screening is current. The transfer already settled with no return. The high_risk flag alone, at a clear band score with no hard signal, does not meet the bar for hold or escalate. A person should note the program-level manual_review_aging_hours breach and watch-level high_risk_entity_share and pep_flagged_entities metrics for separate program-level review, but they do not change the disposition of this specific alert.

{
  "n": 260,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}