Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Sanctions/PEP detector fired on entity enti_sim_nort_91eod4q93y under program Northwind Payroll due to a screening flag of high risk (not PEP). The linked transaction is an outgoing ACH debit of $3699.03 that was returned with code R03 (no account/unable to locate). What the evidence shows. The alert score is 20, banded clear, driven solely by the entity.high_risk signal (weight 20). Hard signal is false. The entity is VERIFIED, PEP status is no, review reasons none, last screened 2026-06-26, country US. The transfer itself scored the same 20/clear with no additional signals, and it is already returned (R03), so no funds are in motion or at risk from this transfer. Program KRIs show high_risk_entity_share and pep_flagged_entities both at watch level (0.061 and 1/33 respectively), and manual_review_aging_hours is in breach (1434.67 hours, n=7), but these are program-level metrics not specific to this alert's evidence. What was checked. Entity screening status and verification, transfer status and return code, alert and transfer skoor/band, program KRI panel, and prior dispositions (none on file). What is recommended. The transfer is already returned, so there is nothing to hold or release. The entity's high-risk flag is the only driver of this alert and carries no PEP indication, no adverse review reasons, and current verification. No hard signal was triggered. This alert can be closed. Separately, the program-level manual_review_aging_hours breach (1434.67 hours) and the watch-level high_risk_entity_share and pep_flagged_entities metrics warrant attention outside this alert, as they are not specific to this entity or transaction but reflect broader queue and portfolio conditions.

{
  "n": 739,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}