Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Sanctions/PEP screening detector fired on entity enti_sim_harb_skonrvy3x6, a US business named 'High Risk Trading 1', in connection with a single outgoing ACH credit transfer of $487.14 settled on 2026-07-28 with no return code. What the evidence shows. The entity carries a static high-risk screening flag (20-point signal) but is marked PEP: no, verification status VERIFIED, and has no listed review reasons. Last screening date is 2026-06-26, prior to alert open, and program-wide stale_screening_share is 0.00 (ok), so screening is current. The transfer itself settled normally with no return code. A secondary signal, returns.counterparty_prior_any (+15), indicates the counterparty has some prior return history, but this transaction shows no return and program ach return rates (overall 1.95%, unauthorized 0%, administrative 0.65%) are all within normal range. Combined score is 35, placing it in the review band with hard_signal false; route reason is 'detector always reviewed,' meaning this alert type is routed for review regardless of score. What was checked. Entity profile (business type, verification, PEP status, high-risk flag, screening date, country), the single associated transfer (amount, rail, status, return code, counterparty country), transfer-level score and signals, program declared volume and rails, and program KRIs. KRIs show pep_flagged_entities=1/30 (watch) and high_risk_entity_share=6.67% (watch), both program-level and not specific to this entity's transaction. manual_review_aging_hours shows a breach (1438 hours, n=2), which is a program operational metric unrelated to this specific transfer's disposition. No prior dispositions exist for this alert. What is recommended. Close this alert. The entity is verified, not PEP, screening is current, and the flagged transfer settled with no return or adverse outcome. The high-risk designation alone, absent PEP status or a hard signal, does not indicate a person needs to intervene on this specific transfer. Separately, the manual_review_aging_hours breach at the program level should be tracked outside this alert as it reflects review queue backlog, not this transaction.

{
  "n": 564,
  "band": "review",
  "skoor": 35,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}