Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_91eod4q93y
- Transfer
- acht_sim_nort_3u5e8fm29e · $2,644.08 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 2527e61f-533c-468d-8b3e-5522e15a8feb fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector, high severity, because screening marked the entity high risk. The detector's route reason is 'detector always reviewed,' meaning this alert type is routed for review regardless of score. The only transfer tied to the alert is acht_sim_nort_3u5e8fm29e, an outgoing ACH credit of $2,644.08 USD, status SETTLED, with no return code.
What the evidence shows. The entity record shows verification VERIFIED, high_risk true, pep no, and review reasons none, last screened 2026-06-26T12:01:30.000Z. The alert's hard_signal flag is false, and the score band is unscored with skoor null (n=15, confidence null). The only contributing signal is entity.high_risk with weight 20; no sanctions match, no PEP match, and no other adverse signal is present. The transfer is already settled, has no return code, and falls within the declared program profile (Northwind Payroll, ACH, US, $2,500,000.00 monthly volume). Counterparty country is listed as unknown, but no signal or review reason references the counterparty specifically.
What was checked. Reviewed the alert evidence block, the entity record, the transfer record, and program declarations. Confirmed no hard signal is set, no PEP designation, no review reasons logged, and the entity is verified. Confirmed the transfer status is SETTLED with no return code, meaning it is not a held transfer awaiting release. Checked prior dispositions: none exist for this alert.
What is recommended. Close the alert. The single contributing signal is a generic high-risk screening flag with no hard signal, no PEP match, no adverse review reason, and a verified entity status. The transfer has already settled with no return code, so no funds are pending release. The score band is unscored, so a person should still confirm this reading given the thin scoring data, but nothing in the evidence as presented requires holding funds or escalating a broader pattern.
- Recommendation
- close
- Confidence
- 0.55
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- hard_signal is false and pep is no, reducing the strength of the sanctions_or_pep detector trigger
- entity is VERIFIED with review reasons none, and last screened within the past 90 days as of alert open date
- transfer is already SETTLED with no return code, so 'release' does not apply and no hold is pending
- score band is unscored with skoor null and n=15, which limits confidence and argues for a person's confirmation rather than an automated close, hence confidence is set below 0.7
- no prior dispositions or repeat pattern evidence exists to support escalation
Evidence
{
"n": 15,
"band": "unscored",
"skoor": null,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.