Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_1qfavflo4v9 · $486.65 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_harb_azbiyidj3x2 under the sanctions_or_pep detector because screening flagged a potential PEP match. The alert is tied to one settled ACH outgoing transfer of $486.65 dated 2026-07-20, and the route reason states this detector is always reviewed regardless of score.
What the evidence shows. The entity-level record shows verification status VERIFIED, high_risk false, and review reasons none, with last screening dated 2026-06-25. The alert score is 15, banded clear, with hard_signal false, driven solely by the entity.pep_potential signal at weight 15. The transfer itself scored 15, band clear, confidence 0.955, and has already settled with no return code. Program KRIs show pep_flagged_entities at 1 of 30 (watch) and high_risk_entity_share at 6.7% (watch), both within a watch band rather than a breach. The one breach metric, manual_review_aging_hours at 1438 hours, is based on n=1 and is a program-level aging metric, not specific to this entity or transfer.
What was checked. Reviewed the entity's verification and PEP review-reason fields, the transfer's status and return code, the alert and transfer skoor bands, and the program KRI panel for any related breach (sanctioned_country_transfers, stale_screening_share, verification_denial_rate) that would corroborate elevated risk. All of these are ok or watch, not breach, except the unrelated manual_review_aging_hours metric. No prior dispositions exist for this alert or entity.
What is recommended. Close the alert. The entity is verified with no open review reasons, the score bands clear on both alert and transfer, hard_signal is false, and the transfer has already settled with no return code, so there are no funds to hold. Nothing in the evidence indicates a pattern requiring escalation beyond this single alert.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity verification is VERIFIED with review reasons none, indicating the PEP potential flag was already addressed at screening.
- Alert and transfer both score 15 in the clear band with hard_signal false.
- Transfer acht_sim_harb_1qfavflo4v9 is SETTLED with no return code, so there is no held transfer to release or freeze.
- Program KRIs for PEP and high-risk entity share are watch, not breach, and no sanctioned-country or stale-screening issues are present.
- Counterparty country is unknown, which is a gap in the evidence and slightly limits confidence, but it does not by itself indicate elevated risk given the verified entity status.
- No prior dispositions exist, so there is no pattern of repeat alerts on this entity to support escalation.
Evidence
{
"n": 280,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.