Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Lantern Lending (simulated)
- Subject
- entity enti_sim_lant_6uvwvng8cjh
- Transfer
- acht_sim_lant_ae8m8zg1e3x · $677.91 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A sanctions/PEP screening detector fired on entity enti_sim_lant_6uvwvng8cjh, the subject of a settled outgoing ACH debit of $677.91 dated 2026-09-02, under program Lantern Lending. The alert routed to review because this detector is always reviewed, not because of score severity.
What the evidence shows. The entity is a US-based verified business flagged high risk by screening, but PEP status is no and review reasons are listed as none. Screening is current (last screened 2026-08-29). The transfer-level skoor is 20, band clear, with confidence 0.985 over n=634, driven solely by the entity.high_risk signal (+20). The transfer settled with no return code, and the counterparty's country is unknown but no sanctioned-country or unauthorized-return signals fired. Program KRIs show sanctioned_country_transfers=0, ach_unauthorized_return_rate=0, stale_screening_share=0, and high_risk_entity_share at 3.0% (n=33, ok). Two KRIs show elevated aging: hold_aging_hours is watch and manual_review_aging_hours is breach (n=6), but neither is tied to this specific alert or transfer.
What was checked. Detector and score evidence, entity screening record, transfer status and return code, program-level KRI panel, and prior dispositions (none on file). No sanctions list hit, no PEP flag, and no adverse review reasons are present in the entity record.
What is recommended. Close the alert. The single high-risk signal is explained by the entity's existing screening classification, not by new adverse information; the transfer already settled with no return, and no sanctions or PEP match is present. The manual_review_aging_hours breach is a program-level KRI issue, separate from this entity-specific alert, and should be tracked independently rather than held against this transaction.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Score band is clear (20) driven only by entity.high_risk, with no PEP flag and no review reasons recorded.
- Screening is current (last screened 2026-08-29), so no stale-screening concern.
- Transfer already settled with no return code; nothing to hold since funds have moved and no reversal signal exists.
- Program KRIs show no sanctioned-country transfers and 0% unauthorized return rate, consistent with a clean pattern.
- Manual_review_aging_hours breach (n=6) is a program-level metric, not linked to this specific entity or transfer, so it does not itself justify holding this alert.
- Counterparty country is unknown, which is a minor evidence gap; this lowers confidence slightly but does not meet the bar for escalation absent any sanctions or PEP hit.
Evidence
{
"n": 634,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.