Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 288877f6-9566-4367-9406-105dbee93c21 fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector because screening marked the entity high risk. Severity is high but the alert score is 35, placing it in the review band, and hard_signal is false. The entity is a BUSINESS ("High Risk Trading 0") in the Northwind Payroll program tied to a single settled outgoing ACH credit of $993.11 to counterparty cpty_sim_nort_6vgyi7tm4a. What the evidence shows. Screening shows the entity is high risk but not PEP, verification status is VERIFIED, review reasons are none, and last screening was 2026-06-26, within the alert window. The transfer signals show entity.high_risk (+20) and returns.counterparty_prior_any (+15), reaching a 35 review score with n=261 and confidence 0.88. The transfer itself is SETTLED with return code none, so this specific transaction did not return. Counterparty country is unknown, which limits geographic risk assessment but is not itself a sanctions or return signal. Program KRIs are mostly ok; sanctioned_country_transfers=0 and ach_unauthorized_return_rate=0 across n=109/60. pep_flagged_entities (0.033, watch) and high_risk_entity_share (0.061, watch) are program-level and not specific to this entity's transaction outcome. manual_review_aging_hours shows a breach (1434.7 hours, n=2), which reflects backlog in manual review generally, not evidence tied to this alert's transaction. What was checked. Checked entity verification status, PEP flag, review reasons, and last screening date. Checked the referenced transfer's status, return code, and signal composition. Checked program-level KRIs for sanctioned-country transfers, return rates, and high-risk/PEP entity shares for corroborating pattern signals. Checked prior dispositions, of which there are none. What is recommended. No transfer is being held and the settled transfer shows no return. The entity is verified, not PEP, has no open review reasons, and was screened within the past three months. The counterparty_prior_any signal references prior return history elsewhere but does not indicate a return on this transaction. Absent a hard signal or a sanctions match, and with no funds currently held, this alert does not require a person to intervene on this transaction. Close the alert. The manual_review_aging_hours breach and the watch-level PEP/high-risk share KRIs are program-level conditions that a person should track separately from this alert's disposition.

{
  "n": 261,
  "band": "review",
  "skoor": 35,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}