Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Lantern Lending (simulated)
- Subject
- entity enti_sim_lant_6uvwvng8cjh
- Transfer
- acht_sim_lant_hu9bz8wckx · $981.80 · ach outgoing
- Skoor at alert
- null unscored
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_lant_6uvwvng8cjh under the sanctions_or_pep detector, high severity, because screening marked the entity as high risk. The alert is tied to a single ACH outgoing credit transfer (acht_sim_lant_hu9bz8wckx) for $981.80 USD, settled on 2026-07-10, with no return code.
What the evidence shows. The entity record shows verification status VERIFIED, high_risk true, pep no, and review reasons none, last screened 2026-06-26. The alert-level evidence has a single signal, entity.high_risk (+20), with score unscored and hard_signal false. The transfer-level evidence adds counterparty.first_time (+10); the transfer is also unscored (band unscored, n=1, confidence null). The counterparty cpty_sim_lant_c9qj5z42ckx has an unknown country. There is no sanctions match, no PEP designation, and no review reason recorded. Prior dispositions: none.
What was checked. Reviewed the entity screening record (verification, PEP status, review reasons), the transfer record (status, return code, amount, rail), the program context (Lantern Lending, declared monthly volume $900,000.00, ACH rails, US only), and the signal list attached to both the alert and the transfer. No hard signal was present, and no PEP or sanctions match was recorded despite the high_risk flag.
What is recommended. Close the alert. The evidence shows a high-risk screening flag without a corroborating PEP or sanctions match, a verified business entity, a settled transfer with no return, and no review reasons on file. The counterparty's unknown country and first-time status add some uncertainty but do not by themselves indicate a pattern requiring hold or escalation. A person should still confirm counterparty country data is filled in going forward, but nothing here requires stopping funds or a deeper investigation at this time.
- Recommendation
- close
- Confidence
- 0.62
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity pep is no and review reasons is none, so the sanctions_or_pep trigger rests solely on a generic high_risk flag, not a confirmed match.
- Entity verification status is VERIFIED, reducing identity risk.
- The transfer is SETTLED with no return code, indicating no rejection or reversal.
- Alert-level and transfer-level scores are both unscored (skoor null, band unscored), meaning the evidence is thin; this lowers confidence but does not itself indicate wrongdoing.
- Counterparty is marked first-time and its country is unknown, which is a data gap worth flagging for future monitoring but not sufficient alone to hold funds or escalate.
- No prior dispositions exist on this entity, so there is no pattern across alerts to point to escalation.
Evidence
{
"n": 1,
"band": "unscored",
"skoor": null,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.