Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 2eb2a5ba fired on entity enti_sim_harb_skonrvy3x6 under the sanctions_or_pep detector, which the route reason indicates always sends this detector to review regardless of score. The triggering activity is a settled ACH outgoing debit of $429.55 (acht_sim_harb_1esf4uvn6ez) dated 2026-08-08, with no return code. What the evidence shows. The entity is a VERIFIED business, high_risk true, pep no, with no review reasons listed and a last screening date of 2026-06-26. The alert skoor is 20, banded clear, with confidence 0.925 on n=928. The single contributing signal is entity.high_risk(+20), which is the only reason for the score; there is no sanctions hit, no PEP match, and no adverse review reason recorded. The transfer itself settled normally with no return code. Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level (1/30 and 6.67%), and stale_screening_share is 0.00 (ok), meaning screening on this entity is current. manual_review_aging_hours and ach_unauthorized_return_rate are flagged breach at the program level, but neither ties to this entity or this transfer specifically. Counterparty country is unknown, and sanctioned_country_transfers is 0 across 693 transfers. What was checked. Reviewed the alert evidence, entity screening record, transfer status and return code, program KRI panel, and prior dispositions. No prior dispositions exist for this alert. No sanctions match or PEP flag is present on the entity. The transfer is settled with no return, and the counterparty country is not identified as sanctioned. What is recommended. The evidence supports closing this alert. The only signal present is the entity's high-risk flag, which is a static screening attribute already accounted for in the clear-band score, not a new sanctions or PEP match. The transfer settled without incident and screening is current (stale_screening_share 0.00). The program-level manual_review_aging_hours and ach_unauthorized_return_rate breaches are separate program metrics not connected to this specific alert or transfer and should be tracked independently, not as grounds to hold this transaction.

{
  "n": 928,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}