Alert · reviewed · open

Activity on an entity flagged by screening (PEP status potential).

Detector: sanctions_or_pep
Severity: high
Program: Harbor Marketplace Payouts (simulated)
Subject: entity enti_sim_harb_azbiyidj3x2
Transfer: acht_sim_harb_5k4mf7br4c8 · $351.10 · ach outgoing
Skoor at alert: 15 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert triggered by the sanctions_or_pep detector on entity enti_sim_harb_azbiyidj3x2 due to a potential PEP match. The alert is tied to a single ACH outgoing debit of $351.10 USD (acht_sim_harb_5k4mf7br4c8) that settled on 2026-07-13. What the evidence shows. The entity screening evidence shows verification status VERIFIED, high_risk flag false, and review reasons listed as none, despite the pep_potential signal. The alert score is 15, banded 'clear', with the only contributing signal being entity.pep_potential (+15). The transfer itself is already SETTLED with no return code, indicating it is not currently held or reversible. Program KRIs show pep_flagged_entities at 1 of 30 (watch) and high_risk_entity_share at 6.7% (watch), but both are drawn from a small n=30 sample and are not specific to this entity beyond the potential PEP tag already reflected in the alert. What was checked. Reviewed the entity record (verification, high-risk flag, review reasons, last screened date), the transfer record (status, return code, amount), the alert scoring detail (band, signal weights, confidence), and program-level KRIs for related patterns (pep_flagged_entities, high_risk_entity_share, stale_screening_share). No prior dispositions exist for this entity or alert. What is recommended. Close the alert. The entity is verified, not flagged high risk, and has no open review reasons; the alert score sits in the clear band; and the associated transfer has already settled with no return code, so there is no fund movement to hold. The KRI watch levels are program-wide and based on a small sample, not specific evidence of risk on this entity, so they do not independently justify escalation at this time.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:30Z

Rationale

Entity verification status is VERIFIED with high_risk=false and review reasons=none, despite the pep_potential tag.
Alert score is 15, banded clear, with only one contributing signal (entity.pep_potential, weight 15).
Transfer is already SETTLED with no return code; there is no pending transfer to hold or release.
Program KRIs pep_flagged_entities and high_risk_entity_share are at watch level but derive from a small sample (n=30) and are not entity-specific findings beyond what the alert already captures.
No prior dispositions exist, so there is no pattern of repeat alerts on this entity to support escalation.
Several program KRIs (velocity_vs_declared, reserve_coverage_ratio, sanctioned_country_transfers) are unmeasured, limiting broader pattern assessment, which caps confidence below high.

Evidence

{
  "n": 97,
  "band": "clear",
  "skoor": 15,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
entity.pep_potential	+15		potential PEP match

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.