Activity on an entity flagged by screening (PEP status no, high risk).

What happened. The sanctions_or_pep detector fired on entity enti_sim_nort_91eod4q93y within the Northwind Payroll program, referencing an ACH outgoing credit of $2459.80 (transfer acht_sim_nort_cmaywvuo1ov, settled 2026-08-05) tied to that entity. What the evidence shows. The alert score is 20, band clear, with a single contributing signal: entity.high_risk (+20). Hard signal is false. The entity is a verified US business, high risk true, but PEP status is no and there are no review reasons listed. Last screened 2026-06-26, which is within the program's stale_screening_share=0 (ok) metric. The transfer itself scored 20, band clear, and settled with no return code, indicating no ACH rejection occurred. Program-level KRIs show high_risk_entity_share=0.06 (watch) and pep_flagged_entities=1 of 33 (watch), but these are portfolio-level indicators, not entity-specific findings tied to this alert. manual_review_aging_hours=1434.67 (breach) reflects a backlog metric unrelated to this specific alert's content. No sanctioned-country transfers, no unauthorized or administrative return spikes, and counterparty concentration is within normal range. What was checked. Reviewed the alert's signal composition (single high_risk flag, no PEP, no adverse review reasons), the transfer status (settled, no return), the entity's verification and screening recency, and program KRIs for corroborating patterns. Found no additional signals, no hard signal flag, and no prior dispositions on this entity or alert. What is recommended. The evidence consists of a single high-risk flag on a verified, non-PEP entity, with a settled transfer showing no return or rejection. Score and band are clear. Nothing in the evidence indicates funds should be held or that a broader pattern beyond this single flag exists. The manual_review_aging_hours breach is a separate program-level operational metric and does not itself implicate this transfer or entity. Close the alert.

{
  "n": 570,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}