Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 313fe2c8-c5d5-4a2b-a7cc-d43990c77fa7 fired on entity enti_sim_harb_skonrvy3x6 under the sanctions_or_pep detector after a settled ACH outgoing debit of $204.13 on transfer acht_sim_harb_b77zwczf81n. The route reason states this detector is always sent to review, independent of score. What the evidence shows. The entity is a verified US business marked high risk by screening, with PEP status no and no review reasons listed. Last screening was 2026-08-27, three weeks before the alert opened. The transfer-level skoor is 20 in the clear band with n=1619 and confidence 1, and hard_signal is false. The only contributing signal is entity.high_risk at weight 20. The transfer settled with no return code, indicating no rail-level rejection or dispute. Counterparty country is unknown but this is not one of the signals driving the alert. What was checked. Reviewed the entity record for PEP status, verification state, and review reasons: all clear except the high-risk flag itself. Reviewed the transfer for status, return code, and amount relative to declared program volume: settled, no return, and $204.13 is immaterial against a $4,000,000.00 declared monthly volume. Reviewed program KRIs for related patterns: pep_flagged_entities and high_risk_entity_share are at watch, and manual_review_aging_hours and ach_unauthorized_return_rate are at breach, but none of these are specific to this entity or this transfer, and no prior dispositions exist on this entity to indicate a repeat pattern. What is recommended. Close the alert. The evidence shows a routine review triggered by the detector's standing rule to always review high-risk entities, not by an elevated score or a hard signal. The entity is verified, not PEP, and has no other review reasons. The transfer settled cleanly with no return. A person should still be aware of the program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) but those are program-wide conditions, not specific to this alert, and do not change the disposition of this individual alert.

{
  "n": 1619,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}