Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Lantern Lending (simulated)
- Subject
- entity enti_sim_lant_866sn4vcjd
- Transfer
- acht_sim_lant_7ma45s3td11 · $546.44 · ach outgoing
- Skoor at alert
- 25 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 35440d00-5941-4783-a975-5fa6ca7dad06 was generated by the sanctions_or_pep detector on entity enti_sim_lant_866sn4vcjd, a PERSON named "Potential Pep 3" enrolled in Lantern Lending (simulated). The alert was opened 2026-09-17 following a $546.44 USD outgoing ACH debit (acht_sim_lant_7ma45s3td11) to counterparty cpty_sim_lant_2x5q7bzad11, which settled 2026-07-24 with no return code.
What the evidence shows. The alert score is 25, band clear, hard signal false; route was 'reviewed' because the detector always routes to review regardless of score. The transfer-level skoor is also 25/clear (n=161, confidence 0.6625), driven by entity.pep_potential (+15) and counterparty.first_time (+10). The entity record shows verification VERIFIED, high_risk false, review reasons none, and last screened 2026-06-25T12:01:30Z, about three months before this alert opened. Program KRIs show pep_flagged_entities at 1 of 33 (watch) and stale_screening_share at 6.1% (ok), with no sanctioned_country_transfers, no unauthorized or administrative ACH returns, and reserve coverage well above 1x. The transfer has already settled; there is no held transfer to act on.
What was checked. Reviewed the alert evidence payload, the linked transfer's status and skoor, the entity's verification and screening history, program-level KRIs for PEP and screening staleness, and prior dispositions on this alert (none exist).
What is recommended. No hold action is available since the transfer already settled with no return code. The entity is verified, carries no adverse review reasons, and the PEP flag is 'potential' rather than confirmed. Nothing in the evidence indicates a pattern requiring escalation beyond this single alert. Recommend closing the alert, noting the entity's PEP-potential status for the next periodic screening refresh given the ~3-month gap since last screening.
- Recommendation
- close
- Confidence
- 0.70
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Alert score 25 falls in the clear band with hard_signal false.
- Entity is VERIFIED, high_risk false, and review reasons are listed as none.
- Transfer is SETTLED with no return code; there is no held transfer to release or hold.
- Route to review was triggered by standing policy (detector always reviewed) rather than by an elevated score.
- Program KRIs (pep_flagged_entities, stale_screening_share) sit at watch/ok levels, not breach, and show no cross-alert pattern.
- Last screening date (2026-06-25) is about three months prior to alert open, which is a minor gap worth noting but not sufficient alone to hold or escalate.
Evidence
{
"n": 161,
"band": "clear",
"skoor": 25,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.