Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_ztfep4z19d · $3,196.53 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 37f567e8-5ce5-44a1-b358-0d16fef52ec5 was opened on 2026-09-17 for entity enti_sim_nort_sr7cv2o3u under the sanctions_or_pep detector, triggered by a potential PEP match on a $3,196.53 USD outgoing ACH debit (acht_sim_nort_ztfep4z19d) settled on 2026-07-29 within the Northwind Payroll program.
What the evidence shows. The alert score is 15, placing it in the clear band, with hard_signal false. The only contributing signal is entity.pep_potential at weight 15. The entity record shows verification status VERIFIED, high_risk false, and review reasons listed as none, with last screening on 2026-06-25, prior to alert open. The transfer settled with no return code, and the amount is small relative to the program's declared monthly volume of $2,500,000.00. Program KRIs are mostly ok; pep_flagged_entities (1 of 33) and high_risk_entity_share (0.06) are flagged watch, and manual_review_aging_hours shows a breach (1434.7 hours, n=3), but these are program-level metrics not tied specifically to this entity or transfer.
What was checked. Reviewed the alert scoring and band, the entity's verification and screening status, the transfer's settlement status and return code, and the program KRI panel for corroborating signals. No prior dispositions exist for this alert.
What is recommended. Close the alert. The score is clear, the only signal is a potential PEP match with no accompanying review reasons, and the entity is verified with no high-risk flag. The transfer settled normally with no return code. The program-level manual_review_aging_hours breach is noted for separate operational follow-up but does not by itself implicate this entity or transfer.
- Recommendation
- close
- Confidence
- 0.68
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- skoor 15, band clear, hard_signal false
- single signal entity.pep_potential weight 15, no additional review reasons on entity record
- entity verification VERIFIED, high_risk false, screened 2026-06-25 (recent, pre-alert)
- transfer SETTLED, return code none, amount consistent with program payroll activity
- program KRIs mostly ok; pep_flagged_entities and high_risk_entity_share at watch but not breach; manual_review_aging_hours breach is a program-wide metric unrelated to this specific alert's evidence
- no prior dispositions on this alert to indicate recurrence
Evidence
{
"n": 405,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.