Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_9j3wz6pz4k7 · $273.03 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_harb_azbiyidj3x2 for a potential PEP match under the sanctions_or_pep detector, tied to a single outgoing ACH transfer of $273.03 that has already settled.
What the evidence shows. The alert score is 15, banded clear, with hard_signal false. The only contributing signal is entity.pep_potential (weight 15). The entity record shows verification VERIFIED, high_risk false, review reasons none, and a screening date of 2026-06-25, about three weeks before the transfer. The transfer itself is small ($273.03), settled, domestic (US), with no return code. Program-level KRIs show pep_flagged_entities at 1 of 30 (watch) and high_risk_entity_share at 6.7% (watch), both based on a small n=30 sample, with no other unusual KRI (stale_screening_share 0, verification_denial_rate 3.3%, frozen_accounts 0, overdraft_events 0). No prior dispositions exist for this entity or alert.
What was checked. Reviewed the alert score and band, the hard-signal flag, the entity's verification and risk status, the last screening date, the transfer status and amount, the counterparty record, and the program KRI panel for corroborating patterns.
What is recommended. Close the alert. The transfer has already settled, so no hold or release action applies. The entity is verified, not flagged high risk, has no open review reasons, and was screened recently. The watch-level KRIs on PEP share and high-risk share are within a small sample and do not, on their own, indicate a broader pattern requiring escalation. If a person reviewing this alert has independent information not captured in this evidence (e.g., a name-match concern beyond the automated screen), that would warrant reopening.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Alert score 15 bands as clear and hard_signal is false, meaning the automated screen did not treat this as a confirmed match.
- Entity is VERIFIED, high_risk is false, and review reasons are none, with screening current as of 2026-06-25.
- Transfer is small ($273.03), already SETTLED, with no return code, so no funds are in a holdable state.
- Program KRIs (pep_flagged_entities, high_risk_entity_share) sit at watch level but are based on n=30, a small sample, and no other KRI (denial rate, frozen accounts, overdrafts) shows anomaly.
- No prior dispositions exist to suggest recurring concern on this entity.
Evidence
{
"n": 178,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.