Alert · reviewed · open

Activity on an entity flagged by screening (PEP status no, high risk).

Detector: sanctions_or_pep
Severity: high
Program: Harbor Marketplace Payouts (simulated)
Subject: entity enti_sim_harb_skonrvy3x6
Transfer: acht_sim_harb_5mjatvj5946 · $666.69 · ach outgoing
Skoor at alert: 20 clear
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 464810cb-3f76-4b1a-bff6-e9a74a2a37e2 fired on entity enti_sim_harb_skonrvy3x6 under the sanctions_or_pep detector, which reviews this entity because screening marked it high risk. The triggering activity is one settled ACH outgoing credit transfer (acht_sim_harb_5mjatvj5946) for $666.69 USD, created 2026-09-12 and settled with no return code. What the evidence shows. The only scored signal is entity.high_risk (weight 20), producing a skoor of 20 in the clear band with hard_signal false. The entity record shows pep no, review reasons none, verification VERIFIED, country US, and a last screening date of 2026-08-27, sixteen days before the transfer. The transfer itself settled cleanly with no return code and no counterparty country on file. Program KRIs show two items at breach level (manual_review_aging_hours, ach_unauthorized_return_rate) and several at watch, but these are program-wide metrics not specific to this entity or transfer, and sanctioned_country_transfers is 0 with counterparty_concentration_top1 at 0.069, both ok. What was checked. Reviewed the alert score and band, the entity's PEP and verification status and screening recency, the transfer's status and return code, the routing reason (detector always reviews high-risk entities regardless of score), and program-level KRIs for corroborating patterns. No prior dispositions exist for this entity or alert. What is recommended. Close the alert. The evidence shows a single generic high-risk-entity flag with no PEP match, no adverse review reasons, a verified entity, and a cleanly settled transfer with no return code. The program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not tied to this entity or transfer in the evidence provided and do not by themselves indicate a pattern involving this subject; they may warrant separate program-level attention outside this alert.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Skoor 20 falls in the clear band with hard_signal false, and the only contributing signal is a generic entity.high_risk flag with weight 20.
Entity is PEP no, verification VERIFIED, and has no listed review reasons; last screened 2026-08-27, within a normal window of the 2026-09-12 transfer.
The transfer settled with no return code, and program metrics tied directly to transfer conduct (sanctioned_country_transfers=0, counterparty_concentration_top1=0.069 ok) show no corroborating adverse pattern.
This alert concerns a settled transfer, not a held one, so release is not applicable.
Two program-level KRIs are at breach (manual_review_aging_hours, ach_unauthorized_return_rate), but the evidence does not connect them specifically to this entity or transfer, so escalation is not supported by what is in this alert; confidence is held below a higher level because those breaches remain unexplained at the program level.

Evidence

{
  "n": 2070,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

Signal	Weight	Hard	Detail
entity.high_risk	+20		entity marked high risk by screening

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.