Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Lantern Lending (simulated)
- Subject
- entity enti_sim_lant_866sn4vcjd
- Transfer
- acht_sim_lant_1tg97qee09 · $735.33 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A sanctions/PEP detector alert was opened on entity enti_sim_lant_866sn4vcjd following a $735.33 outgoing ACH credit transfer (acht_sim_lant_1tg97qee09) that settled on 2026-08-29. The alert routed to review because this detector always routes to review, not because of an elevated score.
What the evidence shows. The entity screening evidence shows a potential PEP match only, contributing the full alert score of 15, which sits in the clear band (n=576, confidence=1). Hard signal is false. The entity record shows verification status VERIFIED, high_risk false, and review reasons listed as none. Last screening date is 2026-06-25, about three months before the transfer and about 84 days before the alert opened; the program's own stale_screening_share KRI reads 0 (ok), so this screening is not considered stale by program threshold. The transfer itself settled with no return code and no signals beyond the entity-level PEP flag. Program KRI pep_flagged_entities is 0.030 (1 of 33, watch band) but this is a program-wide metric, not evidence of wrongdoing specific to this entity or transfer.
What was checked. Reviewed the detector evidence and score band, the entity's verification status, high-risk flag, and review reasons, the screening recency against the stale_screening_share KRI, the transfer's status and return code, and the program KRI panel for related breaches. The only breach-level KRI (manual_review_aging_hours, n=5) reflects review processing time across the program and is not tied to this entity or transfer's underlying risk facts. No prior dispositions exist for this alert.
What is recommended. Close the alert. The score is in the clear band, hard signal is false, the entity is verified with no open review reasons and no high-risk flag, screening is not flagged as stale, and the associated transfer settled cleanly with no return code. Nothing in the evidence indicates a person needs to intervene before this closes, though the program-level manual_review_aging_hours breach may warrant separate operational attention outside this alert.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Detector score 15 falls in the clear band with hard_signal false.
- Entity verification is VERIFIED, high_risk is false, and review reasons field is empty.
- Screening recency (2026-06-25) does not trigger the program's stale_screening_share KRI, which reads 0.
- Transfer acht_sim_lant_1tg97qee09 settled with no return code and no additional risk signals.
- Route reason states this detector always routes to review, meaning the review routing itself is not evidence of elevated risk.
- Program-wide KRI breach (manual_review_aging_hours) is unrelated to this specific entity or transfer's risk facts.
Evidence
{
"n": 576,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.