Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 4f2ac0a8-c61a-4d7d-aa68-c5fa22f426a8 fired on entity enti_sim_harb_skonrvy3x6 under the sanctions_or_pep detector because the entity is marked high risk by screening. The detector routes for review on every high-risk flag regardless of score (routeReason: detector always reviewed). The alert score is 20, band clear, hard_signal false. What the evidence shows. The entity is a BUSINESS, verification status VERIFIED, pep flag no, review reasons none, last screened 2026-08-27. The single signal driving the score is entity.high_risk (+20), which alone lands in the clear band. The associated transfer acht_sim_harb_8yd1sg7h90f is an outgoing ACH credit of $414.42 USD, status SETTLED, with no return code. The transfer-level skoor is also 20/clear with confidence 1.0 on n=2040. There are no other signals (no sanctioned-country match, no stale screening, no PEP hit). Program KRIs show two items outside normal range: manual_review_aging_hours at 1438.05 hours (breach) and ach_unauthorized_return_rate at 0.86% (breach), alongside several watch-level items (hold_aging_hours, overdraft_events, pep_flagged_entities, high_risk_entity_share). None of these KRI breaches are tied in the evidence to this specific entity or transfer. What was checked. Reviewed the alert signals, transfer details, entity screening record, and program KRI panel. Confirmed no hard signal, no PEP match, no review reasons, verification status VERIFIED, and no return code on the settled transfer. Checked prior dispositions for this alert or entity: none exist. Noted the two program-level KRI breaches but found no linkage in the evidence connecting them to this alert's subject or transaction. What is recommended. Close this alert. The evidence supports no immediate action on this entity or transfer: score is clear band, no hard signal, entity is verified and not PEP, and the transfer settled cleanly with no return. The program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are noted but are not evidenced as connected to this specific alert and should be tracked separately at the program level rather than held against this transfer.

{
  "n": 2040,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}