Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 57bbef7f-8d1b-4afd-94a5-f617c1bc30fb fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector, which reviews all matches regardless of score. The triggering activity was a single settled ACH outgoing debit of $997.19 USD (acht_sim_nort_a0qqjkc631y) under the Northwind Payroll program. What the evidence shows. The entity is a verified BUSINESS, high risk flagged by screening, but PEP status is no and there are no review reasons on file. Last screening was 2026-08-18, prior to the transfer date. The single scoring signal is entity.high_risk contributing +20, placing both the entity and the transfer in the clear band (skoor 20 of 1160-1163 population, hard_signal false). The transfer settled with no return code, no unauthorized or administrative return, and counterparty country is unknown but not flagged as sanctioned. Program-level KRIs are mostly ok or watch; sanctioned_country_transfers is 0 of 1048 and verification_denial_rate is 3.03%, not elevated for this entity type. What was checked. Reviewed the alert's evidence signals, the entity's screening record (PEP no, verified, no review reasons), the associated transfer status and return code, and the program KRI panel for related elevated metrics (pep_flagged_entities watch, high_risk_entity_share watch, manual_review_aging_hours breach). None of these KRIs are specific to this entity or transfer; they are program-wide and not cited as directly linked evidence in this alert. What is recommended. Close this alert. The entity is verified, not PEP, has no review reasons, and the single high-risk signal is already reflected in a clear-band score with no hard signal. The transfer has settled with no return code or unauthorized activity. No evidence here indicates a need to hold funds (transfer already settled, not eligible for release) or to escalate this specific alert as part of a broader pattern. A person should confirm no additional non-evidenced context exists before closing.

{
  "n": 1160,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}