Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 58346d17-91da-4306-b775-794e08cfea2e fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector after a $2,117.52 outgoing ACH debit (acht_sim_nort_7g8jt9omvv) settled on 2026-07-22 under the Northwind Payroll program. The alert is routed for review because this detector is always reviewed, not because the score triggered escalation. What the evidence shows. The entity screening record shows PEP status no, high risk true, verification VERIFIED, review reasons none, and last screened 2026-06-26T12:01:30.000Z. The single contributing signal is entity.high_risk (+20), producing a skoor of 20 in the clear band with hard_signal false. The transfer itself carries the same skoor of 20, clear band, with confidence 0.865 on n=246. The transfer settled with no return code, and sanctioned_country_transfers at the program level is 0 (n=38, ok). Counterparty country is listed as unknown, but no sanctions or country-risk signal fired on the transfer or entity. What was checked. I checked the entity screening fields (PEP, verification, review reasons, last screened date), the transfer status and return code, the skoor/band/hard_signal fields for both alert and transfer, and the program KRI panel. Program KRIs are mostly ok or watch: high_risk_entity_share 0.061 (watch, n=33), pep_flagged_entities 1 (watch, n=33), manual_review_rate 0.026 (watch, n=38), verification_denial_rate 0.030 (ok), stale_screening_share 0 (ok), ach return rates 0 (ok), sanctioned_country_transfers 0 (ok). One KRI, manual_review_aging_hours, shows breach status but n=1, which is too thin to draw a program-level conclusion and is not tied to this specific alert. Prior dispositions: none on file. What is recommended. Close this alert. The entity is verified, not PEP, has no open review reasons, and was screened within the last two months. The only contributing signal is a static high-risk flag, which alone produced a clear-band score with no hard signal. The transfer settled normally with no return code and no sanctioned-country involvement. The counterparty country being unknown is a data gap worth flagging for screening data quality, but it does not by itself warrant holding funds already settled or escalating, since no pattern signal (PEP watch count, high-risk share) has breached at the program level.

{
  "n": 246,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}