Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_4p9xjqu76sc · $590.90 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Screening flagged entity enti_sim_harb_azbiyidj3x2 for a potential PEP match on program Harbor Marketplace Payouts. The alert attaches to one ACH outgoing debit of $590.90 (transfer acht_sim_harb_4p9xjqu76sc), settled on 2026-08-14, counterparty cpty_sim_harb_afaevyc853z with country unknown.
What the evidence shows. The alert score is 15, band clear, with hard_signal false; the only signal present is entity.pep_potential at weight 15. The entity record shows verification VERIFIED, high_risk false, review reasons none, and a screening date of 2026-06-25, which is within the program's stale_screening_share of 0 (no stale screenings across 30 entities). The transfer itself is settled with no return code, and program-level sanctioned_country_transfers is 0 across 889 transfers, so no direct sanctions-country exposure is indicated. The transfer amount ($590.90) is small relative to the program's declared monthly volume ($4,000,000.00).
What was checked. I checked the alert's score and band, the entity's verification and PEP status, the screening recency, the transfer's settlement status and return code, and relevant program KRIs. Program KRIs show watch-level readings for hold_aging_hours, pep_flagged_entities (1/30), and high_risk_entity_share (0.067), plus breach-level readings for manual_review_aging_hours and ach_unauthorized_return_rate. These are program-wide metrics, not specific to this entity or transfer, and no review reasons or high-risk flags attach to this entity individually. Prior dispositions: none on record.
What is recommended. Close this alert. The evidence for this specific entity and transfer is thin and does not indicate a match requiring a person's judgment: the entity is verified, not marked high risk, has no open review reasons, was screened recently, and the flagged transfer settled without incident. The transfer is already settled, so no hold or release action applies. The program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are noted for separate review but do not trace to this entity or transaction and should not drive this alert's disposition.
- Recommendation
- close
- Confidence
- 0.68
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Alert score 15, band clear, hard_signal false, single low-weight signal (entity.pep_potential +15).
- Entity verified, high_risk false, review reasons none, last screened 2026-06-25 (screening not stale per program KRI).
- Transfer settled, no return code, sanctioned_country_transfers program KRI is 0.
- Transfer amount ($590.90) is small relative to declared program volume ($4,000,000.00).
- Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are program-wide and not linked to this entity or transfer in the evidence provided.
- No prior dispositions exist for this entity to suggest a repeated pattern.
Evidence
{
"n": 1104,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| returns.entity_rate_gt_threshold | +15 | entity unauthorized return rate 1/27 originated ACH debits in 60d |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.