Activity on an entity flagged by screening (PEP status no, high risk).

What happened. An alert fired on entity enti_sim_nort_91eod4q93y because screening marked it high risk. The detector routes all such entities to review regardless of score. The alert references a settled outgoing ACH debit of $1785.53 from the Northwind Payroll program dated 2026-09-14. What the evidence shows. The entity is a verified US business with pep status no and no review reasons noted; last screened 2026-08-18. The only signal present is entity.high_risk (+20 weight), producing a skoor of 20, which falls in the clear band. Hard signal is false. The transfer itself carries the same clear-band skoor of 20, settled with no return code, to a counterparty whose country is unknown. Program-level KRIs show high_risk_entity_share at 0.0606 (watch, n=33), pep_flagged_entities at 1 (watch, n=33), manual_review_aging_hours at 1434.69 (breach, n=12), and hold_aging_hours at 518.29 (watch, n=1). Other KRIs (return rates, sanctioned_country_transfers, reserve_coverage_ratio, verification_denial_rate) are within ok range. What was checked. Reviewed the alert's signal composition and score band, the entity's verification and PEP status, the transfer's status and return code, the counterparty country field, and the program-level KRI panel including manual review aging and high-risk entity share. No prior dispositions exist for this alert. What is recommended. The transfer already settled, so no funds are held pending this alert; it is not a case where 'release' applies. The entity-level evidence (verified, not PEP, no review reasons, clear band, no hard signal) does not on its own require a person to intervene on this specific alert. However, manual_review_aging_hours is in breach and high_risk_entity_share and pep_flagged_entities are at watch, which point to a broader program-level pattern beyond this single alert. This alert can be closed on its own facts, but the KRI breach warrants separate escalation of the review-aging backlog at the program level, not through this alert.

{
  "n": 1403,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}