Activity on an entity flagged by screening (PEP status potential).

What happened. Alert 68ae8b2f-38c8-42f4-bcd6-c97050801b8e fired from the sanctions_or_pep detector on entity enti_sim_nort_sr7cv2o3u due to a potential PEP match. The alert was routed to review because this detector always routes to review, not because of the score. The linked activity is a single outgoing ACH debit of $3,141.10 (transfer acht_sim_nort_42x3377w24h), already settled, with no return code. What the evidence shows. The alert skoor is 15, banded 'clear', with hard_signal false. The transfer carries the same skoor 15 (band clear, n=781, confidence 0.955), driven solely by the entity.pep_potential signal (+15). The entity record shows verification status VERIFIED, high_risk false, review reasons none, country US, last screened 2026-06-25. The counterparty's country is listed as unknown, and no return code was posted on the settled transfer. Program-level KRIs are mostly ok: ach_overall_return_rate 0.99%, ach_unauthorized_return_rate 0%, sanctioned_country_transfers 0, reserve_coverage_ratio 2.39. Two KRIs sit in watch (pep_flagged_entities 1/33, high_risk_entity_share 6.06%) and one is in breach (manual_review_aging_hours 1434.67 hours, n=7), but none of these are specific to this entity or this transfer. What was checked. Reviewed the alert evidence block, the linked ACH transfer and its settlement/return status, the entity screening record (verification, high-risk flag, review reasons, last screened date), the program's declared volume and rail/country profile, and the full set of program KRIs for corroborating signals. No prior dispositions exist for this alert or subject. What is recommended. No evidence here indicates an unresolved PEP finding: the entity is verified, not flagged high risk, and carries no open review reasons. The transfer has already settled with no return, so there is no held transfer to release. The single watch-level program KRI on pep_flagged_entities (1 of 33) and the manual_review_aging_hours breach reflect program-wide review capacity, not this specific alert, and should be tracked separately rather than driving this disposition. Close this alert; a person should still review the program-level manual_review_aging_hours breach as a separate operational matter if not already tracked.

{
  "n": 781,
  "band": "clear",
  "skoor": 15,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}