Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_91eod4q93y
- Transfer
- acht_sim_nort_bpd0odvj33g · $1,849.80 · ach outgoing
- Skoor at alert
- 30 review
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 6a436b8c-e424-4cfd-9b21-2bd069ad1ce6 was generated by the sanctions_or_pep detector on entity enti_sim_nort_91eod4q93y because the entity is flagged high risk by screening. The detector always routes to review for this condition. The alert scored 30 (band review) with hard_signal false. The linked transfer is a single outgoing ACH credit of $1,849.80, created 2026-09-05 and now SETTLED with no return code.
What the evidence shows. The entity record shows BUSINESS type, verification VERIFIED, high_risk true, pep no, review reasons none, last screened 2026-08-18. The only signals driving the score are entity.high_risk (+20) and counterparty.first_time (+10); there is no sanctions match, no PEP hit, and no adverse review reason recorded. The transfer settled without a return, and the counterparty country is unknown but the transfer amount ($1,849.80) is a small fraction of the program's declared monthly volume ($2,500,000.00). Program KRIs are mostly ok; hold_aging_hours, pep_flagged_entities, and high_risk_entity_share are at watch level, and manual_review_aging_hours is in breach (1434.68 hours, n=10), but none of these are specific to this entity or this transfer.
What was checked. Reviewed the alert evidence and signal weights, the entity screening record (verification, PEP status, review reasons, last screened date), the transfer status and return code, the program's declared volume and rails, and the program-level KRI panel for related risk indicators. No prior dispositions exist for this alert.
What is recommended. Close the alert. The entity is verified, not PEP, has no open review reasons, and was screened within the last month. The transfer settled cleanly with no return. The elevated score reflects a routine high-risk-entity flag combined with a first-time counterparty, not a sanctions or PEP match. The manual_review_aging_hours breach is a program-level backlog metric unrelated to this specific alert and should be tracked separately, not held against this disposition.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- Detector fired solely on entity.high_risk; hard_signal is false and no sanctions/PEP match is present.
- Entity verification is VERIFIED, pep is no, and review reasons are none as of last screening 2026-08-18.
- Transfer is SETTLED with return code none; funds already moved and no adverse return occurred.
- Counterparty.first_time is a routine signal, not evidence of a pattern on its own.
- Program KRIs are within normal range apart from a manual_review_aging_hours breach, which reflects program-wide backlog, not this alert's transaction or entity.
Evidence
{
"n": 1188,
"band": "review",
"skoor": 30,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.