Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_5zpkr2fr3bh · $1,887.33 · ach outgoing
- Skoor at alert
- 25 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_nort_sr7cv2o3u ("Potential Pep 0") under the sanctions_or_pep detector due to a potential PEP match. The alert is linked to a single settled ACH outgoing debit of $1,887.33 to counterparty cpty_sim_nort_43imfau33bh, dated 2026-09-08, within the Northwind Payroll program.
What the evidence shows. The alert-level skoor is 25, band clear, with hard_signal false. The only contributing signal is entity.pep_potential (weight 15). The transfer itself carries a skoor of 25, band clear, with signals entity.pep_potential(+15) and counterparty.first_time(+10). The entity is VERIFIED, high_risk is false, review reasons are none, and last screened 2026-09-01. The transfer status is SETTLED with no return code, so no funds are pending or held. The counterparty's country is unknown, but there is no sanctioned-country signal and sanctioned_country_transfers program-wide is 0. Program KRIs show pep_flagged_entities at 1 of 33 (watch) and high_risk_entity_share at 0.061 (watch), but these are aggregate watch-level metrics, not breaches, and no other entity or transfer ties to this alert.
What was checked. Reviewed the alert evidence, entity screening status, the single linked transfer and its skoor/signals, and program KRIs for related sanctions or PEP patterns. Found no hard signal, no high-risk designation, no stale screening, no sanctioned-country transfers, and no prior dispositions on this entity.
What is recommended. The transfer has already settled, so no funds are available to hold. The entity is verified with a clear band score and no elevated review reasons. The PEP match is potential only, with no hard signal or corroborating high-risk indicator. This does not meet the threshold for escalation, as no pattern beyond this single low-weight signal is evidenced. Recommend closing the alert; a person should confirm the PEP screening result independently given the watch-level pep_flagged_entities KRI, but nothing in this evidence requires holding funds already settled.
- Recommendation
- close
- Confidence
- 0.62
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- Alert skoor 25, band clear, hard_signal false
- Entity is VERIFIED, high_risk false, review reasons none, screened recently (2026-09-01)
- Linked transfer is SETTLED with no return code; no funds are held or held-eligible, so 'release' does not apply
- Only contributing signal is entity.pep_potential(+15), a potential (not confirmed) PEP match
- Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level but not breach, and no sanctioned-country or return anomalies tie to this entity
- No prior dispositions exist to indicate a recurring pattern for this specific entity
Evidence
{
"n": 1278,
"band": "clear",
"skoor": 25,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.