SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Activity on an entity flagged by screening (PEP status potential).

Detector
sanctions_or_pep
Severity
high
Program
Northwind Payroll (simulated)
Subject
entity enti_sim_nort_sr7cv2o3u
Transfer
acht_sim_nort_5zpkr2fr3bh · $1,887.33 · ach outgoing
Skoor at alert
25 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:31Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. An alert fired on entity enti_sim_nort_sr7cv2o3u ("Potential Pep 0") under the sanctions_or_pep detector due to a potential PEP match. The alert is linked to a single settled ACH outgoing debit of $1,887.33 to counterparty cpty_sim_nort_43imfau33bh, dated 2026-09-08, within the Northwind Payroll program. What the evidence shows. The alert-level skoor is 25, band clear, with hard_signal false. The only contributing signal is entity.pep_potential (weight 15). The transfer itself carries a skoor of 25, band clear, with signals entity.pep_potential(+15) and counterparty.first_time(+10). The entity is VERIFIED, high_risk is false, review reasons are none, and last screened 2026-09-01. The transfer status is SETTLED with no return code, so no funds are pending or held. The counterparty's country is unknown, but there is no sanctioned-country signal and sanctioned_country_transfers program-wide is 0. Program KRIs show pep_flagged_entities at 1 of 33 (watch) and high_risk_entity_share at 0.061 (watch), but these are aggregate watch-level metrics, not breaches, and no other entity or transfer ties to this alert. What was checked. Reviewed the alert evidence, entity screening status, the single linked transfer and its skoor/signals, and program KRIs for related sanctions or PEP patterns. Found no hard signal, no high-risk designation, no stale screening, no sanctioned-country transfers, and no prior dispositions on this entity. What is recommended. The transfer has already settled, so no funds are available to hold. The entity is verified with a clear band score and no elevated review reasons. The PEP match is potential only, with no hard signal or corroborating high-risk indicator. This does not meet the threshold for escalation, as no pattern beyond this single low-weight signal is evidenced. Recommend closing the alert; a person should confirm the PEP screening result independently given the watch-level pep_flagged_entities KRI, but nothing in this evidence requires holding funds already settled.
Recommendation
close
Confidence
0.62
Model
claude-sonnet-5
Drafted
2026-09-17 19:32Z
Rationale
  • Alert skoor 25, band clear, hard_signal false
  • Entity is VERIFIED, high_risk false, review reasons none, screened recently (2026-09-01)
  • Linked transfer is SETTLED with no return code; no funds are held or held-eligible, so 'release' does not apply
  • Only contributing signal is entity.pep_potential(+15), a potential (not confirmed) PEP match
  • Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level but not breach, and no sanctioned-country or return anomalies tie to this entity
  • No prior dispositions exist to indicate a recurring pattern for this specific entity

Evidence

{
  "n": 1278,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

SignalWeightHardDetail
entity.pep_potential+15potential PEP match
counterparty.first_time+10first transfer with this counterparty

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.