Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_2g66zs4p5l2 · $238.09 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. A sanctions/PEP screening alert fired on entity enti_sim_harb_azbiyidj3x2 ("Potential Pep 1") tied to an outgoing ACH transfer of $238.09 from program Harbor Marketplace Payouts, settled on 2026-07-29. The detector routes to review on every hit regardless of score.
What the evidence shows. The transfer score is 15, band clear, hard_signal false, driven solely by the entity.pep_potential signal (weight 15). The entity is VERIFIED, high_risk is false, review reasons are none, and it was last screened 2026-06-25, about a month before the transfer. The transfer itself settled with no return code. Counterparty country is unknown but the transfer carries no sanctioned-country or return-rate flags at the program level.
What was checked. Program KRIs show sanctioned_country_transfers=0 (n=352, ok), ach_unauthorized_return_rate=0 and ach_overall_return_rate=0.019 (both ok), and stale_screening_share=0 (n=30, ok), meaning screening currency is not a program-wide problem. pep_flagged_entities=1 (n=30, watch) and high_risk_entity_share=0.067 (n=30, watch) are elevated at the program level but this specific entity is not marked high_risk. manual_review_aging_hours=1438 (n=2, breach) reflects a backlog in manual review generally, not specific evidence against this entity or transfer. Prior dispositions: none on record.
What is recommended. Close the alert. The entity is verified, recently screened, not marked high_risk, and has no open review reasons. The associated transfer is small ($238.09), settled, and shows no return or sanctioned-country signal. The transfer is not on hold, so no release action applies. The program-level PEP watch metrics (pep_flagged_entities, high_risk_entity_share) and the manual_review_aging_hours breach are worth a person's attention at the program level but do not, on their own, indicate this specific alert needs to remain open.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Score 15, band clear, hard_signal false; only signal is entity.pep_potential.
- Entity is VERIFIED, high_risk=false, review reasons=none, last screened one month before the transfer.
- Transfer is SETTLED with no return code; program shows 0 sanctioned-country transfers and 0 unauthorized return rate.
- Transfer is not held, so 'release' does not apply.
- Program-level pep_flagged_entities and high_risk_entity_share are in 'watch' status, and manual_review_aging_hours is in breach, but these are program-wide metrics not directly tied to adverse findings on this entity or transfer.
- Counterparty country is unknown, which is a minor evidentiary gap; confidence is set below 0.8 to reflect this.
Evidence
{
"n": 591,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.