Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 789676b8-d6c7-4259-8bd6-769b440d8bc2 fired on entity enti_sim_meri_5if3mzfr9pn (BUSINESS 'High Risk Trading 2') under the sanctions_or_pep detector, triggered by a single ACH outgoing debit transfer acht_sim_meri_blkp8g6fc4x for $559.23 USD, settled on 2026-09-11. The detector routes to review by rule ('detector always reviewed'), not because of score. What the evidence shows. The only signal present is entity.high_risk (+20), producing a skoor of 20 in the 'clear' band with hard_signal false. The entity record shows pep=no, verification=VERIFIED, review reasons=none, and last screened 2026-08-27, which is before the transfer date, so screening was current at time of activity. The transfer itself settled normally with no return code. Counterparty country is unknown, and no sanctioned-country or watchlist match is recorded on this transfer or entity. Program-level KRIs show several breaches (reserve_coverage_ratio 0.497, manual_review_aging_hours 1146.9h, ach_unauthorized_return_rate 0.98%, sanctioned_country_transfers=2 of 876), but none of these KRIs reference this entity or this transfer specifically, and pep_flagged_entities and high_risk_entity_share are both in 'watch' or normal range, not tied to this alert. What was checked. Reviewed the alert evidence payload, the entity screening record, the transfer record and its skoor breakdown, program declared volume and rails, program KRI snapshot, and prior dispositions (none found for this alert). What is recommended. Close the alert. The entity is verified, not PEP, has no review reasons, and screening predates the transfer. The single high-risk signal is low weight and the composite score sits in the clear band with no hard signal. The transfer has already settled with no return, so there are no funds to hold or release. The program-level KRI breaches (reserve coverage, unauthorized returns, sanctioned-country transfer count) are worth separate program-level monitoring but do not attach to this specific entity or transfer and should not block closing this alert on its own evidence.

{
  "n": 964,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}