Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 79231078-9696-451c-9a1c-eb5fa9bc7d84 fired on entity enti_sim_harb_130qwgg53wz under the sanctions_or_pep detector, severity high, score 90 (band hold), route reviewed. The entity record shows verification status DENIED with review reason sanctions_match, high risk true, pep no, last screened 2026-06-24. An ACH outgoing credit of $2,400.00 (acht_sim_harb_6mf9ak9b9ki) tied to this entity has already settled, dated 2026-08-09. What the evidence shows. The alert-level evidence lists hard_signal as false and cites only entity.high_risk (+20). The transfer-level scoring evidence for this same transfer shows a different picture: entity.denied (+60, hard), entity.high_risk (+20), and amount.gt_3x_median (+10), yielding the same skoor of 90 but with a hard signal present. The entity record confirms DENIED verification and a sanctions_match review reason, which is a more serious basis than a generic high-risk flag. The transfer has already settled with no return code, meaning funds have moved. Program KRIs show pep_flagged_entities and high_risk_entity_share at watch, manual_review_aging_hours and ach_unauthorized_return_rate at breach, but these are program-wide and not specific to this entity or transfer. What was checked. Reviewed alert evidence, transfer evidence, entity record, program KRIs, and prior dispositions. No prior dispositions exist for this alert or entity. The transfer is already SETTLED, so there is no pending hold to release. The discrepancy between the alert's hard_signal=false and the transfer's entity.denied(+60,hard) signal was noted; the entity record's DENIED verification and sanctions_match reason support the transfer-level hard signal, not the alert-level summary. What is recommended. This requires a person to review. The combination of DENIED verification, a sanctions_match review reason, and a settled $2,400.00 transfer on this entity is a sanctions-adjacent finding that the alert summary understates (it reports hard_signal false while the underlying transfer scoring shows a hard signal). Given the mismatch between alert-level and transfer-level signal reporting, and that funds already moved on a denied/sanctions-flagged entity, this should be escalated for compliance review rather than closed or held, since holding cannot stop a transfer that has already settled.

{
  "n": 954,
  "band": "hold",
  "skoor": 90,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "autoHold": true,
  "routeReason": "detector always reviewed"
}