SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

Activity on an entity flagged by screening (PEP status potential).

Detector
sanctions_or_pep
Severity
high
Program
Lantern Lending (simulated)
Subject
entity enti_sim_lant_866sn4vcjd
Transfer
acht_sim_lant_qsp2qaheg8 · $1,004.64 · ach outgoing
Skoor at alert
25 clear
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:32Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. Alert 7ed9acfc-7480-4079-be25-0dcde68e5a38 was opened on 2026-09-17 by the sanctions_or_pep detector, which reviews every match it produces regardless of score (routeReason: 'detector always reviewed'). The subject is entity enti_sim_lant_866sn4vcjd, a person flagged with a potential PEP status. The triggering activity is one outgoing ACH debit, acht_sim_lant_qsp2qaheg8, for $1004.64, created 2026-09-14 and now in SETTLED status with no return code. What the evidence shows. The transfer scored 25, in the 'clear' band, with hard_signal false and n=788 supporting observations. The only two contributing signals are entity.pep_potential (+15) and counterparty.first_time (+10); neither is a hard signal. The entity record shows verification VERIFIED, high_risk false, review reasons none, and a screening date of 2026-09-01, sixteen days before this alert. The counterparty's country is unknown, which is a data gap but not itself a signal in the evidence. Program KRIs show pep_flagged_entities at 1 of 33 entities (watch) and manual_review_aging_hours in breach at 1433.6 hours (n=8), but these are program-level backlog metrics, not evidence tied to this specific entity or transfer. What was checked. Reviewed the alert scoring and signal detail, the transfer record and its settlement/return status, the entity's verification and screening history, program KRIs for related risk indicators, and prior dispositions. Prior dispositions: none on record for this subject. What is recommended. The transfer has already settled, so there is no held transfer to release or hold. The score is in the clear band with no hard signal, the entity is verified with no listed review reasons, and screening is recent. Nothing in the evidence indicates confirmed PEP or sanctions status requiring further transaction restriction. Close the alert. Separately flag the manual_review_aging_hours breach (1433.6 hours, n=8) to the program owner as a backlog issue independent of this alert, since it is not addressed by this disposition.
Recommendation
close
Confidence
0.72
Model
claude-sonnet-5
Drafted
2026-09-17 19:32Z
Rationale
  • Score 25 falls in the 'clear' band with hard_signal false, based on n=788 observations.
  • Entity is VERIFIED, high_risk is false, and review reasons are listed as none as of the 2026-09-01 screening, 16 days before alert open.
  • The only signals present (entity.pep_potential +15, counterparty.first_time +10) are non-hard signals and together remain in the clear band.
  • Transfer acht_sim_lant_qsp2qaheg8 is SETTLED with no return code, so no funds are pending and 'hold' or 'release' do not apply.
  • Program KRIs (pep_flagged_entities=1/33 watch, manual_review_aging_hours breach) reflect portfolio-level conditions, not entity- or transfer-specific evidence, and do not on their own justify escalation of this single alert.
  • Counterparty country is unknown, a data gap noted for completeness but not a scored signal in this alert.

Evidence

{
  "n": 788,
  "band": "clear",
  "skoor": 25,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}

Skoor signals

SignalWeightHardDetail
entity.pep_potential+15potential PEP match
counterparty.first_time+10first transfer with this counterparty

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.