Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 825b1638-f1b7-4beb-8ef3-3f0ead417f7c fired on the sanctions_or_pep detector for entity enti_sim_nort_91eod4q93y under the Northwind Payroll program, triggered by a single ACH outgoing credit transfer (acht_sim_nort_8ey5n4cn2wt) for $1193.41 USD that settled on 2026-08-31. What the evidence shows. The alert score is 20, band clear, with hard_signal false. The only contributing signal is entity.high_risk (+20), a static screening attribute, not a transaction-specific finding. The entity record shows verification VERIFIED, pep no, high_risk true, review reasons none, and last screened 2026-08-18, which is recent. The transfer itself settled with no return code and carries the same clear-band score of 20 with confidence 1. Route reason states this detector always routes to review regardless of score, which explains why a clear-band alert reached the queue. What was checked. Entity screening status and verification, transfer status and return code, transfer-level skoor and band, and program KRIs. Program KRIs show most metrics ok; pep_flagged_entities, high_risk_entity_share, and hold_aging_hours are flagged watch, and manual_review_aging_hours shows breach (1434.68 hours, n=10). None of these KRI entries reference this specific entity or transfer, and no prior dispositions exist for this alert. What is recommended. Close the alert. The evidence shows a clear-band score, no hard signal, a verified non-PEP entity with no adverse review reasons, and a settled transfer with no return code issues. The manual_review_aging_hours breach at the program level is a separate operational concern and should be tracked independently, not as grounds to hold this specific alert.

{
  "n": 1100,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}