Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_1dls3vbb3o0 · $2,767.21 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:32Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 82e7d571-9240-461c-8e61-11cec3b979a8 was opened on 2026-09-17 for entity enti_sim_nort_sr7cv2o3u under the sanctions_or_pep detector, following a settled outgoing ACH credit of $2767.21 on transfer acht_sim_nort_1dls3vbb3o0 dated 2026-09-16. The detector always routes to review regardless of score, per routeReason.
What the evidence shows. The only signal present is entity.pep_potential (weight 15), producing a skoor of 15 in the 'clear' band with hard_signal false. The entity record shows verification status VERIFIED, high_risk false, review reasons none, and last screened 2026-09-01, sixteen days before the transfer. Country is US, not a sanctioned jurisdiction, and the counterparty country is unknown but the transfer shows no return code and settled normally. The transfer amount is well within the program's declared monthly volume of $2,500,000.00.
What was checked. Transfer status and return code, entity verification and risk flags, screening recency, program KRIs, and prior dispositions. Program KRIs show sanctioned_country_transfers=0 (n=1333, ok) and stale_screening_share=0 (n=33, ok), so this entity's screening is current relative to the program. pep_flagged_entities sits at 1 of 33 (watch) and high_risk_entity_share at 0.061 (watch), both program-level metrics, not specific findings against this entity. manual_review_aging_hours shows a breach (1434.7 hours, n=13) but this reflects program-wide review backlog, not this alert's own evidence. No prior dispositions exist for this entity or transfer.
What is recommended. Close the alert. The transfer has already settled, so there is no pending transaction to hold or release. No hard signal is present, the entity is verified with no adverse review reasons, and the score falls in the clear band. The program-level manual_review_aging_hours breach should be tracked separately by the program owner as an operational metric, not as grounds to hold this individual alert.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:32Z
- Rationale
- skoor 15 in clear band with hard_signal false
- entity verification VERIFIED, high_risk false, review reasons none
- screening dated 2026-09-01, within 33-entity program's stale_screening_share=0
- transfer already SETTLED with no return code, so hold/release does not apply
- no prior dispositions to indicate repeat pattern for this specific entity
- program-wide KRI watches (pep_flagged_entities, high_risk_entity_share, manual_review_aging_hours) are noted but are not specific to this alert's evidence
Evidence
{
"n": 1444,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.