Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_skonrvy3x6
- Transfer
- acht_sim_harb_32rdowfx63d · $415.48 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 865f1193-1667-4822-b9dc-076f915052f1 was generated by the sanctions_or_pep detector on entity enti_sim_harb_skonrvy3x6 (Harbor Marketplace Payouts program). The detector routes to review by policy regardless of score ('detector always reviewed'). The triggering activity is an outgoing ACH debit transfer acht_sim_harb_32rdowfx63d for $415.48 USD, already SETTLED, with no return code.
What the evidence shows. The transfer skoor is 20, band clear, hard_signal false, based on a single signal: entity.high_risk (+20). The entity record shows BUSINESS type, verification VERIFIED, high_risk true, pep no, no review reasons, and last screened 2026-06-26. There is no adverse screening detail beyond the high-risk flag itself, and the transfer settled cleanly with no return code, so no rail-level exception occurred. Program KRIs show most metrics ok; pep_flagged_entities and high_risk_entity_share are at watch level, and manual_review_aging_hours and ach_unauthorized_return_rate are at breach level, but these are program-wide figures not specific to this entity or transfer.
What was checked. Reviewed the alert scoring and signal detail, the transfer record and settlement status, the entity screening profile (verification, PEP status, review reasons, screening date), and the program-level KRI panel for corroborating patterns. Prior dispositions: none on file for this alert or entity.
What is recommended. No evidence here indicates unresolved sanctions or PEP exposure requiring a person to intervene before funds move; the transfer has already settled with no return. The entity is verified with no review reasons and screening is current (within the last three months). Recommend closing this alert. Separately, the program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not tied to this specific alert but may warrant independent monitoring outside this disposition.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Skoor 20, band clear, hard_signal false; only signal is entity.high_risk with no additional adverse detail.
- Entity is VERIFIED, pep no, review reasons none, last screened 2026-06-26 (recent).
- Transfer acht_sim_harb_32rdowfx63d is SETTLED with return code none; nothing pending to hold or release.
- Route reason is procedural ('detector always reviewed'), not evidence of elevated risk on this specific activity.
- Program KRI watch/breach items (pep_flagged_entities, high_risk_entity_share, manual_review_aging_hours, ach_unauthorized_return_rate) are aggregate and not directly attributable to this entity or transfer; insufficient basis to escalate this specific alert.
- No prior dispositions exist to indicate a recurring pattern for this entity.
Evidence
{
"n": 791,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.