Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert 8733cfe0-6cd0-4aed-a37d-24ff43b2ac8c fired on the sanctions_or_pep detector for entity enti_sim_nort_91eod4q93y, a verified US business ("High Risk Trading 0") under the Northwind Payroll program, tied to an outgoing ACH debit of $3,304.49 (acht_sim_nort_yfms4fl3li) that settled on 2026-09-13. The detector routes to review by policy regardless of score, so the route reflects a standing rule, not a specific risk finding. What the evidence shows. The only signal present is entity.high_risk (+20), producing a skoor of 20 in the clear band with hard_signal false. The entity's PEP status is no, review reasons are none, verification status is VERIFIED, last screened 2026-08-18, and country is US. The transfer settled with no return code, and program-level sanctioned_country_transfers is 0 across 1,280 transfers. Counterparty country is unknown but no sanctioned-country or return-code evidence exists to indicate an issue with this specific transfer. What was checked. Entity screening fields (PEP, review reasons, verification, last screened date), transfer status and return code, transfer-level skoor and band, and program KRIs. Program KRIs show high_risk_entity_share (0.061, watch) and pep_flagged_entities (1/33, watch) at elevated but not breach levels, and manual_review_aging_hours (1434.7h, breach) and hold_aging_hours (518.3h, watch) as operational queue metrics. These are program-wide operational indicators, not evidence specific to this entity or this transfer, and no prior dispositions exist for this alert. What is recommended. No hold is warranted: the transfer already settled, the entity is verified, not PEP, has no review reasons, and the score sits in the clear band with hard_signal false. The single high_risk flag is already reflected in the score and is the expected basis for this always-review detector. The program-level manual_review_aging_hours breach is a separate operational metric that a person may want to track outside this alert, but it does not attach to this entity or transfer. Recommend closing this alert.

{
  "n": 1383,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}