Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_skonrvy3x6
- Transfer
- acht_sim_harb_6miq9ue67ef · $677.72 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 909dbe84-8488-44f0-95eb-3b1814e23dd4 was generated by the sanctions_or_pep detector on entity enti_sim_harb_skonrvy3x6 (Harbor Marketplace Payouts program) after an outgoing ACH credit of $677.72 to counterparty cpty_sim_harb_5mp0z29x6pq settled on 2026-08-21. The detector routes to review on any high-risk screening hit regardless of score, per routeReason 'detector always reviewed'.
What the evidence shows. The transfer-level skoor is 20, band clear, hard_signal false, with the only contributing signal being entity.high_risk (+20). The entity record shows verification status VERIFIED, pep flag no, review reasons none, and last screened 2026-06-26, which is within the program's stale_screening_share=0 measure. The transfer settled with no return code, indicating no rail-level rejection. Program KRIs show two items outside normal range: manual_review_aging_hours is in breach (1438.04 hrs, n=9) and ach_unauthorized_return_rate is in breach (1.18%, n=507); hold_aging_hours, pep_flagged_entities, and high_risk_entity_share are in watch status. None of these KRIs are specific to this entity or this transfer; they describe program-wide conditions.
What was checked. Reviewed the alert's skoor and signal composition, the entity's verification, PEP, and review-reason fields, the transfer's settlement status and return code, and the program KRI panel for any entity- or transfer-specific linkage to the flagged conditions. Prior dispositions for this alert: none.
What is recommended. Close this alert. The evidence for this specific entity and transfer does not show a PEP match, an active review reason, stale screening, or a returned/failed transfer. The transfer has already settled, so a hold or release action does not apply. Separately, the manual_review_aging_hours and ach_unauthorized_return_rate breaches at the program level warrant a person's attention outside this alert, since they are not explained by this entity's activity alone.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Transfer skoor 20 is band clear with hard_signal false; sole signal is entity.high_risk, no PEP or sanctioned-country signal present.
- Entity is VERIFIED, pep=no, review reasons none, last screened within current window (stale_screening_share=0).
- Transfer acht_sim_harb_6miq9ue67ef is SETTLED with no return code, so no rail-level failure indicating illicit routing.
- Program KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are program-wide metrics not tied to this entity or transfer in the evidence provided, so they support separate follow-up rather than action on this alert.
- No prior dispositions exist for this alert to indicate a recurring or escalating pattern for this entity.
Evidence
{
"n": 1351,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.