Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_4b8an7j22jv · $1,343.71 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_nort_sr7cv2o3u under the sanctions_or_pep detector due to a potential PEP match. The associated transfer is a single ACH outgoing credit of $1343.71 USD, settled, under the Northwind Payroll program.
What the evidence shows. The alert score is 15, banded clear, with hard_signal false. The only contributing signal is entity.pep_potential at weight 15. The entity is VERIFIED, marked high_risk false, with review reasons listed as none, and was last screened 2026-06-25. The transfer itself carries the same clear-band score of 15 with high confidence (0.985, n=943) and no return code. Program-level KRIs show pep_flagged_entities at 1 of 33 entities (watch status) and high_risk_entity_share at 0.0606 (watch status), but sanctioned_country_transfers is 0 and stale_screening_share is 0. Manual_review_aging_hours shows a breach (1434.68 hours, n=7), which is a program-level operational metric not specific to this alert.
What was checked. Reviewed the alert scoring and banding, the entity verification status and screening recency, the transfer settlement status and return code, and the program KRI panel for related patterns. No prior dispositions exist for this alert. The route reason is a standing rule (detector always reviewed) rather than a risk-based escalation trigger.
What is recommended. Close this alert. The score is clear-band, the entity is verified with no open review reasons, the transfer settled without incident, and no hard signal is present. The pep_flagged_entities and high_risk_entity_share watch-level KRIs warrant periodic program monitoring but do not by themselves indicate this alert reflects a broader pattern requiring escalation. The manual_review_aging_hours breach is a separate operational metric and should be tracked independently, not as grounds to hold this transfer, which has already settled.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Alert score 15 in clear band with hard_signal false.
- Entity is VERIFIED, high_risk false, review reasons none.
- Transfer settled with no return code; transfer-level score also clear band with high confidence n=943.
- Program KRIs pep_flagged_entities and high_risk_entity_share are at watch level, not breach, and do not specifically implicate this entity or transfer beyond the single PEP-potential flag already scored.
- Manual_review_aging_hours breach is a program-wide operational metric unrelated to this specific transfer's disposition and does not block a settled transfer.
- No prior dispositions exist to indicate a recurring or escalating pattern for this entity.
Evidence
{
"n": 943,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.