Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Meridian Remit (simulated)
- Subject
- entity enti_sim_meri_5if3mzfr9pn
- Transfer
- acht_sim_meri_9xaydf4cabj · $300.30 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert 9e571e0a-17c7-4c2d-9a66-81bcde5f1bde fired on entity enti_sim_meri_5if3mzfr9pn under the sanctions_or_pep detector because screening marked the entity high risk. The entity is not flagged as PEP. The alert is tied to one ACH outgoing credit transfer, acht_sim_meri_9xaydf4cabj, for $300.30, which has already settled with no return code.
What the evidence shows. The transfer-level skoor is 20, band clear, with a single contributing signal: entity.high_risk (+20). Hard signal is false. The entity record shows verification VERIFIED, high risk true, pep no, no review reasons, and last screened 2026-06-26, which is within the program's normal screening cadence. Program KRI stale_screening_share is 0.033 (ok) and high_risk_entity_share is 0.033 (ok), indicating this entity is not an outlier within the program. Most other KRIs are ok; ach_administrative_return_rate shows a breach at 0.033 but this is based on n=30 and is not tied to this transfer, which had no return. There are no prior dispositions on this alert.
What was checked. Reviewed the alert evidence and signal weights, the transfer status and return code, the entity's verification and screening status, the program's declared volume and rails, and the full set of program KRIs for any pattern connecting to this entity or transfer.
What is recommended. The transfer has already settled and no hold is in place, so release does not apply. The single signal driving the alert (entity.high_risk) is already accounted for in the clear-band skoor, verification is current, and there is no sanctions or PEP match. No pattern across the program's KRIs points to this entity beyond the isolated administrative-return-rate breach, which is unrelated to this transfer. Close the alert.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Skoor 20 is in the clear band with only one contributing signal (entity.high_risk, +20); hard_signal is false.
- Entity is VERIFIED, pep no, with no review reasons and a recent screening date (2026-06-26), showing no active sanctions/PEP concern.
- The associated transfer is SETTLED with no return code, so there is no pending movement to hold or release.
- Program KRIs for high_risk_entity_share and stale_screening_share are both 0.033 and marked ok, showing this entity is not part of a broader pattern.
- The one KRI breach (ach_administrative_return_rate) is unrelated to this entity's transfer and does not by itself indicate a pattern tied to this alert.
- No prior dispositions exist to suggest recurring concern for this entity.
Evidence
{
"n": 202,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.