Activity on an entity flagged by screening (PEP status no, high risk).

What happened. An alert fired on entity enti_sim_nort_91eod4q93y ("High Risk Trading 0") under the sanctions_or_pep detector due to its high-risk screening flag. The associated transfer is a settled outgoing ACH credit of $1,811.13 dated 2026-07-30, under the Northwind Payroll program. What the evidence shows. The entity is VERIFIED, PEP status is no, and there are no review reasons on file. Last screened 2026-06-26, which is within a normal screening cycle. The transfer skoor is 20, band clear, based on n=405 with confidence 1, driven solely by the entity.high_risk signal (+20). The route reason is "detector always reviewed," meaning this alert opens automatically whenever the flagged entity transacts, independent of transaction-specific risk. The transfer settled with no return code, indicating no rail-level rejection. Program KRIs show sanctioned_country_transfers=0, ach_unauthorized_return_rate=0, and stale_screening_share=0, none of which implicate this entity or transfer. Two KRIs merit note: high_risk_entity_share is at 0.061 (watch, n=33) and pep_flagged_entities=1 (watch, n=33), both program-level and not specific to this alert. manual_review_aging_hours shows breach (1434.7 hours, n=3), which reflects review queue timing, not this transaction's legitimacy. What was checked. Entity verification status, PEP flag, review reasons, and last screening date. Transfer status, return code, and skoor band. Route reason for the alert. Program-level KRIs for sanctioned-country activity, screening staleness, and high-risk share. Prior dispositions, of which there are none. What is recommended. Close this alert. The entity is verified, not PEP, has no open review reasons, and was screened within the prior two months. The transfer settled cleanly with no return code, and the transfer-level skoor sits in the clear band. The alert opened only because the detector always reviews activity on any high-risk-flagged entity, not because of a fact specific to this transfer. The elevated high_risk_entity_share and pep_flagged_entities KRIs are program-level watch items and do not point to unresolved risk in this specific alert; they may warrant separate program-level attention outside this disposition.

{
  "n": 405,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}