Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_91eod4q93y
- Transfer
- acht_sim_nort_1pgbpfme10i · $3,308.60 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert af8bdf01-8409-4e4e-acfc-248c09df5886 fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector because screening marked the entity high risk. The alert score is 20 in the clear band with hard_signal false, and the route reason is that this detector is always reviewed regardless of score.
What the evidence shows. The entity is a verified business, not flagged PEP, with no review reasons listed and a last screening date of 2026-06-26. The only contributing signal is entity.high_risk at weight 20, which alone keeps the alert in the clear band (n=281, confidence 0.925). The associated ACH transfer (acht_sim_nort_1pgbpfme10i) for $3,308.60 has already settled with no return code, so there is no pending transfer to hold or release. Program-level KRIs show pep_flagged_entities and high_risk_entity_share at watch level, and manual_review_aging_hours in breach, but these are aggregate program metrics, not evidence tied to this specific entity or transfer.
What was checked. Reviewed the alert score and signal composition, the entity's verification and PEP status, the settled transfer's status and return code, and the program KRI panel for any related breach that would implicate this entity or transfer. Prior dispositions: none on record.
What is recommended. Close the alert. The entity is verified, not PEP, and the sole signal is a low-weight high-risk flag already reflected in a clear-band score. The transfer has settled with no return code, so there is no fund movement to act on. The program-level KRI watches (pep_flagged_entities, high_risk_entity_share, manual_review_aging_hours) are not specific to this entity and warrant separate program-level review rather than action on this alert.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Score 20 falls in the clear band with hard_signal false, and the only signal is entity.high_risk at weight 20.
- Entity is VERIFIED, PEP status is no, and review reasons are none.
- The related transfer is SETTLED with no return code, so no funds are held or in a state requiring release.
- Program KRI watches on pep_flagged_entities and high_risk_entity_share are aggregate signals, not specific evidence against this entity, and do not on their own justify escalation of this single alert.
- Prior dispositions are none, so there is no pattern of repeat alerts on this entity to suggest escalation.
Evidence
{
"n": 281,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.