Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_skonrvy3x6
- Transfer
- acht_sim_harb_81whrf195qh · $752.05 · ach outgoing
- Skoor at alert
- 30 review
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert b2c3daf8-3132-4f0b-a578-77a3181d4a79 fired on entity enti_sim_harb_skonrvy3x6 ("High Risk Trading 1") under the sanctions_or_pep detector, which the routeReason indicates always routes to review. The alert scored 30 (band review, hard_signal false) driven by entity.high_risk(+20) and counterparty.first_time(+10) on ACH outgoing credit acht_sim_harb_81whrf195qh for $752.05 USD, which has already settled with no return code.
What the evidence shows. The entity record shows verification VERIFIED, pep no, review reasons none, and last screened 2026-06-26, which is prior to the alert but not flagged as stale (stale_screening_share=0.00 across n=30). The high_risk flag itself is the only adverse signal; there is no sanctions match, no PEP hit, and no return code on the settled transfer. The counterparty country is unknown but no sanctioned_country_transfers were recorded program-wide (0 of n=426). Program KRIs show high_risk_entity_share and pep_flagged_entities at watch level, and manual_review_aging_hours in breach (1438 hours, n=3), but these are program-wide metrics not tied specifically to this alert or entity.
What was checked. Reviewed the alert evidence, transfer record, entity record, program declared volume/rails/countries, program KRIs, and prior dispositions (none on file). Confirmed the transfer settled without a return code and that the score (30) reflects only the generic high-risk label plus a first-time counterparty, not a confirmed sanctions or PEP match.
What is recommended. Close this alert. The entity is verified, not PEP, has no adverse screening reasons, and the transfer settled cleanly with no return code. The only signals present are a generic high-risk classification and a first-time counterparty, both of which are already reflected in the review-band score of 30 with hard_signal false. No transfer is currently held, so release does not apply. The manual_review_aging_hours breach is a program-level condition that should be tracked separately and is not evidence specific to this entity or transfer.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity is VERIFIED, pep no, and has no review reasons listed.
- Screening is not stale (stale_screening_share=0.00, n=30).
- Transfer acht_sim_harb_81whrf195qh settled with return code none.
- Alert score (30) is driven only by entity.high_risk and counterparty.first_time, with hard_signal false.
- No sanctioned_country_transfers recorded program-wide (0 of n=426).
- Program-level manual_review_aging_hours breach and watch-level KRIs are not directly tied to this specific entity or transfer and warrant separate tracking, not escalation of this alert.
Evidence
{
"n": 650,
"band": "review",
"skoor": 30,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.