Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_axsel60zsw · $4,020.72 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Sanctions/PEP screening flagged entity enti_sim_nort_sr7cv2o3u for a potential PEP match. The alert is tied to one ACH outgoing debit of $4020.72 from this entity, settled on 2026-07-21.
What the evidence shows. The alert scored 15, placing it in the clear band, with hard_signal false. The only contributing signal is entity.pep_potential (weight 15). The entity record shows verification status VERIFIED, high_risk false, and review reasons listed as none, with last screening on 2026-06-25. The transfer is SETTLED with no return code, so there are no funds to hold or release. Counterparty country is listed as unknown, which is a data gap but not paired with any other risk signal on this transfer (transfer-level skoor is also 15, band clear, confidence 0.775).
What was checked. Reviewed the entity screening detail, transfer status and return code, transfer-level score, and program KRIs. Program KRIs show pep_flagged_entities at 1 of 33 (watch) and high_risk_entity_share at 0.061 (watch), and manual_review_aging_hours at 1434.7 hours (breach, n=1). These are program-wide metrics and are not specific to this entity or transfer; the entity itself carries no high-risk or stale-screening flag (stale_screening_share program-wide is 0, ok). No prior dispositions exist for this alert.
What is recommended. Close the alert. The evidence shows a clear-band score, no hard signal, a verified entity with no open review reasons, and a settled transfer with no return code. The counterparty country gap and the program-level manual_review_aging_hours breach are noted for awareness but do not point to unresolved risk on this specific alert. A person should confirm these program-level watch/breach metrics are being tracked separately, since they span the whole program rather than this subject alone.
- Recommendation
- close
- Confidence
- 0.78
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Score 15 in clear band with hard_signal false and only one low-weight signal (entity.pep_potential +15).
- Entity verification is VERIFIED, high_risk is false, and review_reasons is none.
- Transfer is already SETTLED with no return code; there are no funds pending that would call for a hold or release.
- Program KRI watch/breach items (pep_flagged_entities, high_risk_entity_share, manual_review_aging_hours) are program-wide and not specific to this entity or transfer.
- No prior dispositions exist to indicate a recurring pattern for this specific subject.
Evidence
{
"n": 221,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.