Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert b896b07b-4e9e-44d8-864f-2e599321bb84 fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector, which per routeReason is always sent to review regardless of score. The entity is tied to a single settled ACH outgoing debit of $1,715.27 (acht_sim_nort_ccu3pqzn3dr) under the Northwind Payroll program. What the evidence shows. The entity-level skoor is 20, band clear, with hard_signal false. The only contributing signal is entity.high_risk (+20). The entity record shows pep no, verification VERIFIED, review reasons none, last screened 2026-08-18. The transfer itself carries the same skoor (20, clear) with no additional signals, return code none, and status SETTLED. Program KRIs are mostly ok; a few sit at watch (hold_aging_hours, pep_flagged_entities, high_risk_entity_share) and one at breach (manual_review_aging_hours), but none of these are specific to this entity or transfer, and no prior dispositions exist for this subject. What was checked. Detector score and band, hard-signal flag, entity screening status (PEP, verification, review reasons, last screened date), transfer status and return code, program declared volume and rails, and program-level KRIs for related patterns (sanctioned_country_transfers, ach_unauthorized_return_rate, verification_denial_rate). No corroborating signal beyond the single high-risk flag was found in any of these fields. What is recommended. Close the alert. The entity is verified, not PEP, has no review reasons, and the only contributing signal is a static high-risk flag from screening with no accompanying sanctions hit, unauthorized return, or elevated KRI tied specifically to this entity or transfer. The transfer has already settled and there is no indication funds should be held. The manual_review_aging_hours breach is a program-level metric unrelated to this specific alert's evidence and does not by itself justify escalation of this single clear-band alert.

{
  "n": 1322,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}