Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert bc4327fa-bd50-44fa-8610-5b0e49e558af fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector after a $1,858.94 outgoing ACH credit (acht_sim_nort_qlu0zzx1e6) settled under the Northwind Payroll program on 2026-07-31. The detector routes to review on every trigger regardless of score. What the evidence shows. The entity is a verified US business flagged high risk by screening but not PEP, with no review reasons listed and a last screening date of 2026-06-26. The only contributing signal is entity.high_risk (weight 20), producing a skoor of 20 in the clear band with hard_signal false. The transfer itself settled with no return code and the counterparty country is unknown but not flagged as sanctioned. Program-level KRIs show sanctioned_country_transfers at 0 (n=313) and ach_unauthorized_return_rate at 0, consistent with no adverse outcome tied to this transfer. What was checked. Reviewed the alert score and band, the single contributing signal, entity verification and PEP status, transfer status and return code, and program KRIs including pep_flagged_entities (watch, 1/33), high_risk_entity_share (watch, 0.061), stale_screening_share (ok, 0), and manual_review_aging_hours (breach, 1434.67 hours). These KRIs are program-wide metrics, not specific to this entity or transfer, and no prior dispositions exist for this alert. What is recommended. Close this alert. The evidence supports no immediate action on this specific transfer: entity is verified, not PEP, screening is current, transfer settled cleanly with no return, and the score sits in the clear band with only one low-weight signal. The manual_review_aging_hours breach and the two watch-level KRIs (pep_flagged_entities, high_risk_entity_share) are program-level conditions that a person should track separately; they do not point to a pattern specific to this alert or entity.

{
  "n": 458,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}