Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Meridian Remit (simulated)
- Subject
- entity enti_sim_meri_28dfpclz9pj
- Transfer
- acht_sim_meri_cds25wesae6 · $1,251.41 · ach outgoing
- Skoor at alert
- 25 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. An alert fired on entity enti_sim_meri_28dfpclz9pj under the sanctions_or_pep detector due to a potential PEP match. The linked activity is one settled outgoing ACH credit transfer of $1,251.41 dated 2026-07-24, associated with program Meridian Remit.
What the evidence shows. The entity is VERIFIED, flagged as PEP potential, but high_risk is false and review reasons list none. Last screening was 2026-06-25, within the program's stale_screening_share threshold (0.033, ok). The alert score is 25, band clear, hard_signal false. The transfer itself scored 25, band clear, confidence 0.865, driven by entity.pep_potential(+15) and counterparty.first_time(+10). The transfer settled with no return code, and counterparty country is unknown but this alone did not push the transfer out of the clear band. Program-level KRIs show no sanctioned_country_transfers (0/69), verification_denial_rate at 0.033 (ok), and reserve_coverage_ratio well above 1 (7.41). One program KRI, ach_administrative_return_rate (0.033), is flagged breach, but this is a program-wide metric with no direct link to this transfer, which had no return code. hold_aging_hours (1364.9, watch, n=1) and pep_flagged_entities (1, watch, n=30) are also program-level and not specific to this entity's activity.
What was checked. Entity verification status, PEP flag detail, screening recency, transfer status and return code, transfer-level score and signals, program declared volume and rails, and all listed program KRIs for any direct tie to this entity or transfer.
What is recommended. The transfer has already settled; there is no pending hold to release. The entity is verified, has no open review reasons, and screening is current. The clear band and absence of a hard signal indicate the evidence does not require further human review at this time. Recommend closing the alert. The program-level ach_administrative_return_rate breach is noted for separate program-level monitoring but does not by itself warrant escalation of this individual alert.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Entity is VERIFIED with high_risk=false and review reasons none.
- Screening is recent (2026-06-25), within the program's ok stale_screening_share.
- Alert and transfer both score 25, band clear, hard_signal false.
- Transfer is SETTLED with no return code; nothing is pending release.
- No sanctioned_country_transfers and no direct KRI breach tied to this entity or transfer.
- Program-level ach_administrative_return_rate breach is unrelated to this specific transfer's return code (none) and is a separate program-monitoring matter.
Evidence
{
"n": 228,
"band": "clear",
"skoor": 25,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| counterparty.first_time | +10 | first transfer with this counterparty |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.