Activity on an entity flagged by screening (PEP status no, high risk).

What happened. An entity screening detector flagged entity enti_sim_nort_91eod4q93y (BUSINESS "High Risk Trading 0") under the sanctions_or_pep detector due to a high-risk designation. The alert cites one settled outgoing ACH debit of $2014.33 from transfer acht_sim_nort_7bdozpf2q3, created 2026-08-27, with counterparty cpty_sim_nort_25c8izfo4a (country unknown). What the evidence shows. The alert-level score is 60 (band review), driven solely by entity.high_risk (+20); hard signal is false and PEP status is no. The entity is VERIFIED, has no review reasons, and was last screened 2026-08-18, which is before the transfer date. At the transfer level, the score is also 60 (review), but the signal composition differs: entity.high_risk (+20) plus returns.counterparty_prior_unauthorized (+40). The transfer itself settled with return code none, so no unauthorized return occurred on this transfer, but the +40 signal indicates this counterparty has a prior unauthorized return history. Program KRIs show ach_unauthorized_return_rate=0 and sanctioned_country_transfers=0 across n=850, with high_risk_entity_share at 0.061 (watch, n=33) and pep_flagged_entities=1 (watch, n=33). manual_review_aging_hours is in breach at 1434.7 hours (n=8), though this is a program-wide metric, not specific to this alert. What was checked. Reviewed alert evidence, transfer details and skoor breakdown, entity verification and screening status, program KRIs, and prior dispositions. No prior dispositions exist for this alert. Counterparty country is listed as unknown, limiting sanctions-geography assessment. The transfer is SETTLED, so it is not currently held. What is recommended. The entity's high-risk flag alone is a low-weight signal on a verified, non-PEP business with no review reasons. However, the transfer-level signal returns.counterparty_prior_unauthorized(+40) indicates this specific counterparty has a documented history of unauthorized returns, which is a stronger and more specific concern than the entity flag alone. This transfer has already settled, so there is no held transfer to release. Given the counterparty's prior unauthorized-return history and unknown country, a person should review the counterparty relationship and recent activity before this pattern is closed, but there is no basis to hold funds already settled or to declare a broader program-level pattern from program KRIs (which are within normal ranges aside from watch-level entity risk share).

{
  "n": 1017,
  "band": "review",
  "skoor": 60,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}