Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Northwind Payroll (simulated)
- Subject
- entity enti_sim_nort_sr7cv2o3u
- Transfer
- acht_sim_nort_9aqvjoha2mn · $1,349.57 · ach outgoing
- Skoor at alert
- 15 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Sanctions/PEP detector fired on entity enti_sim_nort_sr7cv2o3u (Potential Pep 0) due to a potential PEP match. The related ACH outgoing credit transfer acht_sim_nort_9aqvjoha2mn for $1,349.57 USD settled on 2026-08-26 under the Northwind Payroll program.
What the evidence shows. The alert score is 15, band clear, with hard_signal false. The only contributing signal is entity.pep_potential (+15). The entity record shows verification VERIFIED, high_risk false, and review reasons none, with last screening on 2026-06-25. The transfer itself carries the same clear-band score (15, n=997, confidence=1) and settled with no return code, indicating no ACH return or unauthorized-return issue. Program KRIs show ach_unauthorized_return_rate 0, sanctioned_country_transfers 0, and stale_screening_share 0, all ok. Two KRIs are at watch (pep_flagged_entities 1/33, high_risk_entity_share 0.061) and one is at breach (manual_review_aging_hours 1434.68 hours, n=8), but these are program-level metrics not specific to this entity or transfer.
What was checked. Reviewed the alert evidence, entity screening status and review reasons, transfer status and return code, transfer-level skoor, and program KRI panel for corroborating signals of sanctions/PEP risk or transfer irregularity.
What is recommended. No transfer hold is warranted since the transfer has already settled with no return and no hard signal was triggered. The entity is verified with no open review reasons. The program-level manual_review_aging_hours breach and the two watch-level KRIs (pep_flagged_entities, high_risk_entity_share) are not tied to this specific alert's evidence and should be tracked separately at the program level rather than driving this alert's disposition. Close this alert; a person should independently review the manual_review_aging_hours breach as a separate program-level item if not already tracked.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Score 15 in clear band with hard_signal false and only one low-weight signal (entity.pep_potential +15).
- Entity is VERIFIED with high_risk false and review reasons none, last screened 2026-06-25.
- Transfer acht_sim_nort_9aqvjoha2mn settled with no return code; transfer-level skoor also clear (15, confidence 1).
- Program KRIs directly relevant to sanctions/PEP risk (sanctioned_country_transfers, stale_screening_share, ach_unauthorized_return_rate) are all at ok.
- Two KRIs (pep_flagged_entities, high_risk_entity_share) are at watch and one (manual_review_aging_hours) is at breach, but these reflect program-wide conditions, not specific evidence against this entity or transfer, so they do not change this alert's disposition though they warrant separate program-level attention.
- No prior dispositions exist for this alert to inform pattern history.
Evidence
{
"n": 997,
"band": "clear",
"skoor": 15,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.