A $2,400.00 ach transfer was initiated for an entity whose verification was denied.

What happened. A $2,400.00 ACH credit transfer (acht_sim_nort_1c6mqyec3s6) tied to the Northwind Payroll program was flagged by the denied_entity_activity detector because the counterparty entity's verification was denied. The alert scored 80 (band hold, hard signal true) and was routed for review as reviewed/opened 2026-09-17T19:31:00.352Z. What the evidence shows. The entity enti_sim_nort_4ndrgqqi3r, a PERSON labeled "Denied Origin 0", carries verification status DENIED, high_risk true, and review reason sanctions_match, last screened 2026-06-24T12:01:30.000Z. The transfer-level signals confirm entity.denied (+60, hard) and entity.high_risk (+20), producing a skoor of 80 in the hold band with n=675 and confidence 0.7. The transfer itself is already status SETTLED, created 2026-08-10T10:45:10.000Z, with no return code recorded, meaning the $2,400.00 moved before this alert was opened over five weeks later. Program-level KRIs show pep_flagged_entities and high_risk_entity_share both in watch status (1/33 and 6.06%), while manual_review_aging_hours is in breach (1434.67 hours, n=6). Other KRIs (frozen_accounts, overdraft_events, ach return rates, reserve_coverage_ratio) are ok. No prior dispositions exist for this alert or entity. What was checked. Reviewed the alert evidence block, transfer record, entity verification record, program KRIs, and prior disposition history. Confirmed the hard signal (entity.denied) and its sanctions_match review reason. Confirmed transfer status is SETTLED, not held, so no funds remain to be released or blocked at this alert. Checked program KRIs for related patterns; found watch-level flags on high_risk_entity_share and pep_flagged_entities, and a breach on manual_review_aging_hours, suggesting broader review-timeliness issues in the program. What is recommended. This alert cannot be closed because a denied, sanctions-flagged entity completed a settled $2,400.00 transfer with no compensating control noted (no return, no freeze). Because the transfer already settled, a hold on this transfer is moot; the funds have already moved. The sanctions_match reason on a denied entity, combined with program-level watch/breach signals (high_risk_entity_share, pep_flagged_entities, manual_review_aging_hours), indicates this may not be an isolated case and warrants review beyond this single alert. Recommend escalation for a person to assess sanctions exposure, confirm whether other transfers from this entity or similar denied entities occurred, and determine if a look-back review of the program's denied-entity transfers is needed.

{
  "n": 675,
  "band": "hold",
  "skoor": 80,
  "signals": [
    {
      "code": "entity.denied",
      "hard": true,
      "detail": "entity verification DENIED",
      "weight": 60
    }
  ],
  "autoHold": true,
  "routeReason": "hard signal"
}