Alert · reviewed · open
Activity on an entity flagged by screening (PEP status no, high risk).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Meridian Remit (simulated)
- Subject
- entity enti_sim_meri_5if3mzfr9pn
- Transfer
- acht_sim_meri_bmnldud4al7 · $511.91 · ach outgoing
- Skoor at alert
- 20 clear
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:30Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert e97f66f1-7eb2-42f6-b95a-d2af1f27a6aa fired on entity enti_sim_meri_5if3mzfr9pn under the sanctions_or_pep detector because screening marked the entity high risk. The route reason states the detector is always reviewed regardless of score. The linked transfer is a single settled ACH debit of $511.91 USD dated 2026-07-30.
What the evidence shows. The entity is verified, marked high risk true, but PEP status is no, and review reasons are none. Last screening was 2026-06-26, which is recent. The alert-level and transfer-level skoor are both 20, placing the activity in the 'clear' band, and hard_signal is false. The transfer settled with no return code, indicating no ACH failure or dispute. Program KRIs show high_risk_entity_share at 3.3%, stale_screening_share at 0%, sanctioned_country_transfers at 0, and ach_unauthorized_return_rate at 0, all within normal ranges (ok). pep_flagged_entities is watch (1 of 30) but this entity itself is not PEP-flagged. hold_aging_hours is watch but unrelated to this specific transfer, which is already settled.
What was checked. Reviewed the entity screening detail (verification, PEP, high-risk flag, review reasons, last screened date), the transfer status and return code, the alert and transfer skoor/band/hard_signal fields, the program's declared volume and rails, and the full set of program KRIs for signs of a broader pattern (concentration, returns, sanctioned-country activity, stale screening). No prior dispositions exist for this entity or transfer.
What is recommended. No evidence in this alert indicates unresolved risk requiring a hold or further investigation: the entity is verified, not PEP, screening is current, the transfer settled cleanly, and program KRIs tied to sanctions/PEP exposure are ok. Recommend closing the alert. A person should confirm no external case ties to this entity before closing, since the underlying screening system flagged high risk and that flag persists on the entity record.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:30Z
- Rationale
- Score band is clear (20) and hard_signal is false at both alert and transfer level.
- Entity is VERIFIED, PEP is no, review reasons are none, and last screening (2026-06-26) is recent, not stale.
- Transfer status is SETTLED with no return code, showing no operational failure.
- Program KRIs relevant to sanctions/high-risk exposure (stale_screening_share, sanctioned_country_transfers, high_risk_entity_share, ach_unauthorized_return_rate) are all in the ok range.
- No prior dispositions exist, so this is a first-time review with no accumulating pattern documented.
- hold_aging_hours and pep_flagged_entities show watch status at the program level but are not directly tied to this entity or transfer, so they do not independently justify escalation.
Evidence
{
"n": 323,
"band": "clear",
"skoor": 20,
"signals": [
{
"code": "entity.high_risk",
"detail": "entity marked high risk by screening",
"weight": 20
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.high_risk | +20 | entity marked high risk by screening | |
| returns.counterparty_prior_unauthorized | +40 | 2 prior unauthorized return(s) |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.