Activity on an entity flagged by screening (PEP status potential).

What happened. Alert e9b7e54a fired from the sanctions_or_pep detector on entity enti_sim_harb_azbiyidj3x2 ("Potential Pep 1"), triggered by a single signal: entity.pep_potential (weight 15). This is a potential PEP match, not a confirmed one. The alert score is 15, placing it in the 'clear' band, and hard_signal is false. Route was 'reviewed' because this detector is always reviewed, per routeReason. What the evidence shows. The entity record shows verification status VERIFIED, high_risk false, review reasons none, and last screened 2026-08-16T23:44:46.000Z, roughly one month before this alert opened. Country is US. The transfer tied to this alert (acht_sim_harb_calfj8fi5t2) is an outgoing ACH CREDIT of $261.66 with status RETURNED and return code R10 (customer advises unauthorized). This return code relates to authorization dispute, not to sanctions or PEP status, and is a separate matter from the detector's basis. The transfer's own skoor is also 15/clear. Program KRIs show pep_flagged_entities at 1 of 30 entities (watch) and high_risk_entity_share at 6.7% (watch), both program-level and not specific to this entity beyond the existing flag. Manual_review_aging_hours (breach) and ach_unauthorized_return_rate (breach) are also program-level metrics, not attributed to this entity or transfer in the evidence provided. What was checked. Checked the alert's detector, score, and band; the entity's verification status, high-risk flag, review reasons, and last screening date; the associated transfer's status, return code, and skoor; program KRIs for related watch/breach conditions; and prior dispositions, of which there are none for this alert. What is recommended. Close this alert. The entity is already verified, screened within the past month, carries no open review reasons, and the alert score sits in the clear band with no hard signal. The R10 return on the linked transfer concerns transaction authorization, not PEP/sanctions status, and is not evidence of a sanctions or PEP concern on this entity. The transfer is already RETURNED, not held, so no release action applies. Program-level KRI watches and breaches (pep_flagged_entities, manual_review_aging_hours, ach_unauthorized_return_rate) are noted for program-level review but do not by themselves indicate this specific alert requires escalation, since none are tied in the evidence to this entity or transfer.

{
  "n": 706,
  "band": "clear",
  "skoor": 15,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}