Activity on an entity flagged by screening (PEP status potential).

What happened. Alert ecabf3cb-95b4-47b1-a46a-a8c59595341e fired from the sanctions_or_pep detector on entity enti_sim_harb_azbiyidj3x2, a PERSON labeled 'Potential Pep 1'. The entity carries a potential PEP flag. The alert score is 55 (review band), hard_signal is false, and the route reason states this detector is always routed to review. The linked transfer is acht_sim_harb_7stsmku969z, an outgoing ACH credit of $401.45 USD, settled, to counterparty cpty_sim_harb_gzii64r41f whose country is unknown, with no return code recorded. What the evidence shows. The alert-level evidence lists only the entity.pep_potential signal (weight 15). The transfer-level scoring, however, shows a second signal not surfaced in the alert evidence: returns.counterparty_prior_unauthorized (weight 40), indicating this counterparty has a prior unauthorized ACH return on record. The entity record shows verification VERIFIED, high_risk false, and review reasons none, with last screening on 2026-06-25. At the program level, ach_unauthorized_return_rate is flagged as a breach (0.0101, n=298), and manual_review_aging_hours is also in breach (1438 hours, n=5). pep_flagged_entities (1 of 30) and high_risk_entity_share (0.067) are at watch. The transfer itself is already settled; there is no held status to release. What was checked. Reviewed the alert summary, entity record, transfer detail, transfer-level signal breakdown, program declared volume and rails, and the full KRI panel. Confirmed no prior dispositions exist for this alert or entity. Confirmed the transfer status is SETTLED with no return code, meaning no funds are currently held pending action. What is recommended. Because the transfer carries a counterparty with a prior unauthorized return history combined with a PEP-potential subject and an unknown counterparty country, and because this coincides with a program-wide breach on ach_unauthorized_return_rate, the pattern extends beyond this single alert. A person should review the counterparty's return history and the program's unauthorized-return trend together, rather than closing this as a standalone PEP hit. Funds on this specific transfer have already settled, so there is nothing to hold or release here; the recommendation is to escalate for pattern-level review.

{
  "n": 897,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "entity.pep_potential",
      "detail": "potential PEP match",
      "weight": 15
    }
  ],
  "routeReason": "detector always reviewed"
}