Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert f6332435-69cf-4c88-ab82-677ee7f35171 fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector, which the routing rule always sends to review regardless of score. The triggering activity is a single outgoing ACH credit of $2,030.33 (acht_sim_nort_3wgm77mx35z), settled, no return code, under program Northwind Payroll. What the evidence shows. The entity is a verified US business flagged high risk by screening but not PEP, with no review reasons listed and a last screening date of 2026-08-18. The alert skoor is 20, banded clear, with hard_signal false; the only contributing signal is entity.high_risk(+20). The transfer itself carries the same clear-band score (20, n=1206, confidence 1) with no additional signals. The transfer settled with no return code, and counterparty country is unknown but not flagged sanctioned. Program-level KRIs are mostly ok or watch (pep_flagged_entities, high_risk_entity_share, hold_aging_hours), with one breach: manual_review_aging_hours at 1434.68 hours on a small sample (n=10). This breach reflects review-queue timeliness across the program, not a signal specific to this entity or transfer. What was checked. Reviewed the entity's verification status, PEP status, high-risk flag, and last screening date. Reviewed the single transfer's status, return code, and score. Reviewed program KRIs for sanctioned-country transfers (0), ach return rates (all ok), verification denial rate (ok), and counterparty concentration (ok). No prior dispositions exist for this entity. What is recommended. Close the alert. The entity is verified, not PEP, has no review reasons, and was screened within the last month. The single transfer has already settled with no return and carries a clear-band score with no hard signal. No sanctioned-country or unauthorized-return activity appears in the program data tied to this entity. The manual_review_aging_hours breach is a program-wide queue metric on a small sample and does not on its own point to a pattern involving this specific entity or transfer; it may warrant separate operational attention outside this alert.

{
  "n": 1206,
  "band": "clear",
  "skoor": 20,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}