Alert · reviewed · open
Activity on an entity flagged by screening (PEP status potential).
- Detector
- sanctions_or_pep
- Severity
- high
- Program
- Harbor Marketplace Payouts (simulated)
- Subject
- entity enti_sim_harb_azbiyidj3x2
- Transfer
- acht_sim_harb_9hxmtvtj86g · $675.80 · ach outgoing
- Skoor at alert
- 30 review
- Hard signal
- no
- Policy
- policy-v1
- Opened
- 2026-09-17 19:31Z
- Closed
- —
- Decision clock
- none · due — no clock
- Escalated
- —
Draft narrative
What happened. Alert f8634203-db41-48fb-8f9c-28594113a99f was opened on 2026-09-17 by the sanctions_or_pep detector against entity enti_sim_harb_azbiyidj3x2, a PERSON record flagged as a potential PEP match. The alert carries a skoor of 30 (review band) and hard_signal is false. The route reason is 'detector always reviewed,' meaning this alert type is routed for review regardless of score.
What the evidence shows. The entity record shows verification status VERIFIED, high_risk false, and review reasons: none, with last screening on 2026-08-16. The single associated transfer (acht_sim_harb_9hxmtvtj86g) is an outgoing ACH credit of $675.80 USD, status SETTLED, with return code none. The transfer's own skoor is also 30 (review), driven by entity.pep_potential (+15) and returns.entity_rate_gt_threshold (+15). There is no indication of a sanctions hit, no adverse screening outcome, and no return or dispute on the transfer. Program-level KRIs show pep_flagged_entities and high_risk_entity_share in watch status (1 of 30 and 6.7% respectively), and manual_review_aging_hours and ach_unauthorized_return_rate in breach status, but these are portfolio-wide metrics not specifically tied to this entity or transfer.
What was checked. Entity screening status and review reasons, transfer status and return code, counterparty details, program KRIs, and prior dispositions. No prior dispositions exist for this alert. The transfer is already settled, so it is not a candidate for a hold or release action.
What is recommended. Nothing in the entity or transfer evidence requires a person to act: the entity is verified, has no open review reasons, and the transfer settled cleanly with no return. The program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not linked to this entity or transfer in the evidence provided and should be tracked separately at the program level rather than through this alert. Recommend closing this alert.
- Recommendation
- close
- Confidence
- 0.72
- Model
- claude-sonnet-5
- Drafted
- 2026-09-17 19:31Z
- Rationale
- Entity verification status is VERIFIED with review reasons: none.
- Hard_signal is false and skoor (30) sits at the low end of the review band.
- Transfer is SETTLED with return code none; no unauthorized return or dispute is recorded against this transaction.
- Route reason indicates this detector always routes to review regardless of risk signal strength, which lowers the weight of the routing alone as evidence of a problem.
- Program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) are not attributed to this specific entity or transfer in the evidence and do not by themselves indicate a pattern tied to this alert.
- No prior dispositions exist to suggest recurring concern for this entity.
Evidence
{
"n": 1688,
"band": "review",
"skoor": 30,
"signals": [
{
"code": "entity.pep_potential",
"detail": "potential PEP match",
"weight": 15
}
],
"routeReason": "detector always reviewed"
}
Skoor signals
| Signal | Weight | Hard | Detail |
|---|---|---|---|
| entity.pep_potential | +15 | potential PEP match | |
| returns.entity_rate_gt_threshold | +15 | entity unauthorized return rate 1/39 originated ACH debits in 60d |
Decision
Sign in as an operator to decide. Operator sign-in →
Dispositions
No disposition yet.
Actions
Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.
No actions requested.