Activity on an entity flagged by screening (PEP status no, high risk).

What happened. Alert fc8ed6b3-04ec-4c60-b08e-ead1e3957d7a fired on entity enti_sim_nort_91eod4q93y under the sanctions_or_pep detector, high severity, score 30 (review band), hard_signal false. The entity is tied to a single ACH outgoing credit of $2,513.49 (transfer acht_sim_nort_aidhvakt2ff), settled on 2026-08-21, under the Northwind Payroll program (declared monthly volume $2,500,000.00, ACH, US only). What the evidence shows. The entity is a verified business, marked high risk by screening, PEP status no, with no review reasons listed and last screened 2026-08-18. The transfer-level signals are entity.high_risk (+20) and counterparty.first_time (+10), combining to the same score-30 review band. The transfer is already SETTLED with no return code, so there is no pending movement to hold. Counterparty country is unknown but the transfer cleared without administrative or unauthorized return. Program KRIs show pep_flagged_entities and high_risk_entity_share at watch level (1/33 and 6.06%), sanctioned_country_transfers at 0, ach return rates normal, and reserve coverage above 2x. manual_review_aging_hours is in breach (1434.68 hours, n=7), which is a program-level operational metric, not specific to this alert's entity or transfer. No prior dispositions exist for this entity or transfer. What was checked. Reviewed the alert evidence, entity screening record, transfer details and status, and program-level KRI panel. Confirmed hard_signal is false, verification status is VERIFIED, PEP is no, and no review reasons were logged. Confirmed transfer status is SETTLED with no return code, meaning no funds are in a holdable state. Checked program KRIs for sanctions or high-risk concentration signals beyond this single entity; only two watch-level metrics (pep_flagged_entities, high_risk_entity_share) appear, both at low absolute counts (1 and ~6% of 33 entities), not indicative of a broader pattern tied to this alert. What is recommended. Close this alert. The entity is verified, not PEP, has no review reasons, and the associated transfer is already settled with a clean return history. The only elevated program metric (manual_review_aging_hours) reflects a separate operational backlog and is not evidence of a sanctions or PEP concern tied to this specific alert. A person should separately track the review-aging breach as an operational item outside this alert's disposition.

{
  "n": 883,
  "band": "review",
  "skoor": 30,
  "signals": [
    {
      "code": "entity.high_risk",
      "detail": "entity marked high risk by screening",
      "weight": 20
    }
  ],
  "routeReason": "detector always reviewed"
}