PEP Screening Guide: Process, Risks and Tools

Q: Is being a PEP illegal?

No. Holding a prominent public function is lawful, and so is being related to or associated with someone who does. PEP status is a risk indicator, not an accusation, and FATF is explicit that its PEP requirements are preventive rather than criminal. The regulatory expectation is that a firm applies heightened, documented due diligence to a confirmed PEP: It assesses the risk of the role, establishes the source of wealth and source of funds where the risk warrants it, obtains senior approval, and monitors the relationship more closely. What a firm should not do is reject or exit a customer solely because they are a PEP. FATF says that approach conflicts with Recommendation 12, and the FCA in the UK has said the same, adding that firms should only decline or end a relationship when they cannot manage the risk. Blanket de-risking of PEPs also has a practical cost: It pushes legitimate customers into less transparent channels and draws regulatory criticism. The basics guide to what a politically exposed person is covers the definition and the reasoning behind the rules.

Q: What is the difference between a PEP and a sanctioned person?

A sanctioned person is subject to a legal prohibition. Governments and international bodies designate individuals, companies, vessels, and countries, and once a party is on a list such as OFAC's SDN list, the EU consolidated list, or the UK sanctions list, regulated firms are barred from dealing with them and must freeze any assets they hold. A PEP faces no such restriction. The PEP designation means the person holds or held a prominent public function, which raises the risk of corruption-related money laundering and calls for extra scrutiny, but the relationship itself remains lawful. The two can overlap, for instance where a serving minister of a sanctioned government is also individually designated, and in that case the sanctions rules take precedence because they are a hard legal bar rather than a risk judgment. The screening responses differ accordingly: A confirmed sanctions match means stop and report, while a confirmed PEP match means assess, decide, and monitor. The PEP vs sanctioned person explainer sets out the overlap and the differences in detail.

Q: Who counts as a relative or close associate of a PEP?

The rules extend PEP treatment to family members and close associates because corrupt officials rarely hold illicit funds in their own name. Family typically includes a spouse or partner, children and their spouses or partners, and parents. UK guidance also includes siblings, and from July 2027 the EU's AML Regulation adds siblings for heads of state, heads of government, and ministers. Close associates are people known to share beneficial ownership of a legal entity or arrangement with the PEP, to have any other close business relationship with them, or to be the sole beneficial owner of a vehicle set up for the PEP's benefit. An RCA is not a PEP in their own right; the connection is what triggers the scrutiny, and once the PEP leaves office and is declassified, the RCA generally returns to standard due diligence. RCA information is the hardest part of PEP data to source, because family ties and private business links rarely appear in official registers. The guide to relatives and close associates explains how far the net should reach and where the data comes from.

Q: Does PEP status expire?

It depends on the jurisdiction, and a global program needs a policy that satisfies each local minimum. FATF sets no fixed period and asks firms to judge former PEPs on risk: How senior the role was, how much informal influence the person retains, and whether the old and new roles are connected. The EU requires firms to keep treating a former PEP as a risk for at least 12 months after leaving office, and longer where PEP-specific risk remains; the AML Regulation retains that floor from July 2027. The UK also applies a 12-month minimum, with any longer period needing a documented, risk-based justification, and FCA guidance expects firms to remove PEP status promptly once the person no longer qualifies. In the US, the private banking rules cover current and former senior foreign political figures without an end date, with a risk-based expectation. Canada treats foreign PEPs as PEPs for life and domestic PEPs for five years after leaving office. The guide to PEP declassification rules walks through the decision and the records to keep.

Q: Are domestic PEPs treated differently from foreign PEPs?

Yes, in most jurisdictions. FATF requires enhanced due diligence for every foreign PEP, because the firm has the least visibility into a foreign official's context and the corruption risk is hardest to judge from outside the country. For domestic and international organization PEPs, FATF requires a risk assessment first, with enhanced measures applied only where the relationship is higher risk. The UK has gone further: Since January 2024, UK PEPs and their relatives and associates are treated as lower risk than foreign PEPs by default, unless other risk factors are present, and FCA guidance tells firms to apply lighter checks in those cases. The EU applies enhanced measures to all PEPs but calibrates their intensity to risk. The US does not define PEPs in general regulation and does not treat US officials as PEPs; its specific rules cover senior foreign political figures in private banking. The practical consequence is that a foreign finance minister and a domestic town councilor should never receive the same treatment. The guide to PEP categories explains the three groups, and the PEP risk assessment guide covers how to tier within them.

Q: How often should PEPs be re-screened?

Continuously, in the sense that PEP status can change at any time and the firm is expected to notice. Customers become PEPs after onboarding when they are elected or appointed, and they stop being PEPs when they leave office. FATF has described cases where institutions learned within a year that a client had become a PEP and still failed to classify them correctly. There is no regulatory interval that fits every firm; the expectation is risk-based. High-risk PEP relationships are typically reviewed at least annually and re-screened whenever PEP data updates, while lower-risk relationships follow a longer cycle. Event-driven triggers matter as much as the calendar: Elections, cabinet reshuffles, senior appointments, resignations, and adverse media should all prompt a re-screen of the affected customers. Continuous monitoring, sometimes called perpetual KYC for PEPs, replaces periodic batch re-screening with an ongoing comparison of the customer base against updated PEP data, so that a change in status surfaces as it happens rather than at the next review date. The guide to continuous PEP monitoring covers how to set the triggers and the review cycles.

Q: How do I screen PEPs with non-Latin names?

Names written in Arabic, Cyrillic, Chinese, and other scripts can be transliterated into Latin letters in several valid ways, and name order and the use of patronymics or family names vary between cultures. FATF lists inconsistent transliteration as a known weakness of commercial PEP databases, and it is a major cause of both false positives and missed matches. The practical answers are to screen in the original script wherever the data source supports it, to use matching logic that recognizes transliteration variants rather than exact strings, and to rely on secondary identifiers such as date of birth, nationality, and role to confirm or discard a candidate match. Analysts also need enough cultural knowledge to recognize when two spellings refer to the same person and when a common name is simply common. The same problem exists in sanctions screening, where name matching against designated parties raises identical transliteration challenges, and firms that solve it for one list usually solve it for the other.

Q: What should I do when I get a PEP match?

Treat it as a candidate, not a finding. The first step is to confirm whether the person is really the PEP in the data, by comparing secondary identifiers such as date of birth, nationality, place of birth, and role. Many alerts close at this stage as false positives, and each closure should be recorded with a reason. Once a true match is confirmed, the case needs an owner, a risk rating based on the category, seniority, jurisdiction, sector, and product involved, and a defined escalation path. Foreign PEPs and higher-risk domestic or international organization PEPs move to enhanced due diligence, which includes establishing the source of wealth and source of funds. Senior management approval is required before the relationship is opened or continued, at a level of seniority proportionate to the risk. After approval, the relationship goes onto closer transaction monitoring and a review cycle. At no point should the match itself be treated as grounds for rejection; the question is whether the firm can manage the risk. The guide on how to handle a true PEP match sets out the escalation workflow step by step.

Q: Are executives of state-owned companies PEPs?

Senior executives of state-owned enterprises are among the PEPs most often missed, because they may never have held a political title. FATF includes senior executives of state-owned corporations in its definition of a politically exposed person, and most national regimes follow. The reasoning is the same as for ministers: A person who controls a national oil company, a state bank, a sovereign wealth fund, or a public utility has access to public assets and procurement on a scale that creates corruption risk. The difficulty is identification. Board members and executives of state-owned enterprises are less likely to appear in commercial PEP data than elected officials, and the state's ownership of the company may itself be indirect or partial. Firms should treat the company's ownership structure as part of the PEP check, screen directors and senior officers of any entity with significant state ownership, and apply the same tiering to them as to other PEPs. The guide to state-owned enterprises and PEP screening covers identification and the thresholds that different jurisdictions apply.

Sooner or later, most regulated firms onboard someone close to political power. It might be a serving minister, a recently retired general, or the brother of a head of state. PEP screening exists to spot these customers early and decide how much extra scrutiny each one deserves.

The challenging part is proportion. Miss a high-risk official and a firm may end up handling corrupt money. Treat every public servant as a suspect, and the firm wastes effort and turns away people who pose little risk. The rules are moving as well, with the UK now treating domestic PEPs as lower risk by default and the EU set to apply one PEP definition from July 2027.

Who counts as a PEP, how firms tier the risk, what happens after a match, when PEP status ends, and how the rules differ by country are all covered in this article.

What Is PEP Screening?

PEP screening is the process of checking customers, beneficial owners, and connected parties against data on politically exposed persons. A politically exposed person, or PEP, is someone entrusted with a prominent public function. A match is not a rejection. It triggers proportionate, risk-based due diligence before and during the relationship.

The concept rests on FATF Recommendation 12 and Article 52 of the UN Convention against Corruption, which both treat senior public office as a risk to manage. PEPs fall into foreign, domestic, and international organization groups, each covered below. This guide explains why the risk is higher, how screening and enhanced due diligence fit together, and where national rules part ways, leaving role lists, checklists, and country detail to dedicated articles. If you need the full politically exposed person definition first, start with our basics guide.

Who Is a PEP? Categories and Positions

FATF groups PEPs into three categories. Foreign PEPs hold prominent public functions for another country. Domestic PEPs hold them for the firm's own country. International organization PEPs are senior managers and board members of bodies such as the UN or NATO. What decides the category is the country that granted the role, not the person's passport or home address. How firms handle each of the PEP categories is explained in a dedicated guide.

Typical roles include heads of state and government, ministers, senior judges, central bank governors, senior military officers, ambassadors, and leaders of major political parties. Middle-ranking and junior officials fall outside the definition, though FATF warns they can still act for a PEP. Someone with a prominent role in two countries is handled under the stricter foreign PEP rules. Titles vary between countries, so a complete list of PEP positions sits in its own reference article.

State-owned enterprise PEPs are the easiest to miss. The finance chief of a national oil company may never have held a political title, yet FATF lists senior executives of state-owned corporations as PEPs. The guide to state-owned enterprises and PEP screening covers how to identify them.

Category	Who it covers	Typical risk level
Foreign PEPs	People entrusted with prominent public functions by another country, such as presidents, ministers, supreme court judges, generals, and heads of state companies	Always higher. FATF requires enhanced due diligence in every case
Domestic PEPs	The same kinds of roles, entrusted by the firm's own country	Case by case. Enhanced measures apply when the relationship is higher risk, and the UK starts from lower risk
International organization PEPs	Directors, deputy directors, and board members of international public bodies such as the UN or NATO	Case by case, handled like domestic PEPs

Why PEPs Are Higher Risk

Senior officials control things other people will pay for. They approve budgets, award contracts and licenses, make appointments, and shape regulation. That access creates room for bribery, kickbacks, and embezzlement, and the proceeds usually end up in the financial system. FATF case work shows corrupt officials using relatives, shell companies, and intermediaries such as lawyers and real estate agents to keep their own names off the paperwork.

The risk comes from the role, not from the person. FATF describes its PEP requirements as preventive rather than criminal, and it says refusing a customer only because they are a PEP goes against Recommendation 12. Context still matters. A foreign head of government stays high risk however well the bank knows them, while an opposition MP in a low-corruption country may only need light-touch checks.

Warning signs tend to show up in the gap between what a person should own and what they actually own. Wealth that outpaces an official salary, reluctance to discuss where money came from, and transfers to countries with no obvious link are classic PEP red flags.

Negative news is often the first warning. Bribery or embezzlement allegations can reach the press before any charge or sanction, and a PEP flag alone says nothing about conduct. That is why PEP checks commonly run alongside adverse media screening, which adds the story behind the status.

PEP Risk Is Not All Equal: Risk-Based Tiering

If one idea shapes a PEP program, it is this one. PEPs differ in how much harm they could cause, so screening results should feed a tiered model rather than a single flat label. FATF sets the frame, with enhanced measures for every foreign PEP and a risk assessment first for domestic and international organization PEPs.

Most tiering models weigh the same handful of factors.

Seniority and power. A head of state or finance minister ranks above a regional official. Control over budgets, procurement, licenses, or state accounts pushes the score up.

Jurisdiction. The risk is heightened by high corruption, armed conflict, weak institutions, and opaque ownership registries. A free press, independent courts, and strong public audit reduce it.

Sector. FATF points to oil and gas, mining, construction, defense, and gambling as areas exposed to corruption.

Product and relationship. A simple deposit account is less risky than private banking, heavy cash use, or complex structures.

Adverse information and time. Credible allegations move a PEP up a tier. Years out of office can move them down.

Many firms turn these factors into a few tiers, with heads of state and ministers at the top, an approach the Wolfsberg Group of global banks also supports. The UK has written part of this into law. From January 2024, UK PEPs and their relatives and associates start as lower risk than foreign PEPs unless other risk factors appear. FCA guidance tells firms to use lighter checks in those cases.

Mistakes run in both directions. Under-screening lets a high-risk foreign PEP, or a relative acting for one, pass as an ordinary customer. Over-screening burns analyst time and can shut out people who pose little risk, such as domestic PEPs with no other risk factors. When the FCA reviewed 15 firms in 2024, seven used PEP, relative, or associate definitions wider than the rules and FCA guidance called for. FATF has also warned that dropping whole customer groups, rather than judging each case, pushes money into less transparent channels.

Whatever model you choose, record why each customer landed in their tier. The scoring mechanics are covered in the PEP risk assessment guide.

Screen PEPs and sanctions together.

Complead checks customers against sanctions, PEP and adverse media data in one screening run and keeps monitoring them after onboarding.

Explore screening and monitoring

800+financial institutions use Complead

70+countries served

Relatives and Close Associates (RCAs)

Corrupt officials rarely hold stolen money in their own name. They use a spouse, a child, a sibling, or a trusted business partner instead. PEP rules therefore extend to family members and close associates, known as RCAs.

Definitions vary by country. EU and UK rules name spouses or partners, children and their spouses, and parents, and the FCA also counts siblings. From July 2027 the EU adds siblings for heads of state, heads of government, and ministers. Close associates usually share beneficial ownership of a company or trust with the PEP or own a vehicle set up for the PEP's benefit. An RCA is not a PEP in their own right. In the UK, a relative goes back to standard checks once the PEP leaves office.

RCA data is the hardest piece to source. Family ties and private business links rarely appear in official registers, so firms rely on company records, media reports, and what the customer discloses. How far the net should reach is covered in our guide to RCA screening.

How PEP Screening Works: The Process

The PEP screening process follows the customer from the first check to the end of the relationship, and every step covers beneficial owners too.

Screen at onboarding. A PEP check at onboarding starts with the full name, date of birth, nationality, and address, then screens the customer, its beneficial owners, and any relevant controllers. Ask about public roles directly, but never rely on a self-declaration alone. FATF says commercial PEP databases help but are neither required nor sufficient. That is why firms supplement them with customer data, official lists, and media checks. Digital companies work under constant time pressure, so PEP screening for fintechs has to run in real time without skipping human review.

Resolve the alert. A name hit is a candidate, not a finding. Analysts compare secondary identifiers like date of birth, nationality, and role to separate false alarms from real matches. Once a true PEP match is confirmed, the case needs an owner, a written rationale, and a defined escalation path.

Assess the risk and apply EDD. A confirmed PEP gets a risk rating based on the factors above. Foreign PEPs and higher-risk domestic or international organization PEPs then move to enhanced due diligence, covered in the next section.

Get senior sign-off. FATF requires senior management approval before opening, or continuing, a relationship that calls for enhanced measures. UK guidance lets firms delegate lower-risk approvals to a less senior level, provided that person has enough knowledge and authority and the decision is recorded.

Monitor and re-screen. Approved PEP relationships get closer transaction monitoring. The wider customer base should be re-screened whenever PEP data changes, since customers can become PEPs after they join. FATF describes cases where institutions knew within a year that a client was a PEP yet failed to classify them properly. Elections, appointments, and resignations are useful triggers, and continuous PEP monitoring picks up those changes as they happen. When a PEP leaves office, the declassification rules covered below take over.

Record and review. Keep a clear file for every decision, including refusals and tier changes, for at least the five years FATF requires. Review higher-risk relationships more often than lower-risk ones.

The aim is a decision you can defend. The FCA is explicit that a firm should decline or exit a relationship only when it cannot manage the risk, not because the customer holds public office.

PEP status you can defend.

Complead structures PEP data into four tiers, links relatives and close associates, and tracks every tier change, so each screening decision has a record behind it.

Explore PEP data

4 tiersdomestic, foreign, international organization and RCA

15 minrefresh interval, with tier changes versioned

Enhanced Due Diligence for PEPs

Enhanced due diligence adds to standard customer due diligence rather than replacing it. For PEPs who need it, FATF names three core measures: Senior management approval to establish or continue the relationship, reasonable measures to establish the source of wealth and the source of funds, and enhanced ongoing monitoring of the relationship.

Most firms also collect more detail on the purpose of the relationship, expected activity, and the reasons behind large transactions. The depth should track the risk. The FCA lets firms rely on information they already hold for lower-risk PEPs, and it expects more intrusive checks and more frequent reviews for higher-risk ones.

Source of wealth is the defensible core of PEP due diligence. Source of funds shows where the money for this relationship came from. Source of wealth explains how the person built everything they own, whether through salary, business, inheritance, or investments. FATF tells firms to focus on what can reasonably be explained, not on what someone in that office might be expected to have. A minister on a modest salary who owns several properties abroad needs a credible account backed by registers, disclosures, or records.

Verifying the source of wealth is often the hardest step. FATF acknowledges that reliable information is frequently missing, so firms may have to lean on the customer's own declaration. Anything the firm cannot verify should be recorded and weighed.

The full method, from document requests to review cycles, is set out in the dedicated article on EDD for politically exposed persons.

Once a PEP, Always a PEP? Declassification

Does PEP status ever end? That depends on where the firm operates.

FATF sets no fixed period. It says former PEPs should be handled on the basis of risk rather than prescribed time limits. The useful questions are how senior the old role was, how much informal influence the person keeps, and whether the old and current roles are linked.

The EU sets a floor and then applies risk. Firms must keep treating a former PEP as a risk for at least 12 months after they leave office, and for longer if PEP-specific risk remains. The AMLR keeps that 12-month minimum from July 2027. UK rules also require at least 12 months, and any longer period needs a documented, risk-based reason. In the US, the private banking rules cover current and former senior foreign political figures with no end date, and regulators expect a risk-based view.

Canada shows how far apart the rules can drift. A foreign PEP there stays a PEP for life, while a domestic PEP loses the status five years after leaving office. A global program therefore needs a declassification policy that meets each local minimum and records why a customer was stepped down. Our overview of PEP declassification rules walks through the decision steps.

PEP Screening vs Adjacent Concepts

PEP screening is often confused with two close neighbors. Telling them apart matters, because each check leads to a different action.

A PEP is not a sanctioned person. Sanctions are legal restrictions on named people, companies, vessels, or countries. In the US, anyone on OFAC's SDN list has their assets blocked, and US persons are generally barred from dealing with them. A PEP faces no such ban. Some people are both, such as serving officials of a sanctioned government, and then the sanctions rules come first. The PEP vs sanctioned person explainer covers the overlap in detail.

The two screening processes also behave differently. Sanctions screening is a legal prohibition check, so a confirmed hit means stop, block or freeze, and report as the law requires. PEP screening is a risk check, so a confirmed hit means scrutinize, decide, and monitor. That split between blocking and scrutinizing is the core of sanctions screening vs PEP screening.

Wanted lists are a third type of data. An Interpol Red Notice asks police worldwide to locate and provisionally arrest someone pending extradition. It is not an international arrest warrant, and most notices are visible only to law enforcement. A hit calls for escalation and, if there is suspicion, a suspicious transaction report. The three data sets differ in source, legal effect, and the response they require, and a screening program should treat each accordingly.

Common PEP Screening Challenges

Even well-run programs hit the same obstacles.

False positives on common names. A popular name can return a long list of possible matches, and FATF warns that thin identifier data makes this worse. Adding date of birth, nationality, and role data, then tuning match thresholds, cuts the noise. Practical ways to reduce false positives in PEP screening have a guide of their own.

Non-Latin names. Arabic, Cyrillic, and Chinese names can be written several ways in Latin letters, and name order changes between cultures. FATF lists inconsistent transliteration as a known weakness of PEP databases. Matching in the original script helps, and screening non-Latin names is a problem sanctions teams face too.

RCA data gaps. As noted above, family and business ties are the least documented part of PEP data.

Hidden PEPs. A PEP may sit behind a trust, a nominee, or several layers of companies. A joint FATF and Egmont Group study of 106 cases found shell companies to be a key feature of schemes that hide beneficial ownership. Screening every owner, trustee, and controller is the practical answer, and screening PEPs in trusts needs its own method.

Charities and non-profits. PEPs turn up as trustees, large donors, or local partners. FATF revised its non-profit standard in November 2023. The aim was to require proportionate measures that do not disrupt legitimate charitable work. The same logic applies to PEP screening for charities, which should be targeted rather than applied to every beneficiary.

Rules that change at every border. This challenge is big enough for its own section, which follows.

Regulatory Expectations Around the World

Every PEP regime starts from the FATF standards, which more than 200 jurisdictions have committed to apply. National rules then add detail, and they often differ.

The EU currently applies PEP rules through its AML directives, backed by an official list of prominent public functions published in November 2023. From 10 July 2027, the AML Regulation applies directly in all member states. It sets one EU-wide definition and adds heads of regional and local authorities with at least 50,000 inhabitants. The new EU authority, AMLA, must issue guidelines on close associates and PEP risk levels by the same date.

The UK applies regulation 35 of its 2017 Money Laundering Regulations, read with FCA guidance, which treats only Supreme Court judges as judicial PEPs in the UK.

US regulations do not define PEPs. Specific rules cover private banking accounts for senior foreign political figures. Federal regulators say there is no general requirement for extra PEP-specific steps, and they do not treat US officials as PEPs.

A town mayor is a domestic PEP in Canada regardless of population, while the FCA tells UK firms not to treat local government officials as PEPs. PEP compliance across borders therefore means reconciling these rules instead of forcing one rulebook everywhere, and it should plan now for the EU change in July 2027. The country-by-country detail sits in a separate article on PEP screening regulations by country.