Politically Exposed Person Check: A PEP Guide

A politically exposed person check trips up a lot of onboarding teams, and it's easy to see why. It isn't a legal filter the way sanctions screening is — nobody is prohibited from doing business with a former mayor or a mid-ranking central bank official. It's a risk signal that tells you to look harder before deciding, and to keep looking as the relationship continues. Get it wrong in one direction and you decline good customers for no reason. Get it wrong in the other and you miss exactly the elevated bribery and corruption exposure the check exists to catch.

Key takeaways

• A PEP is anyone who holds, or has held, a prominent public function — domestically, abroad, or at an international organisation — plus their family members and close associates.
• PEP status is a risk factor, not a prohibition: it should trigger enhanced due diligence, not an automatic decline.
• Enhanced due diligence means establishing source of wealth and source of funds, getting senior management sign-off, and monitoring the relationship on an ongoing basis.
• Former PEPs still carry elevated risk for a defined look-back period after leaving office — the risk doesn't switch off the day they resign.
• A PEP check is a separate exercise from sanctions screening; the two answer different questions and call for different responses to a hit.

Who counts as a politically exposed person?

The international standard-setter for this area is the Financial Action Task Force (FATF), whose guidance under Recommendations 12 and 22 splits PEPs into three categories. Its own wording for the foreign category is a useful anchor: PEPs are "individuals who are or have been entrusted with prominent public functions by a foreign country, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials". Domestic PEPs are defined the same way but for the reviewer's own country, and international-organisation PEPs cover senior management and board-equivalent roles at bodies such as the UN or the IMF.

Job title matters more than seniority of the organisation as a whole. A junior clerk at a ministry isn't a PEP; a director-level appointee with real decision-making power is, even at a relatively small agency.

Why do family members and close associates count too?

Because a determined bad actor doesn't need to hold the assets in their own name. Bribery proceeds routed through a spouse's account, or a business set up in an adult child's name, are common enough patterns that FATF's framework explicitly extends the same scrutiny to family members and known close associates — partners outside the immediate family, business partners who share ownership or control, and people closely connected to the PEP's financial affairs. Skipping this step and only screening the office-holder by name leaves an obvious gap.

Picture a bank onboarding the adult daughter of a foreign trade minister who wants to open a business account to fund a small import company. She's never held public office herself, so a name-only PEP screen against her alone would clear. But she's a close family member of a serving foreign PEP, so the relationship should be flagged for the same enhanced due diligence as if the minister were opening the account directly — reasonable questions about where the start-up capital came from, and a closer look if the answer doesn't line up with her own income history.

Does a PEP hit mean you have to turn the relationship down?

No, and treating it that way is one of the most common mistakes teams make. A PEP hit is fundamentally different from a sanctions hit: a true match on the OFAC SDN list or the UN Security Council Consolidated list is a legal prohibition, full stop, whereas a PEP match is a prompt to apply proportionate scrutiny before deciding. Confusing the two — or running them as a single undifferentiated "watchlist check" — leads to over-cautious declines of legitimate customers who happen to hold public office, which is exactly the outcome regulators are trying to avoid when they call for a risk-based approach. Our guide to sanctions screening vs PEP screening goes through that distinction in more depth, and if your compliance programme needs both checks run together, combining PEP and sanctions screening covers how the two workflows typically sit side by side.

Regulators have been explicit about proportionality on this point. The UK's Financial Conduct Authority published Finalised Guidance FG25/3 in 2025 partly in response to firms treating domestic PEPs, and even relatives several steps removed, with the same suspicion as a foreign head of state — a pattern of unnecessary friction the guidance was written to correct by presuming lower risk for domestic PEPs absent other red flags.

What does enhanced due diligence actually involve?

"Enhanced due diligence" is a phrase that gets used loosely, but for a genuine PEP relationship it has concrete components:

• Source of wealth — evidence for how the person's overall net worth was built up: career earnings, a business sale, inheritance, investment gains.
• Source of funds — evidence for where the specific money in this relationship or transaction came from, which can be narrower than source of wealth.
• Senior management approval — sign-off from someone above the frontline analyst before the relationship is established or continued.
• Enhanced ongoing monitoring — tighter transaction thresholds and more frequent review than a standard customer would get.

None of this requires assuming guilt. One compliance analyst put it plainly during a recent industry discussion on PEP handling: the goal of the extra questions is to be able to explain the relationship clearly later, not to make the customer feel accused. That's a useful way to frame the conversation with the customer — you're building a file that holds up under review, not conducting an interrogation.

Common mistakes worth avoiding

A few patterns show up repeatedly in PEP programmes that otherwise look solid on paper:

• Treating every PEP hit as an automatic decline. This drives away legitimate customers and, ironically, pushes compliance teams towards rubber-stamping declines rather than doing the actual review work the check is meant to prompt.
• Forgetting former PEPs still carry risk. Someone who left office last year hasn't shed the influence or the relationships that came with the role. Most programmes apply a defined look-back period — commonly measured in years, not months — before treating a former office-holder as a standard customer again.
• Screening the named individual only. Missing family members and close associates leaves the most obvious workaround wide open.
• Documenting the outcome but not the reasoning. "Approved" with no notes on what evidence was reviewed doesn't survive an audit or a regulatory examination.

How does this fit with the rest of a KYC programme?

A PEP check is one input into a broader name screening process that typically also covers sanctions and adverse media, run at onboarding and repeated as records update. None of these checks substitute for the others — a clean PEP result says nothing about sanctions exposure, and vice versa — so a defensible KYC file records each check and its outcome separately, with its own review trail.

PEP screening and sanctions screening solve different problems, but they're both foundational to a defensible onboarding process, and a good compliance programme runs both without letting one stand in for the other. If you need the sanctions half of that picture, you can screen a name against OFAC and UN lists for free and see exactly what a cited, auditable result looks like.