PEP screening is the process of identifying whether a customer — or a customer's beneficial owner — is a politically exposed person: someone who holds or has held a prominent public function. PEPs are statistically more exposed to bribery and corruption risk, which is why AML regimes worldwide impose enhanced due diligence when one appears in your customer base.
PEP screening is a matching exercise with a nuance problem. Names are common, transliteration is messy, lists differ in coverage, and 'prominent public function' spans everyone from heads of state to senior judges, military officers, central-bank officials and executives of state-owned enterprises.
Who counts as a PEP
- Heads of state or government, ministers and deputy ministers.
- Members of parliament and of supreme, constitutional and high-level courts.
- Senior military officers, ambassadors and central-bank board members.
- Members of the administrative, management or supervisory bodies of state-owned enterprises.
- Senior officials of international organisations (directors, deputy directors, board members).
- Family members: spouse or partner, children and their spouses, parents.
- Close associates: known business partners and persons with joint beneficial ownership.
What the rules require
Under FATF Recommendation 12 and successive EU AML directives, when a customer or beneficial owner is identified as a PEP you must obtain senior-management approval before establishing or continuing the relationship, take reasonable measures to establish source of wealth and source of funds, and conduct enhanced ongoing monitoring. These obligations apply whether the PEP is foreign, domestic or an international-organisation official — EU rules have covered domestic PEPs since the Third AML Directive.
There is no automatic de-risking permission in the rules: being a PEP is not a lawful reason to refuse service by itself. It is a reason to look harder.
How long does someone stay a PEP?
Neither FATF nor the EU sets a fixed expiry. The risk-based test is whether the person still presents elevated risk — influence, network and access — after leaving office. Many institutions apply a minimum period (12–18 months is common) and then a documented risk assessment before treating a former PEP as standard risk. Whatever approach you take, it needs to be written down and applied consistently.
Managing PEP screening alerts in practice
PEP alert volume is dominated by false positives: common surnames, partial date-of-birth matches and transliteration variants. Useful controls are matching on multiple identifiers (date of birth, nationality, role, country), risk-tiered PEP categorisation so a local councillor does not generate the same urgency as a minister, and continuous monitoring so a customer who becomes a PEP mid-relationship is flagged rather than discovered at the next periodic review.
Every confirmed PEP needs the three statutory steps documented in the file: senior-management approval, source of wealth and funds, and the enhanced monitoring plan. Examiners look for exactly those three.
How Infocredit Group approaches it
ComplianceSuite screens customers and their beneficial owners against global PEP databases at onboarding and continuously thereafter, with risk-tiered categorisation, multi-identifier matching and a documented approval workflow that captures senior-management sign-off, source-of-wealth information and the monitoring plan in the same case file.
Frequently asked questions
What is a PEP in AML?
A politically exposed person: an individual entrusted with a prominent public function, such as a head of state, minister, MP, senior judge, senior military officer, central-bank board member or state-enterprise executive. Their family members and known close associates are treated as PEPs too.
Is PEP screening a legal requirement?
Yes for obliged entities. FATF Recommendation 12 and EU AML directives require identifying PEPs among customers and beneficial owners, and applying enhanced due diligence — senior-management approval, source-of-wealth verification and enhanced monitoring — when one is found.
Do domestic PEPs count, or only foreign ones?
Domestic PEPs are fully in scope under EU AML directives and FATF standards. A minister in your own country requires the same enhanced due diligence as a foreign one.
When does someone stop being a PEP?
There is no fixed expiry in the rules. Institutions apply a risk-based assessment — often after a minimum 12–18 months out of office — considering the person's residual influence and connections. The decision and its rationale should be documented.
Can you refuse a customer just because they are a PEP?
PEP status alone is not a lawful ground for automatic refusal under the risk-based approach; it requires enhanced due diligence. A refusal must rest on the risk assessment outcome, not the status itself.
Compliance insights, straight to your inbox
Monthly analysis on AML, screening and risk technology from the teams behind ComplianceSuite, RISQO and API4ALL. No spam — unsubscribe anytime.