A PEP isn't just a foreign official. The definition is broader than most firms realize.
Politically Exposed Persons are one of the most commonly misunderstood categories in AML compliance. Here is who qualifies, why they carry elevated risk, and what a compliant screening program looks like in practice.
What makes someone a Politically Exposed Person?
Most compliance teams have a working definition of a PEP. Fewer have a precise one. The gap between the two is exactly where regulatory findings originate.
Foreign, domestic, and by association
FATF and most national AML frameworks distinguish between three PEP categories, each carrying different risk weightings and due diligence requirements. Most firms screen correctly for one. The failures occur in the other two.
Individuals who hold or have held a prominent public function in a country other than the institution's home jurisdiction. Under FATF Recommendation 12, foreign PEPs must always be treated as higher risk and subjected to Enhanced Due Diligence regardless of the jurisdiction's perceived risk level. There is no threshold or exemption based on the seniority of the role.
Individuals who hold or have held a prominent public function within the institution's home country. Unlike foreign PEPs, most jurisdictions allow a risk-based approach for domestic PEPs. the level of EDD applied depends on the specific role, the nature of the relationship, and the institution's risk appetite. A risk-based approach still requires a documented decision. Treating a domestic PEP as standard risk without documentation is not defensible in an examination.
Individuals who are not themselves PEPs but are closely connected to one. family members, business partners, or known associates. They carry indirect exposure to the same bribery and corruption risk as the PEP they are connected to. This category is the most commonly missed in screening programs, partly because it requires screening not just the customer but their network, and partly because the connection to a PEP may not be declared at onboarding.
What happens when PEP screening breaks down
PEP screening failures do not announce themselves at onboarding. They surface gradually. through changes in customer risk profiles that a periodic review process cannot catch in time.
The customer does not appear on any PEP database at the time of onboarding. They are assigned a standard risk rating, KYC documentation is collected and filed, and the relationship begins without any elevated due diligence requirements.
The customer accepts a senior position in a government ministry. Their name is added to PEP databases within days of the announcement. Without continuous re-screening, this change is invisible to your compliance program. The relationship continues under a standard risk rating that no longer reflects reality.
The institution's annual KYC refresh runs a name screen against the customer record. Due to a data entry inconsistency between the name on file and the name on the PEP database, the match is not returned. The customer's risk rating is renewed as standard. The relationship continues unchanged.
During a regulatory examination, examiners pull customer records and cross-reference them against current PEP databases. The customer's current status is identified. The institution has no EDD documentation, no source of funds assessment, and no senior management sign-off for a relationship that has been a PEP exposure for fourteen months. The finding is cited as a material deficiency.
Sentinel ™ re-screens your full customer portfolio continuously against live PEP databases. When the customer's name is added to a PEP list, the match is returned within hours. not at the next annual review cycle. The compliance team is alerted, EDD is triggered, and the documentation trail begins from the moment the risk materialises.
Continuous MonitoringWhat a compliant PEP screening program actually requires
Regulators are not looking for perfection. They are looking for evidence that your program is structured, documented, and proportionate to risk.
Screening must cover foreign PEPs, domestic PEPs, and PEPs by association. A program that screens the customer but not their close family members or business associates is incomplete. Most enforcement actions involving PEP failures cite the by-association category as the gap.
A PEP identification triggers an EDD process that must include verification of source of funds and source of wealth, an assessment of the purpose of the relationship, and documented senior management approval before the relationship is established or continued. Verbal sign-off is not sufficient for examination purposes.
PEP status changes. A customer who is not a PEP today may be one in six months. A former PEP may remain in scope for 12 to 18 months after leaving office. Periodic review cycles cannot reliably detect these changes in time. Continuous re-screening against live PEP databases is the only approach that closes this gap systematically.
Every PEP screening decision must be documented: the date of the screen, the database version used, the match result, the disposition decision, and who made it. When an examiner pulls a PEP record, they expect to see the full history of how the risk was identified, assessed, and managed. not a single onboarding entry and nothing since.
A PEP match is not the end of the process. It's the beginning of a documented decision.
Regulators do not expect compliance teams to reject every PEP. They expect a clear, documented, risk-proportionate response. Sentinel ™ surfaces the match, triggers the right workflow, and builds the audit trail automatically. so when an examiner asks how a PEP relationship was managed, the answer is already on record.
Know exactly who your customers are. and who they're connected to.
See how Sentinel ™ handles PEP identification, EDD workflows, and continuous monitoring in a single platform.