A PEP screening check asks a narrower question than most onboarding checklists assume. It does not ask whether someone is a criminal, and it does not ask whether a transaction looks suspicious. It asks whether a customer, or the beneficial owner standing behind a customer, currently holds — or has ever held — a role with enough proximity to public power that money moving through their accounts could plausibly include public funds, bribes, or the proceeds of abused office.
That narrower question still needs a name to check it against, a tier to classify it into once a hit lands, and a monitoring cycle that doesn’t expire the day an account opens. PEP screening sits next to sanctions screening and adverse media screening in most onboarding flows, and the three get conflated more often than their results justify: a clean sanctions screen and a clean adverse media screen say nothing about whether a customer’s majority shareholder was, until last year, a sitting minister. This piece works through what a PEP actually is under the Financial Action Task Force’s (FATF) standard, the four classification tiers that standard sets, where PEP screening sits relative to sanctions and adverse media checks, what FATF Recommendations 12 and 22 and the EU’s new AML Regulation require once a PEP is identified, how the databases behind a name-match screen are actually built and why that step produces so many false positives, how the EU’s 12-month post-office rule compares with what the UK and US actually require, and why — per a live sample of Zavia’s own dataset — the harder failure point is often finding a name to screen in the first place.
01What counts as a politically exposed person
FATF does not regulate companies directly; it sets the 40 Recommendations that its member jurisdictions then transpose into domestic law, which is why the wording of a “PEP” policy varies slightly between a US bank, an EU-based firm, and a Gulf regulator’s rulebook, even though all three ultimately trace back to the same source text. FATF’s own definition is narrower than it’s often assumed to be: a PEP is an individual who is or has been entrusted with a prominent public function. The word “prominent” is doing real work — FATF’s guidance on Recommendations 12 and 22 is explicit that the category is not meant to sweep in middle-ranking or junior officials, only those whose role carries genuine influence over public funds, procurement, or state assets.
It’s also, by FATF’s own framing, a preventive classification rather than an accusation. FATF’s guidance states plainly that these requirements are preventive, not criminal, in nature, and should not be interpreted as meaning that all PEPs are involved in criminal activity. A PEP hit raises the intensity of due diligence a firm must apply; on its own, it is not grounds to refuse or end the relationship — a distinction covered in Section 10 below.
02The four PEP tiers
FATF’s standard splits politically exposed persons into four groups, and the split matters because the required due diligence response differs between them:
- Foreign PEPs. Individuals entrusted with a prominent public function by a foreign country — heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises, and important political party officials. Recommendation 12 requires enhanced due diligence on foreign PEPs without exception, regardless of the relationship’s assessed risk level.
- Domestic PEPs. The same categories of role, held within the screening firm’s own jurisdiction rather than a foreign one. FATF’s standard asks firms to take reasonable measures to determine domestic PEP status and apply enhanced scrutiny where the relationship itself is higher-risk — a risk-based obligation, lighter than the unconditional one that applies to foreign PEPs.
- International organisation PEPs. Senior management of an international organisation — directors, deputy directors, and board members or equivalent — entrusted with a prominent function by that organisation rather than by a state. Treated under the same risk-based standard as domestic PEPs.
- Family members and close associates. FATF extends the same due diligence obligations outward to immediate family and known close associates of a PEP in any of the first three categories, on the view that routing funds through a relative or associate is one of the more common ways a PEP’s exposure gets obscured rather than eliminated.
Does a hit on a foreign head of state’s adult child really warrant the same response as a hit on the head of state? FATF’s standard says yes: it triggers the same enhanced due diligence response as a hit on the head of state directly, even though the child holds no public office at all.
03PEP screening vs. sanctions screening vs. adverse media screening
Why run three separate screens when any one of them might already look clean? Because PEP screening, sanctions screening and adverse media screening ask genuinely different questions against different data, and a clean result on one says nothing about the other two. Sanctions screening matches a name against a government designation list. Adverse media screening searches news and public-record sources for negative coverage. PEP screening checks a role, current or former, against a classification standard that no single published list fully captures. The table below lays out where each one actually operates.
| Issue | PEP screening | Sanctions screening | Adverse media screening |
|---|---|---|---|
| What it checks | A current or former public role, or a family/associate link to one | A name against a government or supranational designation list | News, litigation and public-record mentions for reputational risk |
| Primary data source | PEP databases, registry/officer data, self-declaration | OFAC SDN, EU consolidated list, UK OFSI list, equivalents | News archives, court records, regulatory actions |
| A “hit” means | Risk classification requiring closer scrutiny, not a finding of wrongdoing | Name-match against a list a government has already published | A substantive negative mention exists in a monitored source |
| Required response | Senior management approval, source-of-wealth check, enhanced ongoing monitoring | Case-by-case review; a confirmed match blocks the transaction | Risk-based review; weight depends on source credibility and recency |
| Does it expire? | No fixed clock at onboarding; EU rule keeps EDD running at least 12 months after the person leaves the role | No — remains in force until the designation is formally lifted | No fixed clock — ages gradually with recency and corroboration |
| Governing standard | FATF Recommendations 12 & 22 | FATF Recommendations 6 & 7; OFAC/EU/UK sanctions regimes | No single binding standard; risk-based AML guidance generally |
04What FATF Recommendations 12 and 22 actually require
Recommendation 12 is the operative FATF standard on PEPs. For foreign PEPs — acting either as the customer or as the beneficial owner behind one — it requires financial institutions to run four things beyond standard due diligence: a risk management system capable of determining whether a customer or beneficial owner is a PEP; senior management approval before establishing or continuing the relationship; reasonable measures to establish the source of wealth and the source of the funds involved; and enhanced ongoing monitoring of the relationship. A second limb of the same Recommendation extends a lighter, risk-based version of that detection obligation to domestic PEPs and international organisation PEPs — firms must take reasonable measures to determine that status, and apply the enhanced measures where the relationship itself is assessed as higher-risk, rather than unconditionally.
Recommendation 22 does the structural work of making Recommendation 12 bind outside banking: it extends the same customer due diligence and PEP obligations to designated non-financial businesses and professions — lawyers, notaries, accountants, real estate agents, trust and company service providers, casinos, and dealers in precious metals and stones, among others — when they carry out the specific activities the Recommendation lists. Without Recommendation 22, a PEP who couldn’t open a bank account directly could still route the same funds through a law firm’s client account or a real estate transaction untouched by Recommendation 12.
One operational point FATF’s own guidance makes explicit, and that compliance teams routinely skip past: a commercial PEP database is a tool, not a compliance program on its own. FATF’s guidance states that such databases are not sufficient by themselves to meet the Recommendation 12 and 22 requirements, and that FATF does not mandate their use. A name-matching subscription can tell you someone appears on a published PEP list; it cannot establish source of wealth, and it cannot substitute for the underlying ownership and officer data a firm needs in order to know whose name to check in the first place — the problem Section 09 measures directly. Section 05 below unpacks exactly how those databases work, and why the name-matching step itself is where a large share of PEP alerts turn out to be noise.
05How PEP databases are built, and why false positives are so common
A commercial PEP database is not a government list the way a sanctions list is. No state publishes an official, exhaustive PEP register, so vendors build their own from gazettes, appointment records, state-owned enterprise filings and news coverage — then maintain it as people move in and out of office. Coverage is uneven: digitised, searchable gazettes get tracked faster than paper-based ones, and a newly appointed provincial official can sit unlisted for months.
The harder problem is matching a name against that list reliably. Exact-string matching misses too much — transliteration from Arabic, Cyrillic or Chinese script routinely produces several plausible Latin spellings of the same name — so systems run fuzzy matching instead: Levenshtein edit-distance scoring, Jaro-Winkler weighting for name prefixes, and phonetic algorithms like Soundex for names that sound alike but are spelled differently. FATF prescribes no specific algorithm, only that the system handle variation, aliases and typos.
If a database returns ten candidates for every real match, what is an analyst meant to do with that list? Published false-positive estimates vary enormously — from 90-95% for loose name-only matching to 15-25% in tighter vendor benchmarks — and no single number generalises across systems and name populations. The one point of agreement: name similarity alone is weak, since a handful of surnames cover a large share of some populations, and a name-only match against a common surname flags unrelated people by the thousand. A secondary identifier — date of birth or nationality — narrows the list far more than a tighter name threshold. Section 09 below measures how often that data is even available.
06A worked example: escalating an ambiguous name match
What happens when the hit isn’t a clean match — just a name close enough to worry about? A screening system flags an onboarding customer, Nguyen Van Minh, against a foreign-PEP record for a provincial deputy minister who held office from 2015 to 2019. The similarity score is 0.88 — high enough to alert, low enough to leave genuine doubt — and the surname is one of the most common in the record’s country.
The first move isn’t to decide the match; it’s to inventory what’s known. The onboarding file has date of birth, nationality and address; the gazette-sourced PEP record has an appointment date, a role title, and — less often than compliance teams would like — a birth year. Does the customer’s age bracket fit someone who could plausibly have held that role in 2015? Does the nationality match? Is there an ID number to compare directly, rather than inferring from a name alone?
Two outcomes follow, and FATF expects a documented answer either way. If the identifiers align, or nothing rules the match out, the file escalates under Recommendation 12: senior management sign-off, a source-of-wealth check, enhanced ongoing monitoring. If they clearly conflict — a birth year that puts the customer at age eleven when the role began — the analyst documents the disconfirming evidence and closes the alert, rather than waving it through on a hunch.
The default is to resolve genuine ambiguity conservatively, not to auto-escalate every low-confidence alert without documented reasoning — that just produces the alert fatigue and blanket-refusal pattern Section 10 addresses directly.
07The EU’s rule: Regulation (EU) 2024/1624 and the 12-month tail
The EU implements the FATF PEP standard through what is now a directly applicable Regulation rather than a directive each member state transposes at its own pace. Regulation (EU) 2024/1624 — part of the AML package that, alongside the new AMLA authority, succeeds the AMLD5/AMLD6 directive-based approach — sets out the baseline PEP measures in Article 42: senior management approval, measures to establish source of wealth and source of funds, and enhanced ongoing monitoring, mirroring FATF Recommendation 12 closely.
Article 45 is the provision that trips up a point-in-time mental model of PEP status. It requires obliged entities to keep applying enhanced due diligence for at least 12 months after a person leaves the prominent public function that made them a PEP, and to factor that former role into the ongoing money-laundering and terrorist-financing risk assessment the firm runs under Article 20 — not to drop the classification the day the person leaves office. Article 46 then extends the Article 42, 44 and 45 measures outward to family members and known close associates, closing at the implementation level the same gap FATF’s fourth tier addresses at the standard-setting level. AMLA, the EU’s new AML authority, is tasked with issuing further guidelines on identifying close associates and calibrating former-PEP risk by 10 July 2027 — a sign the Regulation’s drafters expect the 12-month floor to be a starting point for supervisors, not the final word. How that floor compares with the UK and the US — two jurisdictions that take noticeably different approaches to the same post-office question — is worth setting out directly.
08PEP sunset rules beyond the EU: how the UK and US compare
If the EU fixes a 12-month floor, does every other regulator start that clock the same way? They don’t.
The UK’s Money Laundering Regulations, as amended, land close to the EU’s position for the PEP personally: HMRC’s guidance treats a former PEP as subject to enhanced due diligence for a minimum of 12 months after leaving office, extendable where risk justifies it. Family members and close associates differ: that obligation ends as soon as the PEP leaves office — the opposite of the EU’s Article 46, which extends the full 12-month tail to them too. The FCA’s July 2025 guidance, FG25/3, now presumes domestic PEPs and their associates start from a lower risk baseline than foreign PEPs, applied group-wide, and removes non-executive civil-service board members from PEP status altogether.
The US takes a different architecture rather than a different number. No BSA regulation applies specifically to PEPs, and the FFIEC’s examination manual is explicit that no customer type automatically presents higher money-laundering risk — banks aren’t required to apply a fixed post-office period. When enhanced monitoring can reasonably stand down is left to the institution’s own risk-based review, not a statutory clock.
The same former PEP, screened by three firms under three rulebooks, can lawfully exit enhanced monitoring at three different points: the EU’s 12-month floor, immediately for an associate under the UK’s rule, or whenever a US institution’s own risk review decides. One clock doesn’t fit every jurisdiction.
09The prerequisite problem: you can’t screen a name you don’t have
Every step above assumes a compliance team already has a name — a customer, a beneficial owner, a director — to run against a PEP classification in the first place. That assumption is often where the process actually breaks, and it breaks earlier than the PEP question itself.
In a live, stratified sample of 405 companies drawn from Zavia’s own dataset on 20 October 2026 — 27 companies apiece across 15 jurisdictions, from the UK, Germany and the US to Denmark, Belgium, Singapore and Poland — 85.2% (345 of 405) returned at least one named officer: a director, secretary, or equivalent role-holder disclosed by the company’s home registry. Officer data, where a registry collects it at all, is disclosed often enough that a PEP check against named directors and officers is usually possible to run.
Ownership data tells a different story. Only 16.0% of the same sample (65 of 405) yielded a named natural-person shareholder from the public filing alone. 48.9% (198 of 405) returned no shareholder register at all, and a further 35.1% (142 of 405) disclosed a shareholder list naming only corporate entities — a holding company, a fund, a nominee — with no natural person behind it visible in that filing. For well over four in five companies in this sample, the beneficial-owner-level PEP question — is the person who actually controls this company, as opposed to whoever manages it day to day, a politically exposed person — has no public starting point at all.
That gap matters because FATF’s PEP standard applies to the customer or the beneficial owner, explicitly either one. A PEP check that only ever reaches a company’s listed directors, because that’s the only layer the public record discloses, is answering half the question Recommendation 12 actually asks.
For the registry-by-registry process of closing this gap — tracing a corporate shareholder up to the natural person who actually controls it — see UBO Verification Workflow: From Initial Check to Ongoing Monitoring.
10FATF’s warning: don’t blanket-refuse PEP relationships
Is refusing service to every PEP the safer compliance choice? It’s an easy mistake to make: the intensity of the required response to a PEP hit gets misread as a mandate to exit the relationship outright, and some institutions default to exactly that — declining or closing any account connected to a PEP regardless of the specific risk involved. FATF has pushed back on that pattern directly. Its risk-based-approach guidance is explicit that wholesale refusal or termination of entire categories of customer, without assessing the actual risk each one presents, is not what the FATF standards require and sits in tension with the risk-based approach the standards are built on. Recommendation 12 asks for enhanced due diligence, senior management sign-off, and closer monitoring — a heavier process, not an automatic exit.
The practical risk of over-refusing runs in the opposite direction from the risk the PEP rule is meant to manage: a government minister or state-owned enterprise executive who is refused service by well-regulated institutions doesn’t stop transacting — they move to institutions with weaker controls, which is the outcome AML standards are trying to prevent in the first place. FATF’s financial-inclusion work makes the same point from the other side: a PEP classification applied too bluntly to an entire class of customer, such as every domestic official regardless of seniority or actual risk, pushes legitimate low-risk customers out of the regulated system rather than catching anyone genuinely high-risk.
11Building a PEP screening workflow
- Screen the customer and the beneficial owner, not just the entity name. Both are explicitly in scope under Recommendation 12.
- Classify any hit into the correct tier. Foreign, domestic, international organisation, or family/associate — the tier determines whether enhanced due diligence is mandatory outright or risk-based.
- Confirm an ambiguous match with a secondary identifier — date of birth, nationality, or an ID number — before escalating or dismissing a name-only hit.
- Establish source of wealth and source of funds before completing onboarding for any confirmed foreign PEP.
- Obtain senior management approval to establish or continue the relationship — a documented step, not a formality.
- Apply enhanced ongoing monitoring, calibrated to the specific relationship’s risk rather than applied uniformly.
- Re-screen on a trigger event, not only at onboarding. Covered in the next section.
12When a clean PEP screen goes stale
A PEP status is a snapshot, not a standing fact. The events below should each trigger a re-screen, not just a note in the file.
| Trigger event | Why it invalidates the prior screen |
|---|---|
| Person moves into a new public role | May newly qualify as a PEP, or move into a higher-risk tier — e.g., a domestic role to a foreign assignment |
| Person leaves the public role | Starts the EU’s minimum 12-month continued-EDD clock under Art. 45, rather than ending the obligation |
| New family or close-associate relationship identified | Extends the same enhanced measures under FATF’s fourth tier and the EU’s Art. 46 |
| Periodic review cycle elapses | PEP databases and public records update continuously; a point-in-time screen ages |
| New ownership disclosure or adverse media surfaces | May reveal a beneficial owner’s PEP status that an officer-only screen never reached |
13Glossary
14Frequently asked questions
What is a politically exposed person (PEP)?
FATF defines a PEP as an individual who is or has been entrusted with a prominent public function — for example a head of state, senior politician, senior government, judicial or military official, or senior executive of a state-owned enterprise. It is a risk classification that triggers closer scrutiny, not a finding that the person has done anything wrong.
What are the four PEP classification tiers?
Foreign PEPs (prominent roles held abroad, subject to mandatory enhanced due diligence), domestic PEPs (the same roles held in the screening firm’s own jurisdiction, subject to risk-based enhanced due diligence), international organisation PEPs (senior management of an international body), and family members or close associates of anyone in the first three tiers.
Is a PEP hit a reason to refuse or close an account?
Not on its own. FATF’s guidance is explicit that wholesale refusal of entire categories of customer, without assessing each one’s actual risk, is not what its standards require. Recommendation 12 calls for enhanced due diligence, senior management approval, and closer monitoring — a heavier process, not an automatic exit.
How is PEP screening different from sanctions screening?
Sanctions screening matches a name against a government designation list and is binary: a confirmed match blocks the transaction. PEP screening checks a role, current or former, against a classification standard, and a hit triggers enhanced scrutiny rather than an automatic block. The two run on different data and can produce completely independent results for the same customer.
How long does enhanced due diligence apply after someone leaves a PEP role?
Under the EU’s Regulation (EU) 2024/1624, Article 45, obliged entities must keep applying enhanced due diligence for at least 12 months after the person leaves the prominent public function, and must continue factoring the former role into the firm’s broader risk assessment after that floor. FATF’s own standard does not set a specific number of months, leaving the question to national implementation.
Can a commercial PEP database alone satisfy FATF’s requirements?
No. FATF’s own guidance on Recommendations 12 and 22 states that such databases are not sufficient by themselves to meet the requirements, and that FATF does not mandate their use. A database can flag a name match; it cannot establish source of wealth or substitute for the underlying ownership and officer data needed to know whose name to check.
Does PEP screening cover beneficial owners, or only named customers?
Both, explicitly. Recommendation 12 applies to a customer or a beneficial owner. In practice this is the harder half to run: in a live sample of 405 companies drawn from Zavia’s own dataset, 85.2% disclosed a named officer, but only 16.0% disclosed a named natural-person shareholder — so an ownership-level PEP check frequently has no public starting point even where an officer-level one does.
Why do PEP name screenings generate so many false positives?
Mainly because name similarity alone is weak: fuzzy matching catches transliteration and spelling variants, but also flags unrelated people sharing a common surname. Estimates vary widely, from 90-95% for loose name-only matching to 15-25% in tighter vendor benchmarks. A secondary identifier — date of birth or nationality — narrows the list more than adjusting the algorithm alone.
Does the 12-month enhanced due diligence period after leaving a PEP role apply the same way everywhere?
No. The EU sets a 12-month floor for the PEP personally; the UK lands close to that figure but drops the obligation for family and close associates immediately once the PEP leaves office — the opposite of the EU’s approach. The US risk-based framework sets no fixed number of months at all, leaving the point at which monitoring stands down to the institution’s own risk review.
Screen the name you have. Then find the one the filing didn’t give you.
Zavia connects to official company registries in 173 countries, so PEP checks run on real officer and shareholder data.
For deeper reading on adjacent topics covered only briefly here: how a sanctioned beneficial owner can sit undetected behind a clean entity-level check is covered in Sanctions Screening and Beneficial Ownership; how reputational risk from news and public records compares to ownership verification is covered in Adverse Media Screening vs. Beneficial Ownership Verification; and the end-to-end process of establishing and monitoring who actually owns a company is in UBO Verification Workflow.
