PEP Screening: Who Counts, and for How Long

A screening alert for a person in public life is often mishandled as a rejection signal. That is not what the UK anti-money-laundering framework requires. The question for a bank, payments firm or other regulated business is whether the customer presents a higher risk of bribery, corruption or misuse of public office, and what controls are proportionate to that risk.

That distinction matters for customers as well as compliance teams. An unresolved name match can identify the wrong individual, while a confirmed match calls for enhanced due diligence, not an automatic refusal of service. Policies that treat every alert as a decline can exclude legitimate customers without improving the quality of financial-crime controls.

The category is broader than foreign officeholders

UK government guidance describes a PEP as an individual entrusted with a prominent public function. Core examples include a non-UK or domestic member of parliament, a head of state or government, and a government minister. The underlying regulatory definition is broader than those examples and also captures specified senior judicial, military, central-bank, state-enterprise and international-organisation roles.

The inclusion of domestic officeholders is important. Some vendor materials still frame screening as a foreign-PEP exercise, a legacy of rules that historically placed particular emphasis on foreign officials. That framing is incomplete in the UK. A domestic role can create relevant corruption risk, although a domestic customer should not be presumed higher risk merely because they hold office.

The definition also covers family members and known close associates. They are not a discretionary, secondary tier that a firm can ignore after screening the officeholder. Relatives can include a spouse or equivalent partner, children and their partners, and parents. Close associates generally include people with a known joint beneficial ownership or close business relationship, or a sole beneficial ownership arrangement established for the public official’s benefit. Firms should assess evidence carefully: an alleged social connection is not necessarily a qualifying association.

What a confirmed match requires

Once a firm has reliably identified a customer, beneficial owner or relevant connected person as falling within the definition, it must apply PEP-specific enhanced due diligence. Enhanced due diligence means extra checks and controls where risk warrants them. It does not mean that the relationship is prohibited.

• Obtain senior management approval before establishing a new business relationship.
• Take adequate measures to establish the source of wealth, meaning how the person accumulated their overall assets. Firms will often also need to understand the source of funds used in the particular transaction or account.
• Apply enhanced, ongoing monitoring of the relationship, including scrutiny of activity against the customer’s known profile and risk assessment.

The practical sequence matters. A screening tool produces a possible match, often based on a name, date of birth, nationality, role and other identifiers. Analysts must resolve that match before applying the designation. For a confirmed case, senior approval and documented source-of-wealth work should be meaningful rather than a box-ticking exercise. The depth of review should reflect the office, jurisdiction, products, ownership structure and transaction pattern.

No simple expiry date

Government guidance does not give firms a universal expiry date after which a former officeholder can be treated as ordinary risk. It describes the measures as applying while the business relationship continues and supports a risk-based assessment of whether the influence and corruption risk associated with the former role persist.

UK anti-money-laundering rules also require firms to take continuing risk into account for at least 12 months after a person leaves a prominent function, and to continue the measures until the person is no longer considered to pose such risk. That is a minimum period for assessment, not a safe-harbour rule that makes every former official low risk on day 366. Conversely, indefinite treatment without review is difficult to reconcile with a genuinely risk-based programme.

For groups operating across the US, EU and UK, terminology and local implementation differ, but the central compliance principle is consistent: public-office exposure is a risk factor, not evidence of criminal conduct. Firms need clear records of why a person was identified, how a match was resolved, what controls were approved and when the risk assessment was revisited.

Declining every match is de-risking

A business may decide not to enter a relationship where it cannot manage the risk or obtain credible information. But a blanket rule against confirmed PEPs substitutes de-risking, the withdrawal from a customer category to avoid perceived compliance cost, for case-by-case compliance. It can also encourage overreliance on vendor labels and obscure the key decision: whether the firm understands the customer and can control the identified risk.

The stronger approach is narrower and more defensible: screen accurately, verify identity and role, include relatives and close associates within the same assessment, secure the required senior approval, investigate wealth proportionately and monitor over time. A PEP match should start that process, not end it.