PEP Screening Process: A Compliance Playbook for Officers

PEP screening is the name-and-relationship check that determines whether a customer, once matched against a politically exposed persons list, triggers Enhanced Due Diligence before your firm can proceed. When a confirmed match appears, you have three obligations, not one: open an EDD file, escalate to senior management for approval, and document the disposition with a clear rationale. None of these steps is optional, and none can happen after onboarding.

In the next 24 to 72 hours after a hit, your team should:

• Verify the match against at least two independent identifiers (date of birth, office held, tenure dates) rather than relying on name similarity alone
• Open an EDD file immediately, even if verification is still pending
• Route the file to a designated senior approver, not a frontline analyst, for final sign-off

Pro Tip: Never auto-reject a match based on a single database hit. FATF’s guidance on Recommendations 12 and 22 is explicit that commercial databases alone are not sufficient for compliance, which means a rejection built on one vendor’s data point is as indefensible to an examiner as no screening at all.

Key Takeaways

Effective PEP screening depends on combining multiple data sources, documenting every disposition, and escalating confirmed matches through a senior-approved EDD process before onboarding proceeds.

Point	Details
Never rely on one database	Combine government registries, commercial data, and open datasets like OpenSanctions to close coverage gaps.
Tier your PEPs	Use a four-tier model to match EDD intensity and monitoring cadence to actual risk level.
Document every disposition	Write a rationale for every match outcome, confirmed or false positive, with sources checked.
Require senior sign-off	Route Tier 1 and Tier 2 EDD files to a designated approver before onboarding completes.
Rescreen on triggers	Set periodic refresh by tier, and force immediate rescreening after any material account change.

Authoritative Resources for PEP Screening

• FATF guidance: PEPs (Recommendations 12 and 22)
• FinCEN interagency statement on PEPs
• FFIEC guidance on PEPs and AML risks
• U.S. Department of the Treasury — OFAC
• OpenSanctions / EveryPolitician PEP data overview

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Table of Contents

• What Does the PEP Screening Process Actually Cover?
• How Should You Tier PEPs for Enhanced Due Diligence?
• What Are the Steps in the PEP Screening Process?
• What Belongs in an Enhanced Due Diligence Checklist?
• What Evidence Do Examiners Expect From Your Screening Program?
• How Do You Tune Automated PEP Matching Without Losing Audit Trail?
• How Long Should You Keep PEP Records, and When Do You Re-Screen?
• Strengthen Your Screening Program With the Right Tools
• Sources
• FAQ

What Does the PEP Screening Process Actually Cover?

Politically exposed persons screening exists to flag individuals whose public role or influence creates a heightened risk of bribery, corruption, or misuse of the financial system. FATF’s framework sets the baseline definition, but individual jurisdictions apply it with real variation. Some countries extend PEP status for life; others sunset it after a fixed period out of office. Your firm’s policy needs to state clearly which standard it follows and why, because an examiner will ask.

The distinction between domestic and foreign PEPs matters more than most onboarding teams treat it. A foreign PEP, someone holding a prominent public function in another country, generally warrants automatic EDD under FATF’s baseline expectations. A domestic PEP, by contrast, often gets a risk-based assessment first, meaning the depth of due diligence scales with other risk factors like the customer’s transaction profile, geography, and industry.

Relatives and close associates, commonly abbreviated as RCA, extend the same scrutiny to people connected to a PEP rather than the PEP alone. This category trips up more programs than any other part of the definition. Consider:

• Family members: spouses, children, parents, and siblings, though some jurisdictions extend this to in-laws
• Close associates: known business partners, joint account holders, or individuals publicly associated with the PEP’s financial affairs
• Beneficial owners: entities where a PEP holds a controlling or significant ownership stake, even indirectly

Missing an RCA connection is one of the most common gaps examiners cite, largely because ownership structures are rarely disclosed voluntarily.

How Should You Tier PEPs for Enhanced Due Diligence?

Not every PEP carries the same risk, and treating a former city council member the same as a sitting head of state wastes resources on one end and under-protects your firm on the other. A four-tier model gives your analysts a consistent framework for calibrating EDD intensity.

1. Tier 1: Heads of state, cabinet ministers, senior military and judicial officials. These require full EDD, source of wealth verification, and senior management approval before onboarding, with quarterly monitoring.
2. Tier 2: Senior legislators, regional governors, and senior executives of state-owned enterprises. Full EDD applies, but monitoring cadence can move to semiannual absent other risk flags.
3. Tier 3: Domestic PEPs in lower-profile roles, such as municipal officials. A risk-based EDD assessment applies, scaled to transaction volume and geography.
4. Tier 4: RCAs of tiers 1 through 3 with no direct public role. Screening applies, but the EDD burden is typically lighter unless the underlying PEP is high risk.

Seniority and tenure both shift tier placement. A former Tier 1 official three years out of office may drop to Tier 2 or 3 depending on your jurisdiction’s decay rules, while a newly appointed regional governor with control over public contracts might justify moving up from Tier 3.

What Are the Steps in the PEP Screening Process?

The workflow from onboarding to ongoing monitoring follows a consistent sequence, though the depth of each step depends on the tier you assign.

1. Collect complete identity data at onboarding. This includes full legal name, date of birth, nationality, government-issued ID, and, critically, beneficial ownership information for any corporate or trust structure involved. Skipping beneficial ownership is the single most common reason RCA connections get missed later.
2. Run the screening call across multiple sources. Query your vendor’s PEP database alongside public registries and open datasets. A single-vendor query is a coverage gap waiting to surface during an exam.
3. Verify the match manually. Compare date of birth, office held, and tenure dates against the record. Fuzzy name matches, especially across transliterated names from non-Latin scripts, produce a high volume of false positives that need human judgment, not automatic dismissal.
4. Document the disposition. Whether the outcome is confirmed, false positive, or inconclusive, write down the reasoning and the sources checked. An undocumented “cleared” disposition is functionally the same as no screening to an examiner.
5. Escalate confirmed matches to EDD. Structure the EDD file around source of funds, source of wealth, ownership review, and adverse media, and route it to a senior approver, never a frontline analyst acting alone.
6. Set the monitoring trigger. Confirmed PEPs need periodic refresh screening plus trigger-based rescreening whenever a material account change occurs.

Pro Tip: Build a standing template for EDD files before you need one. When a Tier 1 match hits at 4:45 p.m. on a Friday, the last thing you want is your team improvising a checklist from memory. A pre-built template with mandatory fields for source of wealth documentation and approval signatures cuts disposition time significantly and gives examiners a consistent structure to review.

What Belongs in an Enhanced Due Diligence Checklist?

A confirmed PEP match means EDD is not optional, and the checklist that follows needs to produce evidence an examiner can review without asking follow-up questions. A complete EDD file addresses:

• Source of funds: the specific transaction or account funding origin
• Source of wealth: the broader explanation for how the individual accumulated their overall net worth, not just the funds in this account
• Corporate ownership review: a full look at any entities the PEP controls or benefits from, including layered ownership structures
• Adverse media screening: negative news checks covering corruption, bribery, or fraud allegations, not just criminal convictions
• Transaction pattern review: an assessment of whether expected activity aligns with the customer’s stated profile and public role

Once the checklist is complete, your firm needs a documented decision path: accept, accept with conditions, or decline. FinCEN’s interagency statement clarifies that risk-based treatment is expected, meaning a blanket policy to decline every PEP relationship is neither required nor, in most cases, appropriate. What is required is senior management sign-off before any Tier 1 or Tier 2 relationship proceeds, and a written rationale if the decision runs against the compliance analyst’s initial recommendation.

Pro Tip: Treat “accept with conditions” as a real category, not a fallback. Conditions might include transaction limits, quarterly reviews instead of annual, or a requirement that source of wealth documentation be refreshed within 90 days. Writing these conditions into the file gives your monitoring team a concrete checklist rather than a vague instruction to “watch this account.”

Documentation standards matter as much as the checklist itself. Every EDD file needs a dated approval signature, a summary of sources checked, and a clear record of why the decision was made. Incomplete EDD files are one of the most frequently cited gaps in examiner findings, precisely because they’re the easiest thing to check.

What Evidence Do Examiners Expect From Your Screening Program?

Examiners don’t take your word that screening works. FFIEC guidance is specific about the artifacts your program needs to produce and retain, and the absence of any one of them is a finding waiting to happen.

Artifact or KPI	What Examiners Expect
Screening logs	Timestamped record of source queried, match outcome, and analyst identity for every screen run
Disposition records	Written rationale for every match outcome, confirmed, false positive, or inconclusive
EDD file completeness	Full checklist coverage plus dated senior management approval signature
Disposition time (SLA)	Time from match to documented disposition, tracked and reported to management
False-positive rate	Tracked over time to justify and periodically recalibrate matching thresholds

These metrics feed directly into your firm’s broader risk scoring workflow, since a PEP disposition should adjust a customer’s ongoing risk rating rather than sit as an isolated compliance note. Retention and retrievability matter just as much as the records themselves. If a file takes three days to locate during an exam, that delay itself becomes part of the finding.

How Do You Tune Automated PEP Matching Without Losing Audit Trail?

Fuzzy matching is what makes automated screening usable at scale, but an untuned threshold either buries your team in false positives or lets real matches slip through under a slightly different spelling. Set your threshold, document why you chose it, and review it on a fixed schedule rather than leaving it static for years.

• Document the matching algorithm and threshold percentage in your written policy, not just in vendor configuration settings
• Review thresholds at least annually, or immediately after a notable false-negative event
• Validate automated RCA mapping manually on a sample basis; automated relationship links can misfire, particularly with common surnames

Pro Tip: Transliteration is where automated matching quietly fails. A name rendered from Arabic, Cyrillic, or Chinese script into Latin characters can have multiple accepted spellings, and a threshold tuned for Western names often misses these variants entirely. If your customer base includes cross-border relationships, test your matching engine specifically against transliterated name sets before trusting it.

Integration patterns matter here too. The strongest programs auto-trigger EDD workflows the moment a match is confirmed, hand off to a designated approver automatically, and log every step for audit purposes. Firms building this into a broader automated KYC process find that the audit trail becomes a byproduct of the workflow rather than a separate task someone has to remember to complete.

How Long Should You Keep PEP Records, and When Do You Re-Screen?

Retention practices should align with FATF and FFIEC expectations, which generally point toward keeping screening records for the life of the relationship plus a defined period after closure, retrievable on short notice during an exam.

Refresh cadence should scale with tier:

• Tier 1 and Tier 2: rescreen at least quarterly, given the higher stakes of missing a status change
• Tier 3 and Tier 4: semiannual or annual rescreening is generally adequate absent other risk signals

Trigger events override the scheduled cadence entirely. A customer relocating, a significant change in transaction behavior, or news of a new public appointment should all force immediate rescreening, regardless of where that customer sits in the normal review calendar.

Declassifying a former PEP requires its own documentation trail: note the date the individual left public office, the jurisdiction’s specific decay period, and the rationale for downgrading the risk rating. A declassification without a paper trail looks, to an examiner, exactly like a compliance gap.

Who Built This Playbook: Author Background and Program Evidence

This playbook draws on more than 15 years of fraud strategy work from Zachary Allen, whose background spans building and auditing detection programs across e-commerce and financial services. That experience shapes the practical emphasis here, on documentation, escalation discipline, and the operational habits that hold up under exam scrutiny rather than just in theory.

Intelligentfraud maintains ongoing resources on adjacent compliance topics, including guidance on KYC in e-commerce and a practical risk management checklist for teams building out governance frameworks alongside their PEP screening controls.

What Actually Breaks PEP Programs in Practice

Most program failures I’ve seen trace back to two habits: relying on a single vendor’s database as if it were complete, and treating beneficial ownership collection as optional paperwork instead of the step that surfaces hidden RCA connections. Neither mistake shows up until an examiner asks the question you didn’t prepare for.

If you want one 30-day fix, audit your last quarter of “cleared” dispositions and check whether beneficial ownership was actually collected on each one. You’ll likely find gaps, and closing them is cheaper now than during an exam.

— Zachary

Strengthen Your Screening Program With the Right Tools

A disciplined process catches most gaps, but manual screening against scattered sources eventually hits a ceiling on speed and consistency. Pairing your PEP workflow with dedicated screening software reduces disposition time and gives you the audit trail examiners expect without building it by hand for every case. Intelligentfraud’s roundup of leading KYC platforms for regulated firms walks through the tooling options built specifically for this kind of multi-source screening and case management.

Sources

No single global “official” PEP list exists. OpenSanctions documents this gap directly, noting that PEP coverage is assembled from a patchwork of public and private sources, and that practitioners need to combine datasets rather than trust one to be complete. That single fact should reshape how your firm budgets for screening tools.

Common sources include:

• FATF guidance: PEPs (Recommendations 12 and 22)
• FinCEN interagency statement on PEPs
• FFIEC guidance on PEPs and risks associated with money laundering and terrorist financing
• U.S. Department of the Treasury — OFAC

Combining sources closes gaps that no single database covers alone, and documenting which source produced a given match is not optional paperwork. It’s what lets you reconstruct a decision months later when an examiner asks why a customer was or wasn’t flagged.

When evaluating a vendor, check three things before signing a contract: how frequently the database updates, whether the vendor discloses its data provenance, and whether RCA linkages are built in or require manual mapping. A vendor that can’t answer the provenance question clearly is a liability, not a convenience.

FAQ

Why Have I Been Flagged as a PEP?

A screening match typically occurs because your name, or a name similar to yours, appears in a database tracking individuals with prominent public roles, or because you’re linked as a family member or close associate of someone who holds such a role.

Is a PEP a High-Risk Customer?

PEP status is a risk factor that requires Enhanced Due Diligence, not an automatic high-risk classification. The actual risk rating depends on the tier of the role, the jurisdiction, and other factors like transaction behavior.

Can a PEP Be Rejected as a Customer?

Yes, but a blanket policy of rejecting every PEP is not required or generally appropriate under a risk-based approach. Firms can accept, accept with conditions, or decline, provided the decision is documented and, for higher tiers, approved by senior management.

What Are the Three Main Types of PEPs?

The three primary categories are foreign PEPs, domestic PEPs, and PEPs affiliated with international organizations, with relatives and close associates screened as an extension of each category rather than a separate type.

Recommended

• How to Comply with Anti-Fraud Regulations in 2026
• The Role of Compliance in Fintech: A Fraud-Prevention Playbook
• Fraud Detection Guide 2026: Strategies That Work
• Risk Management Checklist: A Practical 2026 Guide