PEP screening: what a match means and what to do next

A PEP match tells you two things you do not yet know: whether this is really the listed person, and what kind of politically exposed person they are. Answer those first. Only then does the FATF standard tell you what to do, and for most categories the answer is more diligence, not refusal. The FATF's own guidance says that refusing a business relationship "simply based on the determination that the client is a PEP is contrary to the letter and spirit of Recommendation 12".

In practice: confirm the identity, classify the person (foreign PEP, domestic PEP, international organisation PEP, or a family member or close associate), and apply the measures that class requires. Foreign PEPs always get enhanced due diligence. Domestic and international organisation PEPs get it when your risk assessment finds the relationship higher risk.

What does the standard actually require?

Recommendation 12 (opens in a new tab) (FATF Recommendations, updated October 2025) sets two tiers.

The FATF glossary gives examples of prominent public functions: heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations and important political party officials. It adds that the definition "is not intended to cover middle ranking or more junior individuals". Your national rules may define the categories more precisely.

Step 1: is it really the same person?

Screening tools return candidates, not conclusions. The FATF's June 2013 PEP guidance (opens in a new tab) says that if a tool indicates a PEP "but if doubts still exist, further investigation is necessary to be able to reach a sufficiently clear decision on the classification of the customer".

Compare the identifiers you hold (date of birth, nationality, place of birth, known positions) with the profile behind the match. A verified date of birth that is 30 years away from the PEP's is a strong reason to clear. A matching name, age and home state is a reason to keep going.

The same guidance warns about over-relying on databases. On commercial PEP databases it says: "Use of these databases is not required by the FATF Recommendations, and is not sufficient for compliance with Recommendation 12." With elections and cabinet changes "taking place almost daily around the world", it says, such lists "cannot be relied upon as being up-to-date". A customer can be a PEP without appearing in any list, which is why your onboarding questions (occupation, employer, declared public roles) still matter.

Step 2: which kind of PEP?

Classification decides the obligations, so record it explicitly.

• Foreign PEP. The guidance says foreign PEPs "are always considered high risk and require the application of enhanced due diligence measures". Knowing the person well does not change that; the guidance calls it "a misconception" that detailed knowledge lets a higher-risk PEP be treated otherwise.

• Domestic or international organisation PEP. Assess the relationship. The guidance asks you to understand the particular public function: seniority, access to or control over public funds, and the nature of the position. If the relationship is normal or low risk, enhanced due diligence is not required.

• Family member or close associate. Treat them under the rules for the PEP they are connected to. The guidance notes that who counts as family or a close associate varies by culture and can be broad.

• Former PEP. Recommendation 12 covers people who "are or have been" entrusted with prominent functions. The guidance says handling a former PEP "should be based on an assessment of risk and not on prescribed time limits", considering continuing influence, seniority and links between old and new roles.

Step 3: what does enhanced due diligence involve?

For a foreign PEP, or a higher-risk domestic one, three things are required.

1. Senior management approval, for new customers and for continuing an existing relationship when a customer becomes a PEP. The guidance leaves the level of seniority to each firm, and says it is best to document the approval or refusal in writing.

2. Source of wealth and source of funds. They are different. Source of wealth is the origin of the person's entire body of wealth. Source of funds is the origin of the money in this relationship: the amounts being deposited or transferred. The guidance says source-of-funds information "should not simply be limited to knowing from which financial institution it may have been transferred".

3. Enhanced ongoing monitoring, so that activity stays consistent with what you learned about wealth and funds.

If at any point you suspect the funds are proceeds of crime, the guidance is clear that a suspicious transaction report should be filed.

A worked example: two matches, two outcomes

An illustrative payments company in Lagos gets two PEP matches in one week.

The commissioner's spouse. A merchant applicant is married to a serving state commissioner, a role the company's policy treats as a domestic PEP. That makes her a family member of a domestic PEP. The company assesses the relationship: a small retail business, turnover consistent with the declared trade, no link between the business and the commissioner's portfolio. The assessment finds it normal risk, so standard due diligence applies. The classification, the reasoning and the date are recorded, with a note to revisit if the business starts contracting with the state.

The visiting minister. A retail wallet applicant is a serving minister of another country. Foreign PEP: enhanced due diligence is mandatory whatever the product. The company asks for source-of-funds information for the expected inflows, gathers what it can on source of wealth, escalates the approval decision to its head of compliance and chief executive, records the decision in writing and sets tighter monitoring thresholds.

Neither applicant is refused because of PEP status alone. One is approved with standard diligence; the other proceeds only with approval and enhanced measures, or is declined for a documented risk reason.

Where does Myaza Trust help?

Watchlist Screening includes a PEP screening type alongside sanctions and adverse media, applied to individuals, including the directors and beneficial owners of businesses you onboard. A match arrives as POTENTIAL_MATCH with the matched name, score, match types and aliases for an analyst to review (screening documentation). Clearing a false positive stops that match re-flagging for the customer; confirming it flags the identity.

For the diligence itself, a workflow can include a questionnaire that collects source-of-funds and occupation declarations inside the flow, and a confirmed match can be worked in Cases & SAR Filing: an investigation with a priority, a deadline, an owner and notes that cannot be edited afterwards, where you can record the classification, the evidence and the senior management decision. If a report is needed, a draft suspicious activity report is generated from the case, and the person who drafted it cannot be the one who files it.

The approval decision itself belongs to your senior management, not to software.

Your PEP match checklist

• Confirm identity with verified identifiers before classifying.

• Record the classification: foreign, domestic, international organisation, family member, close associate, former.

• Foreign PEP: senior management approval, source of wealth and funds, enhanced monitoring. Every time.

• Domestic or international organisation PEP: a written risk assessment decides whether those measures apply.

• Never decline on PEP status alone; decline for a documented risk reason if you decline.

• Revisit former PEPs on risk, and re-screen existing customers, because people become PEPs after onboarding.

National definitions of PEP, family member and close associate differ, as do time limits. Requirements differ by jurisdiction, and this article is general information, not legal advice.