Politically Exposed Person: Who Counts, and What Changes When One Signs

A new client fills in your onboarding form. The screening comes back with a flag: politically exposed person. Now what?

For a lot of firms the honest answer is a shrug followed by an internal email. The term shows up in every anti-money-laundering rulebook, and almost nobody outside a bank compliance desk knows what it obliges them to do.

So let's be concrete. A PEP is a client who holds, or recently held, a prominent public function, plus their close family and business associates. The flag doesn't mean the client is a criminal. It means the money they control is more likely to have come from corruption than the average client's, so you owe a harder look before you sign anything.

The definition comes from the Financial Action Task Force, in Recommendations 12 and 22, and every national regime copies it with local wording. Screening for it is one duty inside the wider anti-money-laundering regime, a distinction worked through in KYC vs AML.

A prominent public function means real power over public money or public decisions. Heads of state and government. Senior politicians. Senior judiciary whose decisions aren't normally appealed. Senior military officers. Board members of central banks. Ambassadors. Senior executives of state-owned companies. Senior figures in political parties.

Middle-ranking and junior officials are out. A tax inspector isn't a PEP. A finance minister is.

Why the category exists at all

Corruption money has to leave the country it was stolen from, and it needs a legitimate-looking business relationship to do it. The PEP rules exist because that pattern repeated often enough to become a standard.

Which is also why the rules reach past the official themselves. Nobody launders proceeds in their own name if a spouse or a business partner will do.

Foreign PEPs hold a prominent function in another country. These carry the highest risk rating almost everywhere, and in most regimes enhanced measures are mandatory rather than risk-based.

Domestic PEPs hold the function in your own country. Treatment is usually risk-based: you assess, and you apply enhanced measures where the assessment says so.

The third category is people entrusted with a prominent function by an international organisation: directors, deputy directors, board members of bodies like the UN or the World Bank.

Family members and close associates

This is the part firms miss, and it's where most of the actual exposure sits.

Family normally covers the spouse or partner, children and their spouses or partners, and parents. Close associates covers people known to have joint beneficial ownership of a company with the PEP, and anyone who holds a company set up for the PEP's benefit.

The abbreviation you'll see in screening tools is RCA, for relatives and close associates. A client can be perfectly obscure and still be an RCA of someone who isn't.

There's no single answer, and this is one of the most-asked questions in every language.

The FATF position is that the status doesn't expire on a fixed date. You assess the residual risk: how senior the role was, how much influence survives it, whether the person still holds sway over the same institutions.

National regimes then put floors under that:

• The European Union requires at least twelve months of continued treatment after the person leaves office, and firms must keep applying a risk-based judgement after that
• Brazil works to five years after the person ceases to hold the function
• United States guidance under the BSA/AML manual is risk-based, without a fixed cut-off

A former minister who left office fourteen months ago is not automatically clean. If the answer to "does this person still have influence over public contracts?" is yes, the enhanced treatment continues.

Four things, and none of them is "decline the relationship". All four sit on top of the ordinary client identity verification you already run.

1. 1
   Senior management signs off. Someone with actual authority in your firm, not the person who did the onboarding, has to approve entering or continuing the relationship. In writing.
2. 2
   You establish source of wealth and source of funds. These are two different questions. Source of wealth asks how the client's overall fortune was built. Source of funds asks where the specific money in this transaction came from. A salary slip answers neither on its own.
3. 3
   Ongoing monitoring gets tighter. More frequent review, lower alert thresholds, and someone actually reading the alerts.
4. 4
   Screening runs again, not once. People become PEPs after you onboard them. An unremarkable client who wins an election in March is a PEP in April, and only periodic rescreening will tell you.

Worth being blunt about the cost: this is a real workload, and it's why firms quietly avoid the flag rather than handle it. That avoidance is its own regulatory problem, covered below.

This needs saying plainly, because a lot of firms get it backwards.

A PEP flag is a risk indicator, not an accusation. Holding public office isn't a crime, and refusing an entire category of clients because handling them is inconvenient has a name in supervisory language: de-risking. The FATF has criticised it repeatedly, on the grounds that pushing people out of the regulated financial system makes their money harder to trace, not easier.

So the correct response to a PEP flag is more scrutiny, documented, with a decision at the right level. Not a polite refusal email.

There's an uncomfortable corollary. If you decline PEPs by default, you never build the procedure, and the day a supervisor asks how you handle them you have nothing to show.

PEP screening tends to live in a different system from the agreement it protects, and that split is where the evidence falls apart.

The pattern is familiar. Someone runs the client through a screening tool, exports a PDF, and files it. Weeks later the contract goes out through a signing tool that knows nothing about any of it. When a supervisor asks what you knew about this client at the moment you committed, you have two documents, two timestamps, and no link between them.

Running the screen inside the signing flow removes the gap. The identity check, the PEP and sanctions result, and the signature itself land in one audit trail, anchored so the record can't be revised after the fact. Senior sign-off attaches to the same file rather than living in an inbox.

It also fixes the rescreening problem in the least glamorous way possible: if screening is part of how documents get signed, it happens again every time the client signs something.

Screening the client and stopping there. Family members and close associates are where most exposure hides, and a name-only check against the client won't surface them.

Treating the flag as a verdict. A hit is a starting point. Screening lists are built on name matching and they produce false positives constantly, which is why the discounting decision has to be written down.

Screening once at onboarding is the third mistake, and the most common. Status changes with elections and appointments, and a file that was clean in January can be a PEP file by summer.

Keeping the screening result apart from the agreement. Two records that don't reference each other are hard to defend, even when both are individually sound.

A politically exposed person is a client whose position makes corruption proceeds more plausible than average. The obligation that follows isn't refusal, it's evidence: senior approval, source of wealth, tighter monitoring, and screening that repeats.

The two failures worth guarding against are opposite. One is treating the flag as a reason to walk away, which supervisors read as de-risking. The other is treating it as a formality, running one check at onboarding and never looking again.

If you only fix one thing, make it the link between the screening result and the signed agreement. That pair is what you'll be asked to produce together, and producing it from two systems weeks later is how firms discover their process only existed on paper.