PEP Screening in 2026: Tiers, RCAs and Why Most Vendors Get the Definition Wrong

Michelangelo Frigo (Co-Founder at Zyphe) Published July 24, 2026 Updated August 8, 2026

Magnifying glass over a list with one flagged row representing politically exposed person screening

FATF treats PEPs as categories, not a binary, and most vendors flatten them. Here's the 2026 playbook for tiers, decay windows, RCAs and what regulators expect.

Table of contents

A politically exposed person is not a binary flag. FATF Recommendation 12 distinguishes foreign PEPs, domestic PEPs, international-organisation PEPs, and their relatives and close associates, with different obligations.
Foreign PEPs require enhanced due diligence in every case; domestic and international-organisation PEPs are handled on a risk basis, which many programs blur.
The industry's Tier 1, 2, 3 language is an operational convenience, not a formal FATF taxonomy, and conflating it with the legal categories causes mis-calibration.
Being a PEP does not expire automatically. FATF expects a risk-based assessment of residual influence, and the EU framework permits reduced measures only after a person ceases the function, for a minimum period commonly set at 12 months.
Relatives and close associates, RCAs, are in scope, and mapping them accurately is where most PEP screening programs are weakest.
Vendor lists vary widely in quality and often flatten the categories, so list-source documentation and a defined decay policy are central to a defensible program.

PEP screening is identifying whether a customer is a politically exposed person, someone entrusted with a prominent public function, or a relative or close associate of one, and applying enhanced due diligence. Under FATF Recommendation 12, foreign PEPs always require enhanced measures, while domestic PEPs are handled on a risk basis.

TL;DR

The most common mistake in PEP screening is treating politically exposed person as a yes-or-no attribute. It is not. FATF Recommendation 12 sets out categories, foreign PEPs, domestic PEPs, international-organisation PEPs, and relatives and close associates, with different obligations: foreign PEPs always get enhanced due diligence, while domestic and international-organisation PEPs are risk-based.

The industry's Tier 1, 2, 3 shorthand is a useful operational layer, but it is not the legal taxonomy, and conflating the two causes both over-screening and missed risk. On top of that, PEP status does not switch off the day someone leaves office, vendor lists vary wildly in quality and often flatten the categories, and relatives and close associates are routinely under-mapped. This guide covers the real definitions, the tiers, the decay window, domestic versus foreign treatment, the vendor problem, and the audit pack that makes a PEP screening program defensible.

11 min read. Last updated 23 September 2026.

What is PEP screening, and what makes someone a PEP?

PEP screening is the process of checking whether a customer, or someone connected to them, holds or held a prominent public function that creates a higher risk of bribery, corruption, or money laundering, and then applying due diligence proportionate to that risk. A politically exposed person is someone entrusted with such a function, and crucially the definition extends to their family members and close associates, because risk flows through relationships.

The key insight is that PEP status is about influence and access, not a criminal presumption. A PEP is not assumed to be corrupt; they are assessed as higher-risk because their position could be misused. That is why the obligation is enhanced due diligence and ongoing monitoring rather than refusal, and why accurate PEP screening has to identify not just the official but the people around them, the layer most programs handle least well. This sits alongside adverse media screening, which often surfaces PEP-related risk.

How do FATF, the EU and FinCEN define a PEP differently?

The three reference frameworks align in spirit but differ in detail. FATF Recommendation 12 distinguishes foreign PEPs, individuals entrusted with prominent public functions by a foreign country, from domestic PEPs and persons entrusted with prominent functions by international organisations. For foreign PEPs, FATF requires enhanced due diligence in all cases: senior-management approval, source-of-wealth and source-of-funds measures, and enhanced ongoing monitoring. For domestic and international-organisation PEPs, it requires a risk-based approach, applying the enhanced measures where the relationship is higher-risk.

The EU framework codifies a similar structure, defining the categories of prominent public function and expressly including family members and known close associates, and the United States takes a more risk-based, less prescriptive route: US regulations do not impose a single statutory PEP definition, but the FFIEC and FinCEN expect institutions to apply risk-based due diligence to senior foreign political figures and their associates. The practical takeaway is that foreign-PEP enhanced due diligence is close to universal, while domestic-PEP treatment is risk-based and varies, so a program must encode which rule applies to whom rather than treating all PEPs identically.

What are the PEP tiers, and why do vendors conflate them?

Most data vendors and many programs use a tiering shorthand: Tier 1 for the most senior figures, heads of state, ministers, central bank governors; Tier 2 for senior politicians, military, and judiciary; Tier 3 for family members and close associates, the RCAs. It is a useful operational way to prioritise diligence effort, and there is nothing wrong with using it.

The problem is treating that tiering as the legal taxonomy. FATF's actual categories are foreign, domestic, and international-organisation PEPs plus RCAs, and the obligation hinges on foreign-versus-domestic and the risk assessment, not on a Tier 1-2-3 number. When a vendor or a program flattens everything into tiers and loses the foreign-versus-domestic distinction, two failures follow: over-screening, applying mandatory enhanced due diligence to domestic PEPs where a risk-based approach was appropriate, and under-screening, missing that a foreign PEP always warrants enhanced measures regardless of seniority tier. Use tiers to prioritise effort, but drive the legal obligation off the FATF categories, not the tier label.

When does a former PEP stop being a PEP?

A persistent myth is that someone stops being a PEP the moment they leave office. They do not, automatically. FATF takes a risk-based view: when a person no longer holds the prominent function, the institution should assess whether they still pose higher risk, considering their residual influence and the seniority they held, rather than delisting them by reflex. Influence does not evaporate on the last day in office.

The EU framework operationalises this with a floor: an institution may apply reduced measures only after the person has ceased to be entrusted with the prominent function, and for a minimum period, commonly set at 12 months, while continuing to assess risk. Many firms adopt a 12-to-18-month cool-off as policy. The defensible position is to have an explicit, documented decay policy, with a minimum period and a residual-risk assessment, rather than either keeping people PEPs forever or dropping them the day they leave. A regulator will ask what your decay rule is and whether you applied it consistently.

How do domestic and foreign PEPs differ for enhanced due diligence?

This is the distinction programs most often get wrong, and it matters because it determines whether enhanced due diligence is mandatory or risk-based. Under FATF and the EU framework, a foreign PEP triggers enhanced due diligence in every case, regardless of assessed risk: you apply senior-management approval, establish source of wealth and funds, and conduct enhanced ongoing monitoring as a baseline. A domestic PEP, or an international-organisation PEP, triggers enhanced measures only where the business relationship is assessed as higher-risk.

So a domestic PEP in a low-risk relationship may be handled with standard due diligence plus monitoring, while the same profile abroad would be mandatory enhanced due diligence. Encoding this correctly avoids both compliance failure and unnecessary friction: you do not want to subject every domestic PEP to full enhanced due diligence by default if your risk assessment does not call for it, nor treat a foreign PEP as ordinary. The risk assessment and the foreign-versus-domestic flag together drive the obligation, which is why the AML compliance software and onboarding logic must capture both.

Why do PEP lists and vendors vary so much?

PEP screening depends on data, and the data is uneven. Major providers such as Refinitiv World-Check, LexisNexis, and Dow Jones Risk and Compliance maintain large PEP databases, and each is strong, but they differ in coverage, freshness, how they classify foreign versus domestic, how thoroughly they map relatives and close associates, and how they handle decay. A name that is a clearly tiered, well-sourced entry in one database may be a sparse or differently classified entry in another.

The practical consequences are real. Relying on a single source can leave coverage gaps, especially on RCAs and on PEPs from regions a given vendor covers less well. And because vendors often present results through their own tiering, a program that takes the vendor's label at face value inherits the vendor's conflation of the legal categories. The defensible approach is to document your list sources and their limitations, understand how each classifies and decays PEPs, and reconcile the legal obligation against the vendor data rather than treating the feed as the final word. A reasoning layer that reads the underlying entry, rather than trusting a tier flag, helps here, the same principle as L1 alert triage.

What audit pack proves your PEP program?

When a regulator reviews PEP screening, it wants to see judgement and consistency, not just hits. The audit pack includes documentation of your list sources and their known limitations, your method for classifying foreign versus domestic and international-organisation PEPs, your RCA mapping approach, your decay policy with its minimum period and residual-risk assessment, evidence of senior-management approval for foreign PEP relationships, source-of-wealth and source-of-funds records where required, and the ongoing-monitoring trail.

The programs that fail examinations are typically those that treated PEP status as a binary flag from a single vendor, applied no consistent decay rule, and could not show why a given customer was or was not subject to enhanced due diligence. The ones that pass can produce, per PEP customer, what category they fell in, why, what measures applied, and how the relationship was monitored over time. PEP screening, in the end, is judged on the defensibility of those decisions, which is the same evidence-led standard our adverse media and monitoring guidance describes.

The bottom line

PEP screening goes wrong when politically exposed person is treated as a binary flag from a single vendor feed. FATF Recommendation 12 sets categories, not a switch: foreign PEPs always get enhanced due diligence, domestic and international-organisation PEPs are risk-based, and relatives and close associates are in scope. The Tier 1-2-3 shorthand is fine for prioritising effort but is not the legal taxonomy, and conflating them causes both over-screening and missed risk.

Drive the obligation off the FATF categories, apply a documented decay policy rather than keeping or dropping PEPs by reflex, map RCAs deliberately, and reconcile vendor data against the law rather than trusting a tier flag. Keep the per-customer evidence, and your PEP screening will hold up where a binary, single-source program does not.

Audit your PEP coverage, or see how it works.

Cited sources

FATF Recommendations (Recommendation 12, politically exposed persons): https://www.fatf-gafi.org/en/topics/fatf-recommendations.html
European Banking Authority, AML and CFT (PEP guidance): https://www.eba.europa.eu/regulation-and-policy/anti-money-laundering-and-countering-financing-terrorism
FFIEC BSA/AML Examination Manual (senior foreign political figures): https://bsaaml.ffiec.gov/manual
US FinCEN: https://www.fincen.gov/
Wolfsberg Group guidance: https://www.wolfsberg-principles.com/

Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.

Frequently Asked Questions

A PEP is a person entrusted with a prominent public function. FATF Recommendation 12 distinguishes foreign PEPs, who always require enhanced due diligence, from domestic and international-organisation PEPs, handled on a risk basis, and extends the definition to family members and close associates. The status reflects higher corruption and money-laundering risk from the position, not a presumption of wrongdoing.

Possibly, and not automatically delisted. FATF takes a risk-based view: after someone leaves a prominent function, you assess whether they still pose higher risk given their residual influence and former seniority, rather than dropping them immediately. The EU framework permits reduced measures only after they cease the function and for a minimum period, commonly 12 months. A former head of state often retains influence well beyond that.

US regulations do not impose a single statutory PEP definition or a standalone PEP-screening mandate, but FinCEN and the FFIEC expect institutions to apply risk-based due diligence to senior foreign political figures and their associates as part of their AML program. In practice that means US institutions screen for and apply enhanced measures to higher-risk PEPs, even without a prescriptive PEP rule like the EU's.

RCA stands for relatives and close associates, the family members and known close associates of a politically exposed person. They are in scope because corruption risk flows through relationships, money and influence are often routed through family or associates rather than the official directly. Mapping RCAs accurately is one of the hardest and most under-served parts of PEP screening, and a frequent gap in vendor data.

There is no single global number. The EU framework allows reduced measures only after a person ceases the prominent function and for a minimum period, commonly set at 12 months, while continuing to assess risk, and many firms adopt 12-to-18 months as policy. FATF expects a risk-based residual-influence assessment rather than an automatic time limit. The key is a documented, consistently applied decay policy.

PEP tiers, typically Tier 1 for the most senior officials, Tier 2 for other senior figures, and Tier 3 for relatives and close associates, are an industry convention for prioritising diligence effort, not a formal FATF taxonomy. FATF's actual categories are foreign, domestic, and international-organisation PEPs plus RCAs. Use tiers to prioritise, but drive the legal obligation off the FATF categories, especially foreign versus domestic.

Because vendor databases differ in coverage, freshness, how they classify foreign versus domestic, how thoroughly they map relatives and close associates, and how they apply decay. The same person can appear as a rich entry in one database and a sparse or differently tiered entry in another. Relying on one source risks coverage gaps, so documenting sources and reconciling against the legal obligation matters.

Document your list sources and their limitations, your foreign-versus-domestic classification method, your RCA mapping, and a clear decay policy with a minimum period and residual-risk assessment. Keep evidence of senior-management approval and source-of-wealth checks for foreign PEPs, and an ongoing-monitoring trail. The standard is showing, per customer, what category applied, why, and what measures followed, consistently.

Related products

PEP screening

that flags the right people, sooner

Screen customers against global Politically Exposed Persons lists in real time, re-checked daily, with risk-based enhanced due diligence — and no central PII honeypot.

Learn more →

Anti-Money Laundering

Trusted AML protection, built for global regulations

AI-driven risk detection with decentralized security to screen threats in real time, leveraging global compliance frameworks that can slash 39% of compliance costs.