Table of contents
- A politically exposed person is someone entrusted with a prominent public function. The status is a risk classification, not an allegation, and the rules say so explicitly.
- The label does not make a customer unbankable. It makes the customer one that a firm has to approve at senior level, understand the money of, and monitor more closely.
- The three obligations are consistent across the EU rulebook: senior management approval, source of wealth and source of funds, and enhanced ongoing monitoring.
- Family members and known close associates carry the same treatment as the official they are connected to.
- The UK moved first on proportionality. Since 10 January 2024 a domestic PEP starts from a lower risk assessment than a foreign one, and the FCA replaced its 2017 guidance in July 2025.
- Nobody stops being politically exposed on a fixed date. Both the current EU directive and the regulation that replaces it in 2027 set a floor of at least 12 months after leaving office, and then a risk judgement with no end date attached.
- The operational problem is almost never the definition. It is match quality: common names, transliterations and stale list entries produce far more alerts than genuine PEP relationships.
A politically exposed person, or PEP, is an individual entrusted with a prominent public function, such as a head of state, government minister, senior judge, central bank official, senior military officer or executive of a state owned enterprise, together with their family members and known close associates, whose position carries a higher risk of bribery and corruption.
Which roles count as a PEP?
There is no single global list of qualifying job titles, and that is deliberate. The rules describe functions, and each country then publishes the functions that qualify inside its own system.
The functions that appear in nearly every framework are these:
| Category | Typical functions |
|---|---|
| Executive and legislative | Heads of state and government, ministers, deputy ministers, members of parliament |
| Judicial | Supreme court and constitutional court members, senior judges whose decisions are not generally subject to further appeal |
| Financial and audit | Central bank board members, members of courts of auditors |
| Military and security | Senior officers of the armed forces, senior figures in security and intelligence services |
| State owned enterprises | Members of the administrative, management or supervisory bodies of enterprises controlled by the state |
| Diplomatic and international | Ambassadors, chargés d'affaires, directors and board members of international organisations |
| Political parties | Members of the governing bodies of significant political parties |
Two boundaries matter more than the list itself. Middle ranking and junior officials are outside the definition in every framework that states one. And under the EU regulation that applies from 2027, each member state has to publish and maintain the list of functions that qualify in its jurisdiction, with the Commission compiling the equivalent list for Union institutions, so the answer becomes a published document rather than a vendor's judgement call.
Are family members and close associates PEPs?
They are not PEPs themselves, but they get the same treatment. In EU law the enhanced measures that apply to a politically exposed person apply equally to family members and to persons known to be close associates.
Family members generally cover spouses or partners, children and their spouses or partners, and parents. Close associates cover people known to hold beneficial ownership jointly with the PEP, and people with close business relationships to them.
This is where a screening programme quietly gets expensive. A single official in a market can pull in a dozen connected people, and the connections are recorded unevenly across data sources. Our page on domestic PEPs goes into how the related and close associate population is handled once the domestic distinction is in play.
Why are PEPs treated as higher risk?
Because of what the position gives access to, not because of anything the person has done. Prominent public functions come with control over public budgets, procurement decisions, licensing, and in some cases judicial outcomes. Those are the levers bribery and embezzlement operate through, and the proceeds have to be laundered somewhere.
The FATF is direct that the measures are preventive rather than criminal, and that requiring extra measures does not mean the customer is assumed to be involved in crime. Firms that lose sight of that end up debanking legitimate customers, which is exactly what pushed the UK to review the practice.
What must a firm do when a customer is a PEP?
Three obligations sit on top of normal customer due diligence, and they are worded almost identically in the current EU directive and in the regulation replacing it:
- Senior management approval before establishing or continuing the business relationship, or before carrying out an occasional transaction.
- Source of wealth and source of funds, established through adequate measures. This is the obligation firms most often fail, because collecting a declaration is not the same as establishing anything.
- Enhanced, ongoing monitoring of the relationship, which means the file does not go quiet after onboarding.
The regulation that applies from 2027 extends the same three measures to occasional transactions, not only to standing business relationships. If your controls only fire at onboarding, that is a gap worth closing early. The mechanics of running this at volume are covered in our guide to enhanced due diligence workflows.
How do PEP rules differ by jurisdiction?
The definition travels well. The treatment does not.
European Union, today. Directive (EU) 2015/849 requires risk management systems to determine whether a customer or beneficial owner is a PEP, then imposes the three measures above, and applies them to family members and close associates.
European Union, from 10 July 2027. Regulation (EU) 2024/1624 carries the same three measures into Article 42, adds published national lists of prominent public functions in Article 43, and sets the treatment of former PEPs in Article 45. It applies from 10 July 2027, with a later date of 10 July 2029 for two categories of obliged entity.
United Kingdom. The Money Laundering and Terrorist Financing (Amendment) Regulations 2023 inserted regulation 35(3A) into the 2017 regulations, in force from 10 January 2024. For a domestic PEP, or their family member or known close associate, the starting point of the assessment is that the customer presents a lower level of risk than a non domestic PEP, and where no enhanced risk factors are present, the extent of the enhanced measures applied is less than for a non domestic PEP. The FCA published finalised guidance FG25/3 in July 2025, replacing its 2017 guidance.
United States. There is no PEP designation in US regulation in the European sense. The 2020 interagency statement from FinCEN and the federal banking agencies confirmed that no unique regulatory due diligence requirement attaches to PEPs, and that firms should apply risk based measures proportionate to the customer's actual risk profile.
The practical consequence for anyone onboarding across borders: a domestic PEP in one market is a foreign PEP in every other market you serve, and the same person can sit at two different risk levels in two of your entities at once. Screening logic has to encode the jurisdiction of the relationship, not just the name.
How long does someone stay a PEP?
Not forever, and not for a fixed term either.
The current EU directive requires firms, for at least 12 months after a person is no longer entrusted with a prominent public function, to take into account the continuing risk and apply risk sensitive measures, until the person is deemed to pose no further PEP specific risk. The 2027 regulation keeps the same floor: measures apply until the risk no longer exists, and in any case for not less than 12 months.
So the widely repeated line that "once a PEP, always a PEP" is a policy choice some firms make, not a legal requirement. Twelve months is the minimum, the end is a documented risk judgement, and the judgement has to account for residual influence. A former minister who now chairs a state contractor has not stopped being interesting. Firms that run perpetual KYC handle this as a review trigger rather than a calendar event.
How does PEP screening work in practice?
PEP screening is name matching against curated data, followed by a decision. In sequence:
- Collect identifiers at onboarding. Full legal name, date of birth, nationality and country of residence. Matching on a name alone is what produces unusable alert volumes later.
- Screen against PEP data and sanctions data together. They answer different questions, but they run over the same identifiers and the same fuzzy matching, so most teams run them in one pass. See our sanctions screening guide for the list side.
- Resolve the match. Confirm or discount using secondary identifiers, then record which identifier settled it. This record is the part regulators actually read back.
- Classify. Domestic, foreign or international organisation PEP, plus family member or close associate, because the classification drives how much diligence follows.
- Apply the enhanced measures. Senior approval, source of wealth and funds, and the monitoring plan.
- Rescreen. Lists and public functions change. A customer who was clean at onboarding may hold office two years later.
Zyphe runs this as PEP screening alongside sanctions screening inside the wider AML stack, with the match decision and its rationale written to a per decision audit trail, and without the verified identity documents ever coming to rest on our side. A deeper operational walkthrough sits in our 2026 guide to screening politically exposed persons.
Why does PEP screening produce so many false positives?
Because the input is a name, and names are not unique. Four causes account for most of the noise:
- Common names. A retail book in a large market will contain many people sharing a name with a foreign official.
- Transliteration. Arabic, Cyrillic and Chinese names arrive in Latin script through several competing conventions, so one person can appear as five spellings.
- Population size. PEP datasets include family members and close associates, which multiplies the number of names in scope well beyond the officials themselves.
- Stale entries. People leave office continuously, and data providers update on their own cadence.
The fix is not a looser matching threshold, which trades false positives for missed matches. It is better identifiers at onboarding, jurisdiction aware classification, and a documented disposition on every alert. Firms that measure their alert to true match ratio and work on the inputs get further than firms that tune the fuzzy matcher.
The bottom line
A politically exposed person is a customer whose public position creates a higher risk of corruption proceeds, and the rules ask for three things in response: senior approval, an understanding of where the money came from, and monitoring that does not stop at onboarding. The definition is stable across jurisdictions. What varies is proportionality, and the UK's lower starting point for domestic PEPs is the clearest example of a regulator saying that treating every PEP identically is itself a failure.
If you want to see what PEP screening looks like when the match decision carries its rationale and the identity documents never come to rest with the vendor, book a demo and bring the alerts your current tool cannot close.
Related resources
- Domestic PEPs: definition, risk and due diligence
- PEP screening in 2026
- Enhanced due diligence workflows
- Enhanced due diligence vs standard CDD
- Sanctions screening guide
- What is anti money laundering?
Cited sources
- FATF, Guidance: Politically Exposed Persons (Recommendations 12 and 22): https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Peps-r12-r22.html
- Directive (EU) 2015/849, Articles 20 to 23: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32015L0849
- Regulation (EU) 2024/1624, Articles 42, 43, 45 and 90: https://eur-lex.europa.eu/eli/reg/2024/1624/oj
- The Money Laundering and Terrorist Financing (Amendment) Regulations 2023 (SI 2023/1371): https://www.legislation.gov.uk/uksi/2023/1371/made
- FCA, FG25/3 Treatment of politically exposed persons: https://www.fca.org.uk/publications/finalised-guidance/fg25-3-treatment-politically-exposed-persons
- FinCEN and the federal banking agencies, Joint Statement on Bank Secrecy Act Due Diligence Requirements for Customers Who May Be Considered Politically Exposed Persons (August 2020): https://www.fincen.gov/system/files/shared/PEP%20Interagency%20Statement_FINAL%20508.pdf
Written by Michelangelo Frigo (Co-Founder at Zyphe) Reviewed September 2, 2026 Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.