This article is a free excerpt from inCOMPLIANCE, ICA's bi-monthly, member exclusive magazine. To gain access to more articles like this, sign in to the Learning Hub or become a member of ICA.
Jude Hilton looks at what it takes to move PEP screening from doing the bare minimum, to realistically reducing risk.
Politically exposed persons (PEPs) continue to attract regulatory attention, supervisory scrutiny and media interest. Yet, in many firms, PEP management still looks like a binary exercise driven by screening tools and rigid rules rather than a genuinely risk-based approach.
Bribery and corruption remain core predicate offences for money laundering, and the risk of both increases where an individual holds – or has held – a prominent public function, as do their close associates and family members. The real challenge for practitioners is not the definition but distinguishing when political exposure translates into actual financial crime risk – and when it does not.
What is a PEP in 2026?
The Financial Action Task Force (FATF) defines three broad categories of PEP: foreign PEPs, domestic PEPs, and individuals entrusted with a prominent function in an international organisation. The definition covers persons who are (or have been) entrusted with prominent public functions such as heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises and important political party officials.
FATF explicitly notes that the term is not intended to capture middle-ranking or junior officials. However, local law and guidance may extend or narrow this scope, including by using different labels or clarifying that most domestic PEPs should generally present lower risk than foreign ones. Compliance teams therefore need to anchor their PEP framework in FATF Recommendation 12 but calibrate it to local legislation and supervisory expectations in each jurisdiction.
Crucially, the FATF framework extends the obligations that apply to PEPs to their family members and close associates, recognising that corruption risk often manifests through connected parties and intermediaries rather than directly via the office-holder.
Corruption risk often manifests through connected parties and intermediaries rather than directly via the office-holder.
Identifying PEPs
Most institutions now use a mix of automated tools and manual checks to identify PEPs at onboarding and throughout the relationship lifecycle. Common techniques include screening customers and beneficial owners against external PEP databases, open-source searches, reviewing corporate documentation, and self-attestation through application and subscription documents.
Screening tools are essential, but they are only a starting point. A database hit is an information lead, not a definitive classification. It needs to be analysed and contextualised: is the individual the same person, do they still hold the office, and in what capacity are they engaging with the firm?
The absence of a database match is equally inconclusive, since lower-profile PEPs or associates might not appear, particularly in markets where media coverage is limited. Firms should therefore document both positive and negative screening results, and record the rationale for decisions to classify – or to discount – an individual as a PEP.
Public vs private roles
One of the most useful – but often overlooked – distinctions in managing PEP risk is the capacity in which the individual is acting. The risk profile of a minister sitting on the board of a state-owned enterprise in an official capacity can be very different from the same individual acting as the beneficial owner of a private company receiving state contracts.
Public employment capacity
When a PEP is appointed by a government or international organisation to perform an official function – for example serving as a director of a sovereign wealth fund, state-owned enterprise or public authority – the PEP is not the ultimate beneficial owner of the entity. In these cases, funds typically flow to, and are controlled by, the public body rather than the individual.
The residual risk is not eliminated, but it is different: the greater concern is that the PEP may abuse their position to favour specific counterparties, rather than directly laundering their own proceeds through the entity’s standard banking relationships. A risk-based approach therefore focuses on verifying the official nature of the appointment through reliable sources, assessing the country and sector risk of the public body, and ensuring appropriate governance and escalation where red flags arise.
Private capacity
The risk profile changes significantly where the PEP is a direct customer, beneficial owner, controller or authorised signatory of a private entity, or otherwise acts on behalf of a third party in their personal capacity. In such cases, there is a clearer pathway for the PEP, or their proxies, to derive personal benefit from bribery, theft or corruption and seek to integrate illicit proceeds into the financial system via corporate vehicles, trusts or complex ownership structures.
This is also where family members and close associates become most relevant. They may hold shares, board positions or signatory powers in private structures connected to the PEP, acting as conduits for the movement of funds. Understanding the ownership and control map is therefore critical, particularly where structures span multiple jurisdictions or present other higher-risk features.
Understanding the ownership and control map is therefore critical, particularly where structures span multiple jurisdictions or present other higher-risk features.
Applying enhanced due diligence where it counts
FATF Recommendation 12 requires financial institutions to apply specific enhanced due diligence measures to foreign PEPs, and to apply these measures to domestic and international organisation PEPs in higher-risk situations. At a minimum, firms should be able to demonstrate that they operate effective risk-management systems to identify PEPs and related parties, obtain senior management approval before establishing or continuing relevant relationships, take reasonable measures to establish source of wealth (SoW) and source of funds (SoF), and conduct enhanced, risk-sensitive ongoing monitoring.
In practice, that may mean using more than one screening source, escalating higher-risk PEP cases to a formal governance forum, conducting targeted background checks to support SoW and SoF assessments, and increasing the frequency and depth of periodic reviews. Equally, regulators increasingly expect firms to avoid blanket enhanced due diligence on all PEPs, especially domestic PEPs whose roles are objectively low risk. That aligns with the risk-based principle embedded in FATF standards: resources should be focused where the risk of misuse is genuinely higher, not consumed by low-risk, highly visible cases.
Once a PEP, always a PEP?
There is no single global rule on how long an individual should be treated as a PEP after leaving office. FATF guidance emphasises the need for a holistic, case-by-case assessment rather than a fixed formula, although some jurisdictions specify minimum cooling-off periods during which enhanced measures should continue to apply.
From a risk perspective, the key point is that corruption risk does not automatically disappear when an individual leaves public office. Many high-profile cases involve former office-holders who continue to enjoy and move illicit wealth long after their term has ended. At the same time, applying intensive enhanced due diligence indefinitely to every former mid-level official is neither proportionate nor sustainable.
A pragmatic approach is to differentiate between very high-profile former PEPs, where a longer-term heightened risk classification may be justified, and lower-profile former officials where firms may gradually step down the level of enhanced measures after a defined period, supported by a documented risk assessment and approval process.
Making PEP frameworks genuinely risk-based
For many institutions, the real PEP challenge is not the definition but the implementation. High-quality PEP frameworks distinguish sharply between public and private capacities, using screening tools intelligently while understanding their limitations, calibrating enhanced due diligence to the actual risk profile of the PEP, and taking a nuanced approach to former office-holders grounded in evidence and documented reasoning.
By shifting the focus from labels to real exposure, firms can better protect themselves from bribery and corruption risk while improving customer experience and demonstrating to regulators that their PEP controls are genuinely risk-based and outcomes-focused.
Many high-profile cases involve former office-holders who continue to enjoy and move illicit weath long after their term has ended.
About the author
Jude Hilton is the founder and principal consultant of Cohesion GRC, a governance, risk, and compliance advisory firm, built on the belief that clarity creates confidence. Jude is a fellow of the International Compliance Association, and a Chartered Fellow of the Chartered Institute for Securities & Investment. She brings over two decades of global experience across regulatory compliance, governance, and risk management in Banking, Alternative Assets and Financial Services.