As regulatory frameworks update and improve daily around the world, businesses are under a lot of pressure to create safeguards to prevent illicit transactions. Among these safeguards, one of the most important is identifying Politically Exposed Persons.
The situation for businesses, especially financial institutions, has become stricter than ever, with the consequences of not getting this right being potentially devastating these days. In 2019, the FCA fined Standard Chartered $126 million for failing to maintain adequate AML controls in its dealings with PEPs.
More recently, in 2024, USB was fined over $5 billion for money laundering practices, which included facilitating elicit activities by politically influential individuals and other high-net-worth clients. In reality, these expectations are put in place for a good reason. People need more protection today than ever, with a continuously rising percentage of financial crime on a global level.
In this post, we’ll share all you need to know about evaluating potential risks, regulatory changes and challenges, as well as what you as a business can do to stay compliant.
What is PEP screening?
A PEP is a politically exposed person, as defined by the Financial Action Task Force (FATF). This is an individual who holds, or has held, a prominent public position in the past. We are talking about domestic or foreign officials, senior executives of major organizations, or public figures in general.
In addition to identifying these individuals, this assessment can also cover screening the relatives and close associates of the politically exposed person, essentially finding anyone who might have access to influence, assets, and resources.
Why is PEP screening important?
PEPs are in a great position to exploit their power and influence for money laundering, corruption, and bribery. While doing business with a high-ranking figure is not legally prohibited, institutions must take measures to monitor them to ensure they aren’t engaged in illicit activities.
These days, identifying individuals who might be a threat, and implementing compliance controls is a must-do when it comes to compliance. Banks often flag PEPs as higher risks compared to ordinary people, within their customer risk rating process.
The FATF has categorized individuals in positions of political influence into three major groups:
- Foreign – i.e. individuals who have served/ are serving significant roles in a foreign nation
- Domestic – i.e. individuals with public functions in the home country
- International organization PEPs – i.e. individuals who have held/ are holding high-ranking positions in an international organization
Ways to perform PEP screening
Regulators have the job of ensuring that your institution performs its enhanced due diligence (EDD) and customer due diligence (CDD) checks. However, there aren’t any strict rules on how you must do these risk assessments.
That being said, here are the two options that most organizations choose from, depending on their size and risk appetite.
Manual
This is the most time-consuming, resource-intensive, and often the least efficient way to run a check. It means that you’d be collecting data and manually going through it. You can access the information on PEPs available on public registers, commercial databases, and official government websites, and even monitor news reports from trusted sources.
As we said, this method requires manpower, and time, and can often come with gaps or delayed discovery of PEPs.
Automated
Automated or partially automated screenings are the easier – and often more efficient option. You can manually check for names by using specialist software to speed up your searches. This can be successful and faster than doing everything manually, but it can still be challenging since you’d have to enter and confirm the information.
The best option by far is the one that top businesses use – fully automated PEP checks. This involves integrating PEP screening tools or sophisticated AML software, either via API or on-premise. The software will automatically aggregate data from trusted lists, run it through algorithms in real time, and help you verify the identities of a large pool of new customers almost instantly.
Screening time and consent management
Regulatory bodies like FATF now mandate PEP screening to prevent financial crime. The process generally begins at onboarding. Institutions must do thorough checks to identify the higher-risk individuals, preferably before they start a business relationship with them.
The screening doesn’t end there. Ongoing monitoring is also important since institutions must regularly reassess their existing customers. Changes in PEP status can happen since, after all, people can get a public or high position at any point in their lives.
As financial institutions face more pressure in terms of scanning for people with political prominence, they must also navigate the complex list of compliance obligations. These obligations include strict rules for identifying high-risk individuals in terms of money laundering – and monitoring them once you detect them.
The integration of screening tools is essential to make sure this all runs smoothly, but it also brings another need into the picture – the need for more robust data privacy measures.
When we talk about data privacy and finances, one very important factor comes into the picture – consent management. Effective consent management ensures that your organization can process sensitive customer information in a way that complies with data protection laws like GDPR – all while maintaining a high level of transparency with the customers.
Why is this important, you wonder?
This helps you mitigate the financial risks and the risks to your reputation, of course. It also enables your company to comply with the many legal obligations that come with identifying and monitoring PEPs and RCAs.
The expanding scope of checks across industries
At one point, PEP checks were mandated only for banks and financial institutions. The situation is different today. The scope of the regulations now spans many industries, depending on the jurisdiction a business operates in. Right now, the industries that may need to assess their client base include iGaming, fintech, payment processors, e-commerce companies, and financial services.
It is important to note that AML regulations are very different across jurisdictions. That’s why businesses must consult their local regulatory bodies to learn whether – and which assessments, if applicable, are required in their region.
The consequences of failing to perform a check, if one is required for your business, can be severe. These can include (but are not limited to):
- Major fines – millions to even billions for inadequate screenings
- Damage to your business’s reputation (often irreversible)
- Decline in stock value
The many challenges in PEP screening
Screening for high-risk profiles is a challenge for many businesses. This is caused by regulations in their region, the number of customers, and of course, the dynamic nature of the PEP lists.
Challenge 1: False positives
False positives are a common occurrence in PEP screening and happen even if you spend hours doing this manually – and even when you use tools. A false positive is when a customer is mistakenly flagged.
As a result, their transactions slow down, their customer onboarding is less streamlined, and this can trigger an exhaustive inquiry into the person. When there’s a high rate of false positives, this can increase the operational costs too, since you’d have to do unnecessary investigations.
Challenge 2: Inconsistent definitions
The definition of PEPs varies across jurisdictions, too. Some countries include high-ranking and mid-ranking officials in the list, such as their local mayors, for instance. This is even further complicated by the many different databases that store the data – and the different formats they use.
According to the Bank Secrecy Act and Patriot Act in the US, institutions are required to screen only for foreign but not for domestic PEPs. This is not the same in other jurisdictions.
Challenge 3: Outdated data
PEP lists are changing all the time. They change based on election cycles, political changes, family changes of existing key political figures, and more. Many of the commercial and government databases don’t maintain and update their records. This can pose a true challenge for organizations, which often use inaccurate or incomplete data for their screening.
Challenge 4: Determining RCA relationships
This is one of the biggest challenges, perhaps, since relatives and close associates linked to political figures are often used as a conduit for illicit activities. But, how do you determine all these connections? Finding the connection between PEPs and RCAs is an important task, but a very complex one.
How to improve your process
Last but not least, there are four main steps you can take to improve your screening efficiency:
- Strengthen your KYC process and implement rescreening procedures
- Leverage additional information (such as dates of birth) to reduce false positives
- Implement a risk-scoring system that considers factors like political influence, geographic location, and financial exposure
- Use jurisdictional filters
Are your PEP screening processes truly effective?
With evolving regulations and increased scrutiny, businesses must change their approach to PEP screening if they want to stay compliant. If you aren’t doing what it takes, you need to make some changes now.
Use advanced screening tools, risk-based assessment, and ongoing monitoring. This will help you minimize the risks, reduce the false positives – and avoid those incredibly high penalties!
