🇪🇺Politically Exposed Persons (PEPs): Rules, EDD and Onboarding

A politically exposed person (PEP) is someone entrusted by a state or an international organisation with a prominent public function: a minister, a member of parliament, a supreme court judge, a general, a central bank board member, the head of a state-owned company. Family members and known close associates come within scope with them.

PEP status says nothing about a person's honesty. It records a heightened opportunity to abuse power, and for that reason it triggers a mandatory set of enhanced measures at a financial institution: senior management approval of the relationship, establishing source of wealth and source of funds, and enhanced ongoing monitoring.

For the client, PEP status means longer onboarding, more documents and recurring questions throughout the relationship. For the licensed firm it is a distinct line of accountability on which supervisors test the whole risk-based approach: whether the firm identifies PEPs correctly, whether its measures are proportionate, whether it can declassify. Errors run in both directions, and supervisors examine both.

Concept

The PEP regime grew out of a simple observation: grand corruption almost inevitably passes through the financial system. An official who allocates public contracts, licences or budgets earns income that is hard to distinguish from legitimate money and moves it through accounts held by relatives, companies of acquaintances and trusts abroad. Criminal law reaches such money late. The PEP regime puts the filter earlier, at account opening: the institution knows in advance whom it is dealing with and can see whether the flow of funds matches the lawful income of a public office.

FATF expressly describes these requirements as preventive: they are not to be read as stigmatising PEPs and do not imply involvement in crime. The same 2013 Guidance on Politically Exposed Persons states that refusing a relationship simply because the client is a PEP is contrary to the letter and spirit of Recommendation 12. Hence the regime's central feature: PEP status sets how a client is handled and does not in itself decide admission.

The design rests on three distinctions. The first is where the function comes from: a foreign PEP (function in another country), a domestic PEP (function in the institution's own country) and a PEP of an international organisation. For foreign PEPs FATF requires enhanced measures in every case; for the other two categories, on a risk basis. The second is the circle of persons: the PEP, family members and close associates who hold no office but have access to money and influence. The third is time: a serving PEP and a former one, whose heightened risk fades gradually.

The regime operates through two FATF Recommendations. Recommendation 12 addresses financial institutions; Recommendation 22 extends the same requirements to designated non-financial businesses and professions (DNFBPs): lawyers, notaries, accountants, trust and company service providers, estate agents and dealers in precious metals. That is why a client hears the PEP question at a bank, from a corporate secretary and from a notary on a property deal.

The key parameters of the regime as at September 2026 are set out below; each row is developed later in the article.

The table shows where regimes diverge: in the treatment of domestic PEPs and in the period after leaving office. This is where a client with the same biography meets a different reception in London, Hong Kong, Singapore and Dubai.

Who counts as a PEP

Functions

Every jurisdiction describes PEPs through the same list of functions inherited from FATF, and every one excludes middle-ranking and junior officials. The differences lie in the detail: which court counts as a highest court, which military rank makes an officer a PEP, how large a state-owned company must be. The most detailed list is the European one in Article 2(1)(34) of Regulation (EU) 2024/1624 (AMLR).

The UK qualifications come from FCA FG25/3, which also states that non-executive board members of UK civil service departments are not PEPs. Heads of cities and regions enter the EU-wide definition only with the AMLR; the current Directive 2015/849 has no such category.

So that institutions do not have to guess which posts are "prominent" in each country, the EU keeps an official list. Member States draw up national lists of exact functions, and the Commission compiles them, together with functions in EU institutions and international organisations, into a single document; the current version was published as notice C/2023/724 of 10 November 2023. Article 43 AMLR keeps this mechanism and requires AMLA to publish the consolidated list on its website.

Family members and close associates

Relatives come within scope because corrupt money rarely sits in the official's own name. The family circle differs between regimes, and for the client this matters more than it seems: a minister's brother may be a PEP-linked person in one country and an ordinary client in another.

The US definition is the widest on relatives: it also reaches the spouse's parents and siblings. The AMLR brings siblings into EU-wide legislation for the first time, but only for the top tier of the executive, while the FCA in FG25/3 treats siblings as family members of a PEP regardless of the office held. FATF's 2013 guidance acknowledges that the size of the relevant family depends on culture and in some societies extends well beyond the nuclear family.

A close associate is defined in almost the same way everywhere: a person who shares beneficial ownership of a legal entity or legal arrangement with a PEP or has other close business relations with them, and a person who is the sole beneficial owner of a structure set up for the PEP's benefit. FATF adds business partners and known partners outside marriage. For a bank this means a PEP link can surface through a client's ownership structure even when the client has never held office; beneficial ownership disclosure is covered in the article on UBO registers.

How enhanced due diligence works

Recommendation 12 requires four things of an institution dealing with a foreign PEP: a system to determine whether a customer or beneficial owner is a PEP; senior management approval to establish or continue the relationship; reasonable measures to establish source of wealth and source of funds; and enhanced ongoing monitoring. The life cycle of a PEP client at a bank runs through six stages, in an order set by the logic of the rule itself.

1. Identification. The client completes a self-declaration while the institution screens the client, beneficial owners and representatives against PEP databases and adverse media.
2. Classification. A match is confirmed or discounted; a confirmed PEP is assigned a category: foreign, domestic, IO, family member, associate, former.
3. Risk assessment. The firm weighs the function, country, product, amounts and other factors and sets the depth of EDD.
4. Approval. The decision to open or continue the relationship is taken at senior management level.
5. SoW and SoF. The institution establishes where the client's wealth as a whole came from and where the money in a given transaction came from.
6. Monitoring, review and declassification. Transactions are checked against the profile, the file is reviewed at a risk-based frequency, and status is reconsidered after the person leaves office.

Senior management approval

Under the UK rules, senior management means an officer or employee with sufficient knowledge of the firm's money laundering and terrorist financing risk exposure and sufficient authority to take decisions affecting it. The approval level scales: FG25/3 expressly allows sign-off at a lower level of seniority for lower-risk PEPs, provided the firm documents who those staff are and trains them.

The MLRO need not sign every decision, but the FCA expects the MLRO to be aware of all PEPs onboarded or rejected. In private banks approval often goes through a high-risk client committee, which is a noticeable source of delay for the client: the decision waits for the next meeting.

Source of wealth and source of funds

Source of wealth (SoW) explains how the client's entire wealth came about: a civil service salary, a business before appointment, an inheritance, the sale of a company. Source of funds (SoF) concerns the specific money arriving in the account. For a PEP the core test is one of consistency: does the declared wealth match lawful income in office and before it? If a former deputy minister on an official salary brings capital that could not have been earned over the years of service, the question becomes where the money came from before or alongside that service.

The depth of the check scales with risk. In the UK model, for a lower-risk PEP FG25/3 allows less intrusive steps: using information the firm already holds and asking the client nothing further unless anomalies arise. For a foreign PEP from a high-corruption country, full documentary reconstruction is standard practice. How such a file is assembled, which documents work for each source and where the check usually stalls is covered in detail in the article on source of funds and source of wealth.

Monitoring and periodic review

Enhanced monitoring means lower alert thresholds, manual review of unusual transactions and reconciliation with the stated purpose of the account. Neither FATF nor the MLRs fix a review frequency; the Wolfsberg Group's guidance on PEPs recommends setting it by risk profile and screening for PEP status at onboarding, at periodic reviews and on trigger events, such as a change of office or a report of an investigation.

FATF's 2013 guidance lists indicators that monitoring looks for: use of corporate vehicles to obscure the beneficial owner, visible discomfort when asked about SoW and SoF, transfers to countries with which the PEP has no apparent ties, and repeated suspicious transaction reports on the same person. An indicator proves nothing by itself, but it requires an explanation.

Declassification

This is where regimes diverge most. FATF considers that handling a person who no longer holds office should rest on an assessment of risk; its 2013 guidance proposes no prescribed time limits. The relevant factors are residual informal influence and any link between the former function and current activity. The EU and UK models add a floor: measures continue for at least 12 months after leaving office, and thereafter until the firm is satisfied that no PEP-specific risk remains (Article 22 of Directive 2015/849, Article 45 AMLR, reg. 35(9) MLR).

The Wolfsberg Group states that the "once a PEP, always a PEP" approach is not consistent with a risk-based approach, and proposes declassification by reference to the length of time in office, the level of inherent corruption risk in the country of political exposure and the transparency of the source of wealth and origin of funds. Hong Kong also abandoned indefinite EDD for former PEPs in June 2023. The minimum period guarantees nothing: a bank may keep a former foreign PEP under enhanced measures for as long as the risk persists. If the person has moved from a ministry to the board of a state-owned company, the link between the former and current function is a direct argument against declassification.

Relatives are treated separately. Under the UK rules the 12-month period does not extend to family members and associates: FG25/3 states that from the point the PEP leaves office, family members are treated as ordinary customers.

Data: databases, adverse media and false positives

Neither FATF nor the UK rules require commercial PEP databases. FATF states plainly that such databases are not required by the Recommendations, are not necessarily comprehensive and do not replace CDD; the FCA leaves them to the firm's choice but requires it to understand how a database is populated and to check that a flagged person actually falls within the definition. In practice large institutions use them, because tracking public functions by hand across every country in the client base is impossible.

This produces the regime's main operational problem: false positives. Commercial databases capture positions more widely than the legal definition — municipal councillors, middle-ranking officials, relatives beyond the second degree. Name matching is fuzzy, and a transliteration match raises an alert on a namesake. The Wolfsberg Group lists the minimum data without which screening is useless: all known names and spellings, date or year of birth, country of political exposure, and positions held with dates of appointment and departure.

Supervisors see the problem. In its 2024 multi-firm review the FCA found firms applying PEP and associate definitions more widely than the law requires, lacking effective arrangements to reassess classification after a PEP leaves office, and failing to reflect the 2024 change on domestic PEPs in their policies. In a circular of 21 November 2025 the HKMA observed that broad interpretation had produced an unmanageably large number of PEPs and that some institutions were requesting source-of-wealth information disproportionate to the risk of the function concerned.

Adverse media works as a second line. PEP status combined with reports of an investigation, sanctions or corruption allegations almost always moves a client into the highest risk band; the neighbouring discipline is covered in the article on sanctions screening. FATF advises against relying solely on the client's self-declaration: it is also completed by those with something to hide.

Law by jurisdiction

The basic design is shared; the differences sit at three points: EDD for domestic PEPs, the period after leaving office, and the circle of relatives. The first two are compared below.

On domestic PEPs the EU demands the most and the US the least; yet the US private banking rule covers the widest circle of relatives.

European Union

The current regime is set by Articles 20–23 of Directive 2015/849 (AMLD4 as amended by AMLD5), transposed into national law. The Directive does not distinguish foreign from domestic PEPs: senior management approval, establishing SoW and SoF and enhanced monitoring apply to all. Article 22 requires the continuing risk to be taken into account for at least 12 months after the person leaves office.

From 10 July 2027 the AMLR replaces the Directive on this point (Article 90). The measures in Article 42 stay the same and expressly extend to occasional transactions.

What changes is scope: heads of regions and cities of 50,000+ inhabitants, including groupings of municipalities and metropolitan regions, party leadership at regional and local level at the same threshold, the management bodies of medium-sized and large enterprises controlled by regional and local authorities, and siblings of the most senior office-holders. Member States may lower the population thresholds, and may widen the family circle where their social and cultural structure warrants it, on notice to the Commission. Article 46 extends the same measures to family members and close associates. The wider reform is covered in the article on the EU AML package.

United Kingdom

The rule is regulation 35 of the Money Laundering Regulations 2017: a detection system, senior management approval, SoW and SoF, enhanced monitoring, and 12 months after leaving office. From 10 January 2024, SI 2023/1371 inserted paragraph 3A: where the customer is a domestic PEP (a function entrusted by the UK), or a family member or known close associate of one, the starting point is that they present a lower level of risk than a non-domestic PEP, and absent other enhanced risk factors the extent of EDD is lower.

On 7 July 2025 the FCA issued FG25/3, updating its 2017 guidance FG17/6 to reflect the amended MLRs. For UK PEPs without additional risk factors it allows less intrusive SoW and SoF steps and sign-off at a lower level.

Factors that raise risk include a country with high corruption and weak institutions, credible allegations of misconduct, and responsibility for large public procurement or for issuing licences. The FCA expects that a firm will not decline or close a relationship merely because a person meets the definition of a PEP; refusal is appropriate where, after its assessment, the firm concludes that it cannot effectively mitigate the risk.

Hong Kong

From 1 June 2023, the 2022 amendments to Schedule 2 of the AMLO (Cap. 615) replaced "foreign PEP" (a function outside the PRC) with "non-Hong Kong PEP" (a function outside Hong Kong). The consequence for clients from mainland China and Macau is fundamental: their politically exposed persons became PEPs subject to mandatory EDD at Hong Kong institutions. For Hong Kong PEPs and international organisation PEPs, enhanced measures apply only to high-risk relationships.

The same reform ended indefinite EDD. The definition still reads "is or has been entrusted", so a former official formally remains a PEP. But where the person no longer holds office, the institution may cease EDD following a risk assessment and treat them as a standard customer thereafter; the factors are residual influence, the seniority of the former position and its link with any current function. The rule applies to former non-Hong Kong and former Hong Kong PEPs alike. Schedule 2 of the AMLO binds all financial institutions, including SFC-licensed corporations; for banks, the detail is in the HKMA AML/CFT Guideline. In November 2025 the HKMA added practical guidance on proportionate treatment of PEPs, including the point that the risk posed by former Hong Kong PEPs and their family members and associates is inherently lower.

Singapore

For banks the requirements sit in MAS Notice 626 (notice of 28 March 2024, last revised on 30 June 2025); parallel MAS notices address other types of licensee. For a foreign PEP, their family and associates, EDD is mandatory: senior management approval, establishing SoW and SoF, enhanced monitoring. Under paragraph 8.4 a bank may decide on a risk basis whether and how far to apply these measures to domestic and international-organisation PEPs, to PEPs who have stepped down (taking into account the influence they may continue to exercise), and to their family members and close associates, except where the relationship presents a higher risk. The family circle in paragraph 8.1 is wide: parents, step-parents, children, step-children, adopted children, spouse, siblings, step-siblings and adopted siblings. In its 2016 evaluation of Singapore FATF rated the Singapore regime fully compliant with Recommendation 12 (Compliant).

United Arab Emirates

Federal Decree-Law No. 10 of 2025 has applied since 14 October 2025, replacing Federal Decree-Law No. 20 of 2018, and its executive regulations, Cabinet Resolution No. 134 of 2025, since 14 December 2025.

Article 1 of the resolution defines a PEP as a natural person who is or has previously been entrusted with prominent public functions in the UAE or any other country. Article 16 requires, for foreign PEPs, a detection system, senior management approval before establishing or continuing the relationship, reasonable measures to establish SoF and SoW, and enhanced ongoing monitoring; for domestic PEPs and officials of international organisations the same measures apply to high-risk relationships.

United States

US law has no general PEP regime. The joint statement of the Federal Reserve, FDIC, FinCEN, NCUA and OCC of 21 August 2020 confirmed three points. The CDD rule contains no requirement for unique additional due diligence steps for PEPs, and supervisors have no such expectation. Not all PEPs are high risk. The term itself refers to foreign individuals; US public officials fall outside it.

A binding rule exists in one narrow segment, private banking. 31 CFR 1010.605 defines a private banking account as one requiring a minimum aggregate deposit of $1 million, established for one or more non-US persons and assigned to an officer, employee or agent of the institution.

A "senior foreign political figure" (SFPF) covers current and former senior officials of a foreign government, senior officials of major foreign political parties, senior executives of foreign government-owned commercial enterprises, companies formed for their benefit, immediate family and known close associates. Under 31 CFR 1010.620 the bank ascertains all nominal and beneficial owners of such an account, whether any of them is an SFPF, the source of funds and the purpose of the account, and where an SFPF is involved it applies enhanced scrutiny reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption.

The licensed firm: what supervisors test

For a licensed firm the PEP regime serves as an end-to-end test of the whole AML system; where PEP processes sit in the overall architecture is described in the article on the compliance stack. Supervisors test four things: that the PEP definition in the policy matches the law and is not inflated; that screening covers clients, beneficial owners and representatives at onboarding, review and trigger events; that the file contains a risk rationale, SoW and SoF and the signature of an authorised person; and that a procedure exists for reviewing status.

The classic failure is the FSA Final Notice to Coutts of 23 March 2012. The penalty was £8.75 million (£12.5 million before settlement discount) for the period December 2007 to November 2010. A 2011 look-back found 233 additional PEPs under the bank's own definition, 93 of them under the regulatory definition; in 49% of the files reviewed the bank had failed to establish, or to evidence that it had established, source of wealth. Periodic reviews of PEPs and other high-risk clients did not bring information up to date.

The current supervisory complaint is the mirror image: over-classification and disproportionate EDD. The 2024 UK review and FG25/3 grew out of section 78 of the Financial Services and Markets Act 2023, which required the FCA to review its PEP guidance, including the extent to which firms follow it, and to publish its conclusions within twelve months. For the firm this adds another duty: documenting why full EDD was applied to a UK PEP, where it was.

For a licensed firm that is itself a client of a correspondent bank, its PEP processes are also examined by counterparties: questions on PEP policy, screening and approval form part of the standard due diligence questionnaires described in the article on Wolfsberg questionnaires.

PEP status at onboarding

Who finds themselves a PEP unexpectedly

Three groups of clients are most often caught out by PEP status. The first is executives and board members of state-owned companies: they see themselves as managers, whereas for the bank they hold a listed prominent public function. The second is family members: a minister's son, a supreme court judge's daughter, a general's wife. The third is former officials long since gone into business: for a European or UK bank the minimum period is one year, but the bank itself decides when to declassify, and for a foreign PEP that decision often takes longer.

An applicant from a sanctioned or high-risk jurisdiction meets a compounded version of the regime. Past civil service, a post at a state corporation or state bank, or a parliamentary mandate, including a regional one, are common in such biographies, and under the AMLR from 2027 heads of regions and cities of 50,000+ inhabitants and the management of enterprises they control come within scope as well.

Where the country of residence appears on the EU list of high-risk third countries, a European bank applies EDD on that ground regardless of PEP status, and for a PEP from that country the two grounds add up. Sanctions screening is a separate check: a former official or state-company executive may appear on restrictive measures lists, and then the question goes beyond EDD.

Why status is not a ban

FATF, the FCA and the HKMA say the same thing: PEP status determines the procedure and is no ground for refusal in itself. A bank refuses when, after assessing risk, it concludes it cannot mitigate it: wealth that lawful income does not explain, opaque ownership, adverse media, a high-corruption country of function. A domestic PEP from a country with strong institutions and a clean record should pass through a UK bank with minimal additional questions; if the bank demands a full EDD package citing status alone, it is reasonable to ask in writing which additional risk factor it sees.

Which documents help with EDD

A good PEP file answers one question: how did the wealth of a person who held public office come about? Documents group by source.

For PEPs, documents that are public by nature are especially valuable: the bank can verify officials' declarations and registry extracts itself. A chronology of positions with dates and a short letter explaining how office and wealth relate are worth preparing in advance. If a PEP's relative is the beneficial owner of a client company, the bank will ask separately about that relative's own source of wealth, and the answer "a gift from my minister father" will require documents on the minister's own income. The general procedure for a private client is described in the article on AML/KYC for private clients.

Why a bank may refuse without explanation

A bank is not obliged to explain why it declines to open an account or ends a relationship: that is a commercial decision within the contract and its risk policy. If the decision rests on a report to the financial intelligence unit, the bank is prohibited from disclosing it: FATF Recommendation 21 prohibits tipping off. A general formula such as "outside our risk appetite" is therefore often all the client receives. Notice periods and the exit process are covered in the article on bank account closure.

Risks that break relationships

The most common client mistake is to assume that a former PEP stopped being a PEP on the day of leaving office. For a European or UK bank the minimum is 12 months, after which the bank decides, and for a foreign PEP from a high-corruption country that can take years. A move from a ministry to a state company, or to a business working on public contracts, extends the risk: FATF names the link between the former function and current activity as a direct reason to keep measures in place.

The second trap is a PEP relative as beneficial owner. A family moves an asset into the name of a spouse, an adult child or a business partner to keep the PEP off the form. For a bank this is a classic indicator: FATF expressly lists use of corporate vehicles and relatives to obscure the beneficial owner as a red flag, and the definition of a close associate is built precisely on joint or sole ownership for a PEP's benefit.

The third trap is inconsistent data: different dates of office in the form, the CV and public sources, an incomplete list of directorships, silence about a past local mandate. The bank reads every discrepancy as an attempt to hide information, even though it is more often carelessness.