PEP

In short

A PEP is a politically exposed person: someone who holds or has held a prominent public function, and is therefore exposed to a higher risk of being involved in corruption or money laundering.

The category does not stop at the official. It also reaches their family members and close associates, because assets of illicit origin are rarely held in the official's own name.

And the consequence of being a PEP is one thing only: enhanced due diligence, not a ban on doing business. A PEP can be a customer. What changes is how much the organization has to know about them and how often it reviews them.

The category reaches the official, their family and their associates

This is the part almost all generic content misses, and the one that defines the real work of the compliance team.

• The official — whoever holds or has held a prominent public function. The criterion is the seniority of the function: the international standard reaches senior public functions and leaves out mid-level or minor positions, although each national rule sets its own scope and several broaden it.
• Family members — the direct link by kinship or marriage. The exact degree is defined by each national rule.
• Close associates — whoever shares ownership of a company, a business or an asset structure with the PEP, or whoever appears as the holder of assets for the PEP's benefit.

All three receive the same enhanced treatment, even though the international standard reserves the term for whoever holds the function. An organization that only flags the official and not their circle complies with the letter and fails at the purpose, because that circle is exactly where the standard expects the problem to show up.

And the condition is not checked only against whoever registers. The standard and local rules reach the customer and also the ultimate beneficial owner. When onboarding a company, a corporate account or a trust structure, the PEP can be behind the legal entity and not on the form. A control that only evaluates whoever fills out the sign-up falls short exactly where the risk is greatest.

The international standard also distinguishes three types by the origin of the function: foreign PEP, when the function is held in another country; domestic PEP, when it is held in the customer's own country; and international organization PEP, for senior officials of multilateral bodies. The distinction matters because several rules require automatic enhanced scrutiny for the first and risk-based scrutiny for the second.

Being a PEP is not an accusation

It is worth saying plainly, because it is the most common source of friction in the relationship with the customer: PEP status implies no suspicion of the person whatsoever.

It is a risk category, not a record. It does not imply investigation, it does not imply a report, and it does not authorize rejecting someone for the sole fact of being one. A minister, a judge, an executive at a state-owned company and the spouse of any of them have the right to open an account.

What the rule requires is proportionality: if the risk is higher, knowledge of the customer has to be deeper and follow-up more frequent. Nothing more, and nothing less.

This has a practical consequence for onboarding design. The PEP declaration is always asked of everyone, as one more field in sign-up, and a "yes" answer triggers additional steps instead of a rejection. A flow that treats the declaration as grounds for a drop turns a regulatory obligation into a loss of legitimate customers.

What changes in the process when the customer is a PEP

Enhanced due diligence is not "asking for more paperwork." It is a set of concrete measures, and all of them produce evidence that has to be kept.

• Senior management approval — the decision to onboard or maintain the relationship stops being operational and moves up to a role with defined responsibility.
• Source of funds and source of wealth — two different questions. Where does the money for this transaction come from, and where did this person's wealth come from. The second is the one the category makes unavoidable.
• Intensified monitoring — more frequent review of transactions and lower alert thresholds than the rest of the portfolio.
• Periodic profile updates — because PEP status changes over time, in both directions. Someone can take on a function after already having been onboarded.
• Recording all of the above — the evidence that enhanced diligence was applied is what gets shown to the supervisor. Applying it without leaving a trail is the same as not having applied it.

Detection is not a one-time sign-up event either. It is a control that runs again over the existing portfolio, because today's ordinary customer can be next month's PEP.

A PEP is not a listed person

The two concepts show up together on the same screen and carry opposite consequences.

A person reached by international sanctions appears on a list because an authority decided to restrict their activity. The typical consequence is a prohibition: they are not onboarded, and in many cases there is a duty to report it.

A PEP is flagged because their function exposes them. The consequence is more scrutiny, and the relationship continues.

Treating both matches under the same rule is a costly mistake in both directions: rejecting PEPs out of caution turns away customers the rule never intended to exclude, and processing a sanctions match as if it were a case of enhanced diligence lets through exactly what needed to be stopped. How each of these is organized is explained under watchlists.

There is one more difference, and it is the one that causes the most confusion: there is no universal PEP list issued by the international standard. The sources are several and coexist: the customer's own declaration, commercial databases, local public listings, state registries and the obliged entity's own internal processes. Using an external source is allowed, but a database on its own is not enough to consider the obligation fulfilled.