PEP (Politically Exposed Person)

What Is a Politically Exposed Person?

A politically exposed person (PEP) is an individual who is or has been entrusted with a prominent public function. The term was formalized by the Financial Action Task Force (FATF) in its 2003 Recommendations and revised in 2012 under Recommendations 12 and 22. FATF clarifies that the definition is not intended to cover middle-ranking or junior officials: it targets individuals whose positions create opportunities for corruption, bribery, or embezzlement of public funds.

PEP status is not an accusation of wrongdoing. It is a risk classification that triggers additional compliance obligations for any financial institution serving that individual. The logic is straightforward: people with access to public funds, influence over government contracts, and authority over regulatory processes present a higher risk of using the financial system to launder proceeds of corruption.

PEP screening applies broadly across the financial ecosystem. Banks, payment processors, insurance companies, and crypto exchanges all must identify PEPs during onboarding and apply enhanced scrutiny. The World Bank estimates that over $1 trillion is paid in bribes globally each year, and public officials in developing countries receive an estimated $20 to $40 billion in corrupt money annually, underscoring why this classification exists.

How PEP Classification Works

FATF and most regulatory frameworks divide PEPs into three categories, each with different risk levels and compliance requirements.

Foreign PEPs

Individuals entrusted with a prominent public function by a foreign country. Foreign PEPs are always regarded as higher risk under FATF Recommendation 12 and automatically require enhanced due diligence. Examples include foreign heads of state, cabinet ministers, ambassadors, senior military commanders, and supreme court justices.

Domestic PEPs

Individuals holding prominent public functions within the same country as the financial institution. Unlike foreign PEPs, domestic PEPs are subject to a risk-based approach: enhanced due diligence is required only when the business relationship is assessed as higher risk. The UK's Financial Conduct Authority clarified in July 2025 (FG25/3) that domestic PEPs should be treated as lower risk as a starting point.

International Organization PEPs

Senior officials of international organizations such as the UN, World Bank, IMF, NATO, and European Commission. This category covers directors, deputy directors, and board members or equivalent roles. Like domestic PEPs, they follow the risk-based approach rather than automatic EDD.

Who Qualifies as a PEP

FATF specifies several categories of "prominent public functions" that trigger PEP classification:

Family Members and Close Associates

PEP obligations extend beyond the individual to their family members and close associates (sometimes called RCAs). Family members include spouses, children (and their spouses), parents, and in some jurisdictions siblings. Close associates include individuals with joint beneficial ownership of legal entities, those in close business relationships with the PEP, and anyone who is the sole beneficial owner of arrangements known to benefit the PEP.

Enhanced Due Diligence Requirements

When a financial institution identifies a customer as a PEP, standard KYC/AML procedures are not sufficient. FATF Recommendation 12 requires four additional measures:

1. Risk management systems to determine whether a customer or beneficial owner is a PEP, typically through screening against commercial PEP databases
2. Senior management approval to establish or continue the business relationship: someone with enough authority to understand the institution's risk exposure must sign off
3. Reasonable measures to establish the source of wealth (where the customer's overall fortune came from) and source of funds (the specific funds used in the transaction)
4. Enhanced ongoing monitoring through more thorough and frequent assessments to ensure transactions remain consistent with the customer's established profile

These measures layer on top of standard customer due diligence. The institution must also conduct adverse media screening and maintain records for the period required by local regulation, typically five or more years.

De-PEPing: How Long Does PEP Status Last?

PEP classification does not end the moment someone leaves office. FATF requires a risk-based approach for at least 12 months after departure, treating this as a minimum floor rather than a ceiling. Different jurisdictions set different timelines: the EU mandates a minimum of 12 months, Spain extends to two years, and Canada classifies domestic PEPs for five years after leaving office while treating foreign PEPs as classified indefinitely. There is no globally accepted declassification process: the general principle is that any fixed time limit is somewhat arbitrary and should be applied alongside ongoing risk assessment.

PEP Screening in Crypto and Digital Assets

Crypto exchanges and virtual asset service providers (VASPs) face the same PEP screening obligations as traditional financial institutions. As the regulatory landscape has matured, compliance requirements have become increasingly specific.

Regulatory Frameworks

The EU's evolving regulatory frameworks place concrete obligations on crypto service providers:

• The FATF Travel Rule (Recommendation 16) requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers. As of 2025, 85 of 117 surveyed jurisdictions have Travel Rule legislation in place.
• The EU's Markets in Crypto-Assets Regulation (MiCA) requires crypto-asset service providers to implement full AML/CFT programs including customer due diligence, EDD for PEPs, suspicious transaction reporting, and minimum five-year record retention.
• The EU's Transfer of Funds Regulation (TFR), effective December 2024, created a unified Travel Rule framework across all member states.
• The new EU Anti-Money Laundering Regulation (AMLR), directly applicable from July 2027, expands PEP categories and harmonizes screening requirements across all 27 member states.

Practical Compliance for Exchanges

Compliant crypto KYC requires multiple layers of screening. During onboarding, exchanges must verify customer identity, screen against PEP databases and sanctions lists, assign a risk score, and for PEPs, apply EDD measures including source-of-funds documentation and manual review by a trained compliance analyst.

After onboarding, PEP accounts receive heightened transaction monitoring. High-risk and PEP customers typically require annual review, compared to every three years for standard-risk customers. Transactions that fall outside expected patterns trigger alerts for manual investigation.

A Typical PEP Screening Flow

Customer submits identity documents
    ↓
Automated screening against PEP databases
    ↓
Match found → Flag for enhanced review
    ↓
Compliance analyst verifies:
  - Category (foreign / domestic / international org)
  - Source of wealth documentation
  - Source of funds for specific transactions
    ↓
Senior management approval required
    ↓
Account opened with enhanced monitoring tier
    ↓
Ongoing: heightened transaction monitoring
         periodic re-screening (typically annual)
         adverse media monitoring

Why PEP Compliance Matters

PEP screening is not optional regulatory overhead: it is a core defense against systemic corruption in the financial system. Several high-profile cases illustrate the consequences of inadequate PEP controls.

The 1MDB scandal saw $4.5 billion extracted from Malaysia's state investment fund, with former Prime Minister Najib Razak convicted of diverting hundreds of millions through shell companies and offshore structures. In the late 1990s, Nigerian dictator Sani Abacha orchestrated the theft of several billion dollars from the Central Bank of Nigeria, with an investigation spanning approximately 60 Swiss banks. The 2016 Panama Papers leak exposed how PEPs and wealthy individuals used offshore entities through law firm Mossack Fonseca to conceal assets.

Enforcement is accelerating. In the first half of 2025, regulators issued 139 fines totaling $1.23 billion for AML, KYC, and sanctions violations: a 417% increase in value compared to the same period in 2024. Starling Bank received a GBP 29 million fine from the UK's FCA in October 2024 after opening over 54,000 accounts for high-risk customers while its automated sanctions screening system was misconfigured.

For crypto and digital asset companies, the message is clear: PEP compliance is a non-negotiable part of operating a regulated financial service, regardless of whether the underlying asset is fiat or crypto. Companies building on platforms like Spark should integrate PEP screening into their compliance workflows alongside KYC/AML and sanctions screening to ensure regulatory compliance across jurisdictions.

Risks and Considerations

Over-Screening and Financial Exclusion

Overly aggressive PEP policies can lead to de-risking, where institutions refuse service to entire categories of customers rather than applying nuanced, risk-based assessments. This disproportionately affects legitimate public servants and their families, particularly in developing countries. The UK FCA's 2025 guidance explicitly addresses this by directing firms to treat domestic PEPs as lower risk by default.

Data Quality and False Positives

PEP databases vary significantly in coverage, accuracy, and update frequency. Name-matching algorithms produce false positives due to common names, transliteration differences, and outdated records. Institutions must balance automated screening efficiency against the compliance risk of missing a true match. Modern RegTech solutions use AI-powered screening to reduce false positives while maintaining coverage.

Jurisdictional Inconsistency

PEP definitions and requirements vary across jurisdictions. The US does not formally define "PEP" in its Bank Secrecy Act regulations, instead using the term "Senior Foreign Political Figure." The EU's new AMLR expands categories to include local officials in municipalities with over 50,000 inhabitants. Institutions operating across borders must reconcile these differences and apply the most stringent applicable standard.

Evolving Regulatory Landscape

PEP regulations continue to expand. The EU's Anti-Money Laundering Authority (AMLA), operational since 2025 and headquartered in Frankfurt, will assume direct supervisory authority over the highest-risk financial institutions and issue binding technical standards on screening methodology. For stablecoin and crypto companies navigating global compliance, staying current with PEP requirements across multiple jurisdictions is an ongoing operational challenge.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.