Moon ScanWhat is PEP screening?
What politically exposed persons are, why they need enhanced due diligence rather than automatic rejection, and practical EDD steps for CDD teams.
What a PEP is
A politically exposed person (PEP) is someone who holds — or has held — a prominent public function: senior politicians, heads of state or government, senior judicial or military officials, and executives of state-owned enterprises, among others. Definitions differ slightly across regulators, but the core idea is the same: public power can create higher bribery and corruption risk.
Screening also looks for relatives and close associates (often abbreviated RCA). A spouse, child, or business partner of a PEP may not hold office themselves, yet can be used as a conduit for illicit funds. Many open and commercial datasets therefore tag both PEPs and RCAs.
Why PEPs need EDD, not automatic rejection
Being a PEP is not a crime and is not, by itself, a reason to refuse a customer. International standards and most national AML regimes expect firms to apply enhanced due diligence (EDD): understand the source of wealth and funds, obtain senior approval where required, and monitor the relationship more closely.
Automatic rejection of every PEP would be both commercially blunt and often wrong. The point of screening is to identify elevated risk so you can manage it — not to treat every public official as prohibited. Contrast this with sanctions hits, which frequently do require you to stop dealing until you can clear the match.
How PEP lists are compiled
Unlike a single official “world PEP list”, PEP data is assembled from public sources: government directories, election results, corporate filings for state enterprises, news, and curated open datasets. Coverage and freshness vary. Some roles age out of PEP status after a cooling-off period; others remain relevant for years.
OpenSanctions and similar projects classify roles such as PEP, RCA, oligarch, or person of interest so screening tools can separate “needs EDD” from “prohibitive sanctions”. Always check what a match’s topics mean before you escalate.
Hong Kong context
Hong Kong CDD expectations for financial institutions and many DNFBPs (including TCSPs under AMLO) include identifying and managing higher-risk customers. PEPs — domestic and foreign — are a classic higher-risk category. Firms should have written procedures for when EDD is triggered and who can approve the relationship.
Local practice often combines automated name screening with questionnaires, beneficial-ownership checks, and ongoing monitoring. A PEP match on a screening tool is the start of that process, not the end of it.
Practical EDD steps
Confirm the match is strong and that identifiers (role, country, dates) plausibly fit your customer. Establish source of wealth and source of funds with documents, not just assertions. Apply a risk rating, obtain the approvals your policy requires, and set a review frequency for ongoing monitoring.
Document everything: the screening result, your corroboration, the EDD measures taken, and the decision. If risk cannot be managed, decline or exit — but do so for reasoned risk management, not because “PEP” appeared on a screen.