PEP Screening: A Practical Guide for Compliance Officers

How does PEP screening software cut false matches?

Most PEP screening queues are full of people who aren't politically exposed. A customer shares a surname with a deputy minister, a director has the same name as an ambassador's son, and someone has to prove each one is a different person. Make the matching stricter and the queue shrinks, but you risk losing the one real match that mattered. When you buy PEP screening software, you are mostly buying how it handles that trade-off.

The rules don't ask you to treat every politically exposed person (PEP) as a suspect, either. The UK regulator's PEP guidance says firms should not decline or close a relationship merely because someone meets the PEP definition. In the 2020 joint statement on PEPs, US banking agencies say the level of risk varies and not all PEPs are automatically higher risk. A screening system that flags too many people, or treats every hit as high risk, creates work the rules never asked for.

This guide is for MLROs and heads of screening at banks, fintechs and other regulated firms. It covers what the standards require, how name matching works and why queues fill up, how to tune matching without losing real matches, how to assess a confirmed PEP, how long PEP status lasts, and how to test PEP screening software on your own names before you buy. It draws on the FATF Recommendations, regulation 35 of the UK Money Laundering Regulations 2017, the UK Financial Conduct Authority's July 2025 PEP guidance and its 2024 review, the 2020 joint statement from US banking agencies, the Hong Kong Monetary Authority's 2023 screening guidance and OFAC's description of its own list search, as they stood on October 19, 2026. It isn't legal advice, and the definitions that apply to you depend on your jurisdiction.

Request a name-matching test on your own data

Bring the four-part test set from this guide, or a sample of your own customer names and the PEP data you license. We'll run the agents in shadow mode on your own data and show you the cases they prepare, including every proposed clear with its reasoning and every match that goes to your analyst. Your team decides what happens next.

Run the name-matching test set

What does PEP screening have to do?

The international standard is Recommendation 12 of the FATF Recommendations. For foreign PEPs, whether customer or beneficial owner, it asks financial institutions to apply four measures in addition to performing normal customer due diligence measures. They should have appropriate risk-management systems to determine whether the customer or the beneficial owner is a politically exposed person. They should obtain senior management approval for establishing (or continuing, for existing customers) such business relationships. They should take reasonable measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring of the business relationship.

Domestic PEPs and people with a prominent function at an international organisation are treated differently. Institutions should take reasonable measures to determine whether a customer or beneficial owner is one of them, and apply the extra measures only in cases of a higher risk business relationship. The requirements for all types of PEP also apply to family members or close associates of such PEPs. The FATF glossary says the definition of PEPs is not intended to cover middle ranking or more junior individuals. Our PEP screening control guide explains how the control sits inside customer due diligence and what examiners look for.

National rules put this standard into law in different ways, and the differences matter for screening software. Three examples show how far apart they are.

In the UK the requirement is law. Under regulation 35 of the Money Laundering Regulations 2017, a relevant person must have in place appropriate risk-management systems and procedures to determine whether a customer or the beneficial owner of a customer is a PEP, or a family member or a known close associate of a PEP. For a domestic PEP, the starting point for the assessment is that the customer presents a lower level of risk than a non-domestic PEP. The FCA's guidance adds that this does not mean that a foreign PEP will always be higher risk.

In the United States, the agencies do not interpret the term "politically exposed persons" to include U.S. public officials. They say BSA/AML regulations do not define PEPs, and that the term is commonly used to refer to foreign individuals who are or have been entrusted with a prominent public function, as well as their immediate family members and close associates. They also say the CDD rule does not require a bank to screen for or otherwise determine whether a customer or beneficial owner of a legal entity customer may be considered a PEP. PEPs should not be confused with the term "senior foreign political figure" (SFPF) as defined under the BSA private banking regulation, a subset of PEPs.

For screening software, the lesson is that "PEP" is not one fixed list. A bank operating in the UK and the US has two different definitions to apply, and a system that can't hold more than one will push the difference onto your analysts.

How does PEP screening work?

PEP screening checks the names of your customers, and of the people behind them, against data about people who hold or held prominent public functions. The FATF standard applies whether the PEP is the customer or the beneficial owner. The FCA expects firms to use information that is reasonably available to them in identifying PEPs, family members or known close associates, and says firms should use a variety of sources where possible. A firm can choose, but is not required, to use commercial databases that contain lists of PEPs, family members and known close associates. If it does, it would need to understand how such databases are populated and will need to ensure those flagged by the system fall within the definition of a PEP, family member or close associate as set out in the Regulations and the FCA's guidance.

• The customer record goes into name screening with the names of the customer and its beneficial owners. The PEP data source goes into name screening with each listed person's role, country and dates in office. Each run of name screening produces a potential match when a name is similar enough to a listed person. Each potential match goes to analyst review, where a person confirms or rules out the match. A confirmed match from analyst review goes on to a PEP risk assessment.

That last point is easy to miss. A commercial PEP list is someone else's definition. If the vendor lists every local councillor and your regulator says local government is out of scope, the system will raise matches you are not supposed to treat as PEPs.

The first figure shows the basic flow. The customer record goes into name screening with the names of the customer and its beneficial owners. The PEP data source goes into name screening with each listed person's role, country and dates in office. Each run of name screening produces a potential match when a name is similar enough to a listed person. Each potential match goes to analyst review, where a person confirms or rules out the match. A confirmed match from analyst review goes on to a PEP risk assessment.

A screen runs at onboarding, and again whenever the list or the customer changes. PEP status starts and ends with appointments, elections and resignations, so a customer who was clear last year can be a PEP today.

PEP screening usually shares its matching engine with sanctions screening, but the outcome is different. A sanctions match can mean a payment must be stopped before it settles, which is why payment screening runs in real time, as our post on real-time sanctions screening for payments explains. A PEP match starts a risk assessment, not a block.

Why do PEP screening queues fill up?

Name matching has to catch the same person written in different ways. OFAC's own list search tool is a useful public example. According to OFAC's FAQ on Sanctions List Search, beyond exact matches it can also provide a broader set of results using fuzzy logic, which uses character and string matching as well as phonetic matching. Only the name field of Sanctions List Search invokes fuzzy logic when the tool is run. Commercial screening engines work on the same idea, with more settings.

The Hong Kong Monetary Authority's 2023 guidance on screening says settings should help a system catch the manipulation of names and keywords (e.g. re-ordering and swapping), as well as the use of different names with the same phonetics. It also says firms may use systems that handle name variations from multiple Chinese Romanisation systems (e.g. Mandarin pinyin, Cantonese, Hokkien) and different types of Chinese characters. The same problem applies to Arabic, Cyrillic and Devanagari names written in Latin script.

Every variant a system catches is also a variant that can match an innocent person. Our view is that most of the noise in a PEP queue comes from four sources:

• Common names, which match many listed people from the same country.
• Name-only matching, where the system can't use date of birth, nationality or address, so every namesake looks the same.
• A vendor list built to a wider definition than yours, which produces matches that aren't PEPs under your rules.
• Rescreening without memory, which re-raises hits your team already cleared and creates the same work again.

Sanctions screening queues fill up for the same reasons, and our sanctions screening guide covers why those queues are so noisy and how programs fail.

The FCA found the third problem in practice. Its 2024 review of how firms treat PEPs found that some firms used definitions for PEPs and for their relatives and close associates (RCAs) that were wider than those in the regulations and the FCA's guidance.

Key insight: a wider PEP definition doesn't make screening safer. It moves the noise from the list into your queue.

How do you tune matching without missing real PEPs?

Every screening system makes a trade between two kinds of error. The HKMA puts it in plain terms for sanctions screening: firms should endeavour to strike the right balance between system effectiveness and efficiency. In that guidance, effectiveness refers to the overall capability of the system in detecting a hit against a sanctioned person, and efficiency refers to the minimising of false positives. The guidance is written for sanctions screening, but we think the same discipline applies to a PEP screening system.

• Name similarity feeds the match score, including spelling, word order and phonetic variants. Date of birth and nationality feed the match score as secondary identifiers. Threshold tests on a known name set check the match score settings before and after any change. Only a match score above your documented threshold sends a hit to the alert queue. The alert queue goes to an analyst, who decides each hit with a written reason.

Settings are where that balance is set. The HKMA says examples of settings that can be applied to a screening system include thresholds of similarity for different identifiers such as names and dates of birth. Firms should be able to demonstrate a clear understanding of the settings used in their screening systems. Where suppression lists (e.g. "good guy", "white" or exclusion lists) are used, they should be subject to appropriate testing and oversight, which should occur before implementation of a new system or system enhancement. Frequent and regular monitoring, tuning and testing should be conducted on all aspects of screening systems and processes, with testing results and analysis properly documented.

The second figure shows how a hit is scored and where people come in. Name similarity feeds the match score, including spelling, word order and phonetic variants. Date of birth and nationality feed the match score as secondary identifiers. Only a match score above your documented threshold sends a hit to the alert queue. The alert queue goes to an analyst, who decides each hit with a written reason. Threshold tests on a known name set check the match score settings before and after any change.

There is no industry standard similarity threshold for PEP matching, and none of the sources in this guide sets one. Your threshold should come from testing on your own customer names and a known set of PEP names, and the reason for it should be written down.

A practical way to tune without losing real matches:

1. Fix the true positives first. Build a set of real PEP names, including transliterations, reordered names and names with initials, and confirm the system catches all of them at your chosen setting.
2. Add identifiers before loosening names. Use date of birth, nationality and ID numbers to clear namesakes, rather than raising the name threshold until the namesakes disappear.
3. Narrow the list to your definition. Remove categories your rules exclude, such as junior officials, and document why.
4. Stop re-raising decided hits. Rescreening should raise only new or changed information about a match your team already decided.
5. Retest after every change. Run the same test set after any threshold, list or suppression change and keep the result.

The HKMA also asks for regular and frequent testing (such as periodic sample testing on names of newly added designations). For PEPs, the equivalent is checking that newly appointed officials appear in your data and match.

What should happen to each match?

A potential match only means two names look alike. The HKMA says firms should clearly identify the parties responsible for reviewing and clearing the alerts, and set out timelines for alert clearance. The rationale for closing or escalating the alert should be documented in sufficient detail to provide an audit trail. It also says firms should be cautious about using pre-defined answers for clearance of alerts. A drop-down that says "false positive" with no reason doesn't tell an examiner why your analyst decided the customer wasn't the minister.

A good clearance note says which identifiers differed and where the evidence came from. For example: the listed person was born in 1958 and the customer in 1991, the listed person is a national of another country, and the customer's passport was verified at onboarding. A note like that lets anyone who reads the file later see why the hit was closed.

Once a match is confirmed, the work changes from matching to risk assessment. The UK guidance says a firm's assessment and its decision to apply relevant enhanced due diligence measures need to be clearly documented. A confirmed match is not a suspicion in itself, and the reporting duty runs alongside the PEP assessment: the US agencies remind banks of their obligation to identify and report suspicious activity, including transactions that may involve the proceeds of corruption.

How should a confirmed PEP be risk assessed?

The FCA's guidance is the most detailed public source on this, and it is clear that the assessment is case by case. It lists the prominent public functions the PEP holds, where that function is held, the nature of the proposed business relationship and the potential for the product to be misused for corruption as factors. It says no one risk factor set out below means a customer should automatically be treated as posing a higher risk; it is necessary to consider all aspects. The US agencies take a similar line: a bank may consider the customer's access to significant government assets or funds, among other factors. They give examples of lower risk: PEPs with a limited transaction volume, a low-dollar deposit account with the bank, known legitimate source(s) of funds, or access only to products or services that are subject to specific terms and payment schedules could reasonably be characterized as having lower customer risk profiles.

• The prominent function feeds the risk assessment, from head of state to an opposition member with no executive role. The country where the function is held feeds the risk assessment. The product and relationship feed the risk assessment, including how easily it could be misused. The risk assessment leads to lower risk measures when the factors together point that way. Otherwise the risk assessment leads to higher risk measures, with closer checks and more senior sign-off.

The FCA lists indicators in both directions. A PEP may pose a lower risk if they do not have executive decision-making responsibilities, for example an opposition MP. Higher risk indicators include personal wealth or lifestyle inconsistent with known legitimate sources of income or wealth, and responsibility for, or the ability to influence, large public procurement exercises.

The third figure shows how the assessment works. The prominent function feeds the risk assessment, from head of state to an opposition member with no executive role. The country where the function is held feeds the risk assessment. The product and relationship feed the risk assessment, including how easily it could be misused. The risk assessment leads to lower risk measures when the factors together point that way. Otherwise the risk assessment leads to higher risk measures, with closer checks and more senior sign-off.

The measures follow the rating. For any PEP relationship, regulation 35 requires senior management approval for establishing or continuing the relationship, adequate measures to establish the source of wealth and source of funds, and enhanced ongoing monitoring. In lower risk cases, the FCA says firms may only use information already available to the institution (such as transaction records or publicly available information) and do not make further inquiries of the individual unless anomalies arise. In higher risk cases, they may take more intrusive and exhaustive steps to establish the source of wealth and source of funds of PEPs, family members or known close associates of a PEP. The guidance says that in lower risk situations sign-off may be at a lower level of seniority in a firm but should still have sufficient authority to sign off these decisions and those decisions should be documented. The MLRO may be independent of decisions to sign off PEP relationships but the FCA expects them to be aware of any PEPs onboarded or rejected as part of their role of overseeing the operation of a firm's AML policies and procedures.

Where a person holds functions that meet the definition of both a domestic PEP and a foreign PEP, a firm should treat them as a foreign PEP. A legal entity should not be treated as a PEP unless it is clear that the PEP exercises significant control over the entity.

Who counts as family or a close associate?

Family and associates are where PEP screening gets hardest, because the names are less public and the links are harder to prove. The FCA says family and close associates are not themselves PEPs solely as a result of their connection to a PEP, although UK law still applies enhanced measures to them. Regulation 35 says a family member of a PEP includes a spouse or civil partner, children and their spouses or civil partners, and parents. A known close associate is an individual known to have joint beneficial ownership of a legal entity or a legal arrangement or any other close business relations with a PEP, or an individual who has sole beneficial ownership of a legal entity or a legal arrangement which is known to have been set up for the benefit of a PEP.

Two practical points follow for software. First, the relationship has to come from somewhere: a PEP data source that includes relatives and close associates, a corporate registry, or your own customer file. Second, the FCA warns that a firm should be alert to the potential that middle ranking and more junior officials could act on behalf of a PEP. No list will catch that. It shows up in monitoring, when a customer's activity doesn't fit the profile you recorded.

How long does someone stay a PEP?

In the UK, regulation 35 requires a firm to keep applying the PEP measures for at least 12 months after the date on which the person ceased to be entrusted with that public function, or for a longer period the firm considers appropriate. The FCA says longer periods will only be necessary for PEPs the firm has assessed as higher risk, and the firm should document the rationale. The tail doesn't extend to family members or known close associates. Regulation 35 ends the requirement for them once the PEP leaves office, and the FCA says family members should be treated as ordinary customers, subject to customer due diligence obligations from the point that the PEP leaves office. In the United States, for a PEP who is no longer in active government service, banks may also consider the time that the customer has been out of office, and the level of influence he or she may still hold. FATF Recommendation 12 sets no fixed period, so the 12-month floor is a UK rule, and you should check what your own rules say.

• A list update triggers rescreening of the customers it could affect. A customer data change triggers rescreening of that customer. Each round of rescreening raises a new or changed match only when something new appears. Leaving office starts a declassification review, scheduled from the date the function ended. The declassification review either returns the customer to ordinary due diligence or records why enhanced measures continue.

The FCA found this step often goes wrong. Its 2024 review found that some did not have effective arrangements to assess if the PEP classification was still appropriate after the PEP had left public office. Its 2025 guidance references trigger events like planned elections that can help firms with their monitoring of PEP status. It also included an option for firms to ask their customers to let them know about the change of circumstance to aid with up-to-date records.

The fourth figure shows how ongoing screening keeps status current. A list update triggers rescreening of the customers it could affect. A customer data change triggers rescreening of that customer. Each round of rescreening raises a new or changed match only when something new appears. Leaving office starts a declassification review, scheduled from the date the function ended. The declassification review either returns the customer to ordinary due diligence or records why enhanced measures continue.

How do you test PEP screening software before you buy?

Most vendors will show you a demo on their own data, which tells you little about your own queue. Ask to run your own test set instead, and keep the results. The vendor's own claims about false-match reduction mean nothing until they have been tested on your list set, your customer names and your settings.

A good test set has four parts:

Run the same set against your current system and the candidate, at the settings you would use in production. Then ask the questions below.

• Data: How is the PEP data populated, how often is it updated, and can you exclude categories your rules don't cover? The FCA expects firms to understand how such databases are populated.
• Definitions: Can the system apply more than one PEP definition, for example UK domestic PEPs starting as lower risk and US rules that exclude U.S. public officials?
• Matching: Which identifiers does it use beyond the name, and how does it handle scripts and transliteration?
• Explanation: For every proposed clear, can your analyst see why the system thinks it is a different person?
• Memory: Does rescreening re-raise hits you already decided, or only new information?
• Status: Does it record dates in office and prompt declassification reviews?
• Records: Does every screen record the list version, the settings and the decision, so you can replay it later?
• Control: Who can clear a match without a person, and can you switch that off?

The HKMA guidance says the ultimate responsibility for ensuring the accuracy and completeness of the databases rests with the firm, which should understand which lists and data are included in the screening databases and be able to explain any decisions made. That applies even when the data comes from a vendor, so record the answers to these questions in your own file rather than relying on the vendor's brochure.

Who decides what in PEP screening?

The rules put the decisions that matter with named people. FATF Recommendation 12 and regulation 35 both require senior management approval for PEP relationships. The FCA guidance asks firms to clearly document which staff can sign off PEP relationships and to keep the MLRO aware of PEP onboarding decisions. The HKMA asks for clarity on who reviews and clears alerts, and says management information, such as information on volume of alerts, false positives and genuine hits, should be made available to senior management. Our post on what the MLRO owns in PEP and sanctions screening maps those approvals in more detail for UAE banks.

• Customer and PEP data flow into the AI agent layer, which compares names and identifiers and gathers context. The AI agent layer proposes each clear to the screening analyst with its reasons. The screening analyst escalates confirmed PEPs to the senior manager for approval. The senior manager decides whether to establish or continue the relationship, and the MLRO is kept informed.

The fifth figure shows where an AI agent layer can sit inside that structure. Customer and PEP data flow into the AI agent layer, which compares names and identifiers and gathers context. The AI agent layer proposes each clear to the screening analyst with its reasons. The AI agent layer sends confirmed and unresolved matches to the screening analyst with the evidence attached. The screening analyst escalates confirmed PEPs to the senior manager for approval. The senior manager decides whether to establish or continue the relationship, and the MLRO is kept informed.

Conclusion

PEP screening is meant to be proportionate. The FATF standard asks for enhanced measures on foreign PEPs and on higher risk domestic and international organisation PEPs. UK law starts domestic PEPs as lower risk, and the FCA warns against declining customers for their status alone. US agencies say not all PEPs are automatically higher risk. A screening system that floods your analysts with namesakes doesn't make that judgment easier.

The fix is mostly discipline: a definition that matches your rules, matching that uses more than the name, thresholds you can explain, clear reasons for every decision and a test set you run every time something changes. Test any PEP screening software against your own names before you buy it, and keep the results in your file.

Request a name-matching test on your own data

Bring the four-part test set from this guide, or a sample of your own customer names and the PEP data you license. We'll run the agents in shadow mode on your own data and show you the cases they prepare, including every proposed clear with its reasoning and every match that goes to your analyst. Your team decides what happens next.

Run the name-matching test set

Frequently Asked Questions

About the author

Sahil Kataria

Founder and CEO of FluxForce

Sahil works on secure AI and financial technology for regulated industries. His engineering background spans identity verification, payment security and compliance automation. He has led teams across Africa, the United States, Europe and India.

At FluxForce.ai, his focus is on explainable AI and auditable financial workflows. He writes for banking and compliance teams about the practical decisions behind these systems: how to assess risk, keep controls visible and introduce automation without losing accountability.

View Sahil Kataria author profile →