Politically exposed person screening is the process of checking your customers against databases of people who hold prominent public positions, along with their family members and close associates, so you can decide who needs extra scrutiny. It runs at onboarding and continues for the life of the relationship, because a customer who is ordinary today may be appointed to office next year.
Most PEP screening guides stop at "find the PEPs and apply enhanced due diligence." That advice is what produces compliance teams buried in alerts, applying the same heavy treatment to a retired local councillor and a sitting finance minister.
The regulators do not actually ask for that. This guide covers who you flag, how closely to match, what monitoring genuinely requires, and the question almost nobody answers properly: when someone stops being a PEP.
Who Are You Actually Screening For?
A politically exposed person is someone entrusted with a prominent public function. The concern is not that they are dishonest. It is that their position gives them access to public money and the power to move it, which makes them a target for bribery and a useful vehicle for laundering the proceeds.
The Financial Action Task Force (FATF), the global standard-setter for anti-money laundering, splits them into three groups in Recommendation 12: foreign PEPs, who hold prominent public functions in another country, domestic PEPs, who hold them in your own, and international organisation PEPs, who hold senior roles at bodies like the UN, the World Bank or the African Development Bank.
That distinction decides how much work each one costs you, and we come back to it below. For the full breakdown of each category with examples, see our guide to politically exposed persons.
What Is Politically Exposed Person Screening?
Screening is the mechanical part: you check a name against a PEP database and see what comes back. The database is commercial, compiled from public records, official gazettes, company registries and news coverage.
What people call politically exposed person screening is really four things. You identify whether a customer is a PEP at onboarding. You classify what kind, because the required treatment differs. You apply PEP due diligence proportionate to that classification. And you keep checking, because political status changes and nobody will tell you.
Here is the part most articles get wrong. Being a PEP is not a finding of wrongdoing and it does not automatically mean high risk.
FATF treats foreign PEPs as automatically requiring enhanced measures. For domestic PEPs and international organisation PEPs, it asks you to assess risk first and apply enhanced measures only where the risk is higher.
The UK's Financial Conduct Authority goes further. Its finalised guidance states that a PEP entrusted with a prominent public function in the UK "should be treated as low risk, unless a firm has assessed that other risk factors not linked to their position as a PEP mean they pose a higher risk."
So the instinct to flag every PEP as high risk is not just expensive. In at least one major jurisdiction it is contrary to what the regulator asked for.
Who Counts: Domestic, Foreign, International and PEPs by Association
The category that causes the most trouble is the one that is not a PEP at all.
Family members are people related to a PEP by blood, marriage or civil partnership. Close associates are people socially or professionally connected: business partners with shared ownership, political allies, romantic partners.
Together these are often called PEPs by association, or RCAs, for relatives and close associates. They matter because a PEP moving illicit funds rarely does it in their own name. They do it through a spouse, a sibling, or a company owned with a business partner.
This is also where most PEP programmes quietly fail. Screening a customer against a PEP database is easy. Working out that your customer is the brother-in-law of a state governor is not, because that relationship is not printed on their identity document.
Three practical moves help. Ask about political exposure directly on your onboarding form, including family connections, because a false answer becomes evidence later. Screen beneficial owners, not just the account holder. And use a database that maps relationships rather than one that only lists names.
One nuance worth knowing, because it saves real work: the FCA guidance says a family member of a former PEP should not be subject to enhanced due diligence unless the firm's own risk assessment justifies it. Associates come off the list faster than the PEP does.
For the Nigerian picture specifically, see our guide to the PEP list in Nigeria.
How Does PEP Screening Work, Step by Step?
1. Collect the identifying data.
Full name, date of birth, nationality, and where available a national identification number. Screening on a name alone is what generates unmanageable alert volumes, because names are not unique and dates of birth are.
2. Screen at onboarding. Run the customer and every beneficial owner against the PEP database before the relationship opens.
3. Review what comes back. An alert is a question, not an answer. Someone has to decide whether your customer is the person in the database.
4. Classify the confirmed match. Foreign, domestic or international organisation. Current or former. PEP or associate. That classification decides everything that follows.
5. Apply proportionate PEP due diligence. For anyone requiring enhanced treatment: senior management approval before opening or continuing the relationship, source of wealth and source of funds established, and enhanced ongoing monitoring. Those three are not optional extras. They are what enhanced due diligence means in both UK regulation 35 and Nigerian law.
6. Keep screening. Covered next, and it is the step most often skipped.
How Do You Set Matching Thresholds Without Drowning in False Positives?
PEP databases are far larger than sanctions lists. Sanctions lists name people a government has specifically designated. PEP databases try to catalogue everyone holding public office anywhere, plus their relatives and associates. A vastly bigger population, so a very high proportion of your alerts will be the wrong person. That is normal, not a sign something is broken.
How closely a name must match before your system reacts is a setting somebody chooses. Set it tight and you miss transliteration variants, which matters enormously for Nigerian, Arabic and Chinese names where romanisation is inconsistent. Set it loose and you generate so many alerts that analysts start clearing them on autopilot, which is how the real match goes out with the rest.
The way through PEP screening noise is not a better setting. It is more data. Screening on name plus date of birth plus nationality collapses false alarms, because the coincidence of all three is rare where the coincidence of a name is not.
Then do three things. Test your threshold against known PEPs with deliberate spelling variations, recording what the system catches and wrongly flags at each level. Write down the setting you chose and who approved it. And track your false positive rate over time, because a sudden change usually means a data problem rather than a change in your customers.
Treat the threshold as a documented risk decision with a named owner. If an examiner asks why it sits where it does, "the vendor's default" is not an answer.
What Does Ongoing PEP Monitoring Actually Require?
Everyone agrees you should monitor PEP relationships on an ongoing basis. Almost nobody says how often, which makes the advice useless.
Ongoing PEP monitoring means two separate things, and conflating them is a common gap.
1. Re-screening the customer base. Customers change status. Someone ordinary at onboarding gets appointed to a board, elected, or married into a political family. Screen only at onboarding and you will never know. Re-screening should be continuous, or at minimum triggered every time your provider updates the database.
2. Monitoring confirmed PEPs' behaviour. This is transaction-level: someone actually checks whether the activity matches the source of wealth you documented.
For cadence, tie the interval to the classification rather than picking one number for everyone. A current foreign PEP in a senior finance role warrants a documented review at least annually and probably more often. A domestic PEP your risk assessment rated low may only need review when something triggers it.
3. Define the triggers explicitly: a change in political office, adverse media, a transaction outside the expected pattern, or a change in beneficial ownership. And define what a review produces. A review that changes nothing and leaves no record is indistinguishable from one that never happened.
When Does Someone Stop Being a PEP?
This is the question your competitors answer in one hedged sentence, and it has real cost attached. Enhanced due diligence is expensive, and applying it forever to people who left office a decade ago is money spent for no risk reduction.
There are two authoritative positions and they do not agree.
1. FATF says no fixed clock. Its guidance on Recommendations 12 and 22 is explicit: "The handling of a client who is no longer entrusted with a prominent public function should be based on an assessment of risk and not on prescribed time limits." The factors are how senior the position was, how much influence the person retains, and whether their current activity connects to the former role.
2. The UK sets a floor. Regulation 35(9) of the Money Laundering Regulations 2017 requires enhanced measures for at least 12 months after the person ceases to hold the function, and firms may extend that where risk warrants.
These are reconcilable. Twelve months is a minimum, not a release date. A risk assessment can and often should keep someone in scope well beyond it.
In practice, three approaches exist. Once a PEP, always a PEP is the safest and the most expensive, and FATF has explicitly said it is not what the standard requires. A fixed period is easy to administer and defensible in the UK, but it is a blunt instrument. Risk-based declassification is what FATF asks for and what a mature programme does.
If you choose the third, write the criteria down before you need them. How long since they left office. How senior the role was. Whether they retain influence, through a party position, a board seat or a family member still in office. Whether any adverse media exists. Whether their transaction behaviour has ever raised a question. And who signs off on removing PEP status, which should not be the relationship manager who benefits from the account getting easier to service.
One more thing that saves genuine effort. Under the FCA guidance, the 12-month minimum applies to the PEP. A family member of a former PEP reverts to standard customer due diligence immediately unless other risk factors justify otherwise.
What Do Nigerian Rules Require?
1. Nigerian institutions work from two instruments: the Money Laundering (Prevention and Prohibition) Act 2022 and the Central Bank of Nigeria's AML/CFT/CPF Regulations 2022.
2. The Act recognises the same three categories FATF uses: foreign, domestic and international organisation PEPs. The obligations run to family members and close associates as well.
What institutions must do is identify PEPs, obtain senior management approval before establishing or continuing the relationship, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring.
Two things are worth flagging for Nigerian compliance teams specifically.
Domestic PEPs carry more practical weight here than international guidance implies. A domestic PEP framework borrowed wholesale from a jurisdiction with different corruption dynamics will not serve you. Your risk assessment has to be built for where you actually operate.
And identification is harder than it looks. Nigerian naming conventions, inconsistent romanisation, and extended family relationships that matter socially but appear nowhere official all make associates difficult to find. That argues for asking customers directly, and for a database with genuine domestic depth rather than one that catalogues world leaders and stops.
For more on this, see our analysis of high-risk politically exposed persons in Nigeria and the PEP red flag indicators worth watching for.
How Youverify Helps
Most of what this guide describes is judgement work no vendor can do for you. Nobody else writes your risk assessment or decides when a former governor comes off your enhanced list. What technology should do is make the classification and the evidence automatic.
Youverify's PEP and sanctions screening solution screens customers and beneficial owners against global PEP databases, sanctions lists and adverse media in real time, with continuous re-screening as records change. It carries genuine Nigerian domestic PEP coverage rather than global lists alone, maps relationships so associates surface instead of staying invisible, and records every decision so you can reconstruct why a match was cleared.
To see whether your current setup would hold up under a CBN examination, book a demo with our compliance experts.
