August 18, 2026

PEP Screening: Who Counts and How to Risk-Rate Them

Axle Team

Key takeaways

No US regulation explicitly requires PEP screening. The 2020 interagency statement confirms the CDD rule imposes no unique due diligence steps for PEPs — but FATF Recommendation 12 and examiner expectations mean a risk-based program still needs it.
PEP status is an input to a risk rating, not a rating by itself. Regulators are explicit that not all PEPs are high risk.
Who counts: individuals entrusted with prominent public functions, plus immediate family members and close associates. FATF extends coverage to domestic and international-organization PEPs on a risk basis; US agencies read "PEP" as foreign officials only.
There is no fixed sunset for former PEPs. Weigh time out of office and residual influence, not a calendar rule.
Most PEP screening cost sits in adjudication, not matching. Name-only hits on common names are the dominant false-positive source — secondary identifiers are where the leverage is.

PEP screening is the process of identifying whether a customer or beneficial owner is a politically exposed person — someone entrusted with a prominent public function — and calibrating due diligence to the risk that person presents. In the US it is a risk-based practice rather than an explicit regulatory mandate; FATF Recommendation 12 requires risk-management systems for PEPs.

That gap between "not literally required" and "expected everywhere" is where most PEP program design questions live. Here is how to navigate it.

What PEP screening is actually required to cover

Start with what the rules say, because it is less than most vendor decks imply. The 2020 joint statement from FinCEN and the federal banking agencies is the controlling US articulation:

"There is no regulatory requirement in the CDD rule, nor is there a supervisory expectation, for banks to have unique, additional due diligence steps for PEPs. The CDD rule also does not require a bank to screen for or otherwise determine whether a customer or beneficial owner of a legal entity customer may be considered a PEP."
— Federal Reserve, FDIC, FinCEN, NCUA, and OCC, Joint Statement on BSA Due Diligence Requirements for Customers Who May Be Considered Politically Exposed Persons (Aug. 21, 2020)

The agencies also do not interpret "PEP" to include US public officials, and they distinguish PEPs from "senior foreign political figures" — the narrower term defined in the BSA private banking rules (31 CFR 1010.605(p)), which do carry mandatory enhanced scrutiny for private banking accounts.

Internationally, the bar is higher. FATF Recommendation 12 requires financial institutions to have risk-management systems to determine whether a customer or beneficial owner is a foreign PEP and, for higher-risk relationships, to obtain senior management approval, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring. Domestic PEPs and persons entrusted with prominent functions by international organizations get these measures on a risk-sensitive basis (see FATF's guidance on Recommendations 12 and 22). If you operate outside the US, or your correspondent partners do, the FATF standard is the one your counterparties will hold you to.

Who counts as a PEP

Foreign PEP — individuals entrusted with prominent public functions by a foreign country: heads of state, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises, senior party officials. Typical treatment: screened at onboarding, risk-rated individually, EDD where risk warrants.
Domestic PEP — the same functions in the home jurisdiction (US agencies exclude US officials from "PEP"; FATF covers them risk-based). Typical treatment: risk-based; often flagged but not automatically escalated.
International organization PEP — senior management of international organizations: directors, deputy directors, board members or equivalent. Typical treatment: risk-based, per FATF Rec 12.
Family members and close associates — immediate family and persons closely connected to a PEP, socially or professionally. Typical treatment: screened alongside the PEP; usually a lighter adjudication path unless the relationship itself carries risk.

The common thread: it is the function that matters, not the title. A mid-level official with signature authority over procurement can carry more corruption risk than a ceremonial minister.

How to risk-rate PEP customers

Regulators have moved decisively away from treating PEP status as a risk rating in itself:

"Not all PEPs are high risk solely by virtue of their status. Rather, the risk depends on facts and circumstances specific to the customer relationship."
— 2020 Interagency Joint Statement on PEPs

The joint statement and the FFIEC manual give you the factor set. In practice, a defensible PEP risk model scores:

The function — the customer's official responsibilities, their authority or influence over government activities or officials, and their access to significant government assets or funds.
The jurisdiction — corruption risk, plus the strength of the jurisdiction's legal and enforcement frameworks, including ethics reporting and oversight requirements.
The relationship — products and services used, volume and nature of transactions, and geographies associated with the customer's activity and domicile.
The money — whether sources of funds are known and legitimate; a low-dollar deposit account with limited transaction volume can reasonably carry a lower risk profile.

For former officials, resist the urge to hard-code a sunset. The FFIEC manual frames it as a judgment call:

"For a bank-identified PEP who is no longer in active government service, banks may also consider the time that the customer has been out of office and the level of influence he or she may still hold as factors in the customer risk profile."
— FFIEC BSA/AML Examination Manual, Politically Exposed Persons (Nov. 2021)

A head of state who left office three years ago with an intact patronage network is not the same risk as a retired deputy minister of agriculture, and a rule that declassifies both at 12 months will embarrass you in an exam.

Running PEP screening without drowning in false positives

The practitioner reality: matching is cheap, adjudication is expensive, and the two are usually tuned by different people. The single highest-leverage change most teams can make is to stop adjudicating at the hit level and start adjudicating at the relationship level — pull every candidate match for a customer into one review, resolve identity once using secondary identifiers (date of birth, jurisdiction, role, known aliases), and record the identity decision separately from the risk decision. When those two decisions are collapsed into one queue, analysts re-litigate the same common-name match every rescreening cycle, and the risk assessment never gets more sophisticated than "cleared again."

Cadence should follow the risk tier, not the vendor default: event-driven and continuous rescreening for confirmed high-risk PEPs, periodic batch for the rest, with list-source changes (a new government, a coup, an election cycle) treated as events. And measure adjudication quality, not just volume — a queue that clears 95% of PEP alerts as false positives with one-line dispositions is a finding waiting to be written.

This is the workload Axle built Baley, our screening agent, to carry: resolving watchlist and PEP hits with full identity reasoning and a documented disposition, with your team reviewing the calls. Where a confirmed PEP needs enhanced due diligence — source of wealth, adverse media, network exposure — Justin picks up the EDD file. If you're mapping where agents fit in your screening stack, start with the AI readiness playbook.

FAQ

Is PEP screening required by US law?

Not explicitly. The 2020 interagency statement confirms the CDD rule does not require banks to screen for PEP status. But BSA/AML programs must be risk-based, private banking accounts for senior foreign political figures carry mandatory enhanced scrutiny under 31 CFR 1010.620, and examiners evaluate how you manage PEP risk — so virtually every institution with meaningful exposure screens.

How long does someone remain a PEP after leaving office?

There is no fixed period in US regulation or FATF standards. The FFIEC manual directs banks to weigh time out of office and the level of influence the person still holds. Risk-based declassification — reviewed case by case — is the defensible approach; automatic expiry after a set number of months is not.

Are family members and close associates PEPs?

They are generally treated as PEPs for screening purposes. The interagency statement's working definition includes immediate family members and close associates, and FATF Recommendation 12 extends its requirements to them explicitly. Their risk rating, though, should reflect the underlying PEP's profile and the nature of the connection — not an automatic inheritance of the highest tier.

PEP screening only works when every hit gets a real decision. See how Baley, Axle's screening agent, adjudicates PEP and watchlist alerts with documented reasoning and a human in the loop.

PEP Screening: Who Counts and How to Risk-Rate Them

More from the blog