PEP Screening and Management: A Practical UK Compliance Guide

What the law means by a politically exposed person

Regulation 35 defines a politically exposed person as an individual who is entrusted with prominent public functions, other than as a middle-ranking or more junior official. The prominent public functions listed in the Regulations include heads of state and government, government ministers, members of parliaments and courts of auditors, senior judges, senior members of central bank boards, ambassadors, high-ranking military officers, and directors of state-owned enterprises, among others. A PEP is defined by the position held, not by any allegation of wrongdoing.

The reach of the rules extends beyond the individual. Regulation 35 also captures family members and known close associates, because these people may benefit from, or be used to facilitate, the abuse of public funds. Crucially, the FCA is clear that a family member or known close associate is not themselves a PEP purely as a result of that connection. They fall within scope for enhanced scrutiny, but firms should not apply broader family definitions or wider circles of associates unless a higher risk has been assessed.

Firms need documented procedures to determine whether a customer or a beneficial owner is a PEP, a family member or a known close associate. This includes situations where such a person operates through an intermediary or introducer, where the firm should understand why that arrangement is being used and factor it into the risk assessment.

Domestic PEPs should generally be treated as lower risk

One of the most important practical points in the current framework is the treatment of UK PEPs. Following changes to the Regulations, the legal starting point since 10 January 2024 is that UK PEPs and their relatives and close associates present a lower level of risk than a foreign PEP where no enhanced risk factors are present. The FCA reflects this in FG25/3: the starting point for the risk assessment for a domestic PEP or their family members and known close associates is that they present a lower level of risk than a non-domestic PEP.

This does not create rigid tiers. The FCA is careful to note that a foreign PEP will not always be higher risk, and that no single risk factor should automatically push a customer into a higher risk category. The point is that firms should be able to take lower levels of enhanced due diligence for UK PEPs where their own analysis supports a lower risk, and should document that reasoning. A robust control framework helps firms record and defend these judgements consistently.

The FCA's July 2024 multi-firm review found that some firms operated global policies not tailored to the UK position, and it told firms their arrangements must reflect the legislative starting point that UK PEPs and their relatives and close associates are lower risk absent enhanced risk factors. Firms that simply inherit a group-wide, one-size-fits-all approach risk both over-screening domestic customers and failing to align with UK expectations.

The enhanced measures firms must apply

Where a firm proposes to establish or continue a business relationship with a PEP, family member or known close associate, regulation 35 requires three core measures. First, the firm must obtain approval from senior management for establishing or continuing the relationship. Second, it must take adequate measures to establish the source of wealth and source of funds involved. Third, it must conduct enhanced ongoing monitoring of the relationship.

On senior sign-off, the FCA guidance sets a floor: for these purposes senior management is, as a minimum, the person holding the Money Laundering Reporting Officer role, mapped to SMF17 under the Senior Managers regime. In higher risk cases the firm should look to the person with prescribed responsibility for countering financial crime. Importantly, in lower risk situations sign-off may be at a lower level of seniority, provided that person has sufficient authority and the decision is documented.

Source of wealth and source of funds checks should be proportionate. Adequate measures vary according to the assessed risk, with greater effort required for unusual or unexpected transactions, and lighter reliance acceptable for lower risk products or relationships. The FCA's review found little evidence of firms routinely applying excessive checks, but some PEP customers reported requests they considered disproportionate, which is why calibrating the depth of enquiry to the assessed risk matters.

How to run PEP screening in practice

Screening is only the entry point. An effective process links identification to a proportionate risk assessment, the right approvals, and monitoring that keeps the picture current. The FCA does not require firms to use commercial PEP databases, but where a firm chooses to, it must understand how the lists are populated and ensure that flagged individuals genuinely fall within the definitions in the Regulations. False positives, especially for common names, need a clear resolution path so that legitimate customers are not delayed.

The steps below describe a defensible screening and management cycle. Each stage should generate a documented rationale, because the FCA's review criticised firms that could not evidence a clear narrative for their risk decisions. A structured platform can help firms capture that audit trail without adding friction for lower risk customers. Firms can explore how this fits together within a single control environment through Nasara Connect Control.

Ongoing monitoring, declassification and the 12-month rule

PEP status is not permanent. When an individual ceases to hold a prominent public function, regulation 35 requires that they continue to be subject to risk-based enhanced due diligence for a period of at least 12 months after the date they ceased to hold that office. Firms may apply enhanced measures for longer, but the FCA considers this will generally only be necessary where the individual has been assessed as posing a higher risk. After the minimum period, and where the risk no longer warrants it, the person should be declassified.

The FCA has declined to introduce fixed, mechanical declassification periods beyond the statutory minimum. Instead, its guidance points firms towards trigger events, such as planned elections, that help them keep PEP status under review. Where a firm chooses to continue treating someone as a PEP after they are no longer one, in line with the flexibility the Regulations allow, it must clearly document the rationale.

The position differs for relatives. FG25/3 confirms that the 12-month rule does not apply to family members, who should be treated as ordinary customers subject to standard customer due diligence from the point the PEP leaves office. This is a common source of over-screening: continuing to flag a former PEP's family as high risk once the connection has ended is not what the Regulations require. The FCA's 2024 review found that five of fifteen firms lacked suitable procedures to review PEP status after individuals left office, so timely declassification is a genuine weak spot across the market.

Governance, records and the cost of getting it wrong

PEP management is as much a governance question as a screening one. The MLRO is expected to oversee how onboarding and ongoing monitoring controls operate, and staff who onboard customers should be trained on when and how to seek approval. Policies that import a definition wider than the Regulations, which the FCA found in seven of fifteen firms, tend to sweep in people who should not be treated as PEPs at all, generating unnecessary work and customer friction.

Documentation is the thread running through every requirement. The risk rating, the reason for the enhanced due diligence applied, the source of wealth conclusions, the approval, and any decision to retain or remove PEP status all need a clear, contemporaneous record. Firms that could not evidence their reasoning drew specific criticism in the FCA's review. A well-designed process makes this the natural by-product of the workflow rather than an afterthought.

Finally, proportionality protects the firm on both fronts. The Financial Ombudsman Service will consider complaints from PEPs, their family members or close associates, and will take the FCA guidance into account when deciding what is fair and reasonable. Treating domestic PEPs as lower risk, calibrating information requests to the assessed risk, and declassifying promptly reduces both regulatory and complaint exposure. Firms weighing how to operationalise this can review options at Nasara Connect pricing.

Conclusion

PEP screening and management is not about treating every public figure as suspect. It is about identifying the people the Regulations bring into scope, applying enhanced due diligence proportionate to the risk each one actually presents, and keeping that assessment current. The core obligations are settled: identify PEPs, their family members and known close associates; obtain senior management approval; establish source of wealth and funds; and carry out enhanced ongoing monitoring. The refinements matter just as much, particularly the expectation that UK PEPs are generally lower risk and the requirement to keep treating a former PEP as such for at least 12 months on a risk-sensitive basis.

The firms that handle this well share a common trait: their decisions are proportionate and their reasoning is documented. That is what satisfies the FCA, protects legitimate customers from unfair treatment, and gives the firm a defensible position if a decision is ever challenged. Build the process around the definitions in regulation 35, follow the FCA's finalised guidance, and make declassification a scheduled discipline rather than a forgotten step, and PEP management becomes a controlled, evidence-led part of your wider financial crime framework.

Frequently asked questions