FATF's own guidance on politically exposed persons makes a point that gets lost in most vendor marketing for automated screening tools. External sources of information for determining PEPs, including commercial and other databases, are not sufficient to comply with PEP requirements on their own, and FATF does not require their use as a substitute for that compliance. That is the standard-setting body on money laundering and terrorist financing saying, plainly, that a database match is not the same thing as a compliance determination.
This distinction sits at the centre of a specific automation problem in compliance screening. A politically exposed person flag and a sanctions list match both arrive at a compliance officer's desk the same way: a name matched against a reference list. What each finding means, and what response it legally requires are entirely different questions, and an automated system that treats them identically is solving the wrong problem well.
The stakes for getting this wrong run in both directions. Treating every PEP flag with the same urgency as a sanctions match creates unnecessary friction for legitimate customers and burns compliance capacity that should go toward genuine risk. Treating a sanctions match as just another PEP-style risk factor to weigh, rather than a legal prohibition to act on immediately, is the more serious error, and it is precisely the one a screening programme should make structurally hard to commit.
Two different findings that look identical to a matching engine
A PEP designation identifies someone who holds, or has held, a prominent public function, a status that carries elevated risk of exposure to bribery or corruption, not an accusation of wrongdoing. FATF's guidance on Recommendations 12 and 22 sets out additional due diligence measures institutions must apply to PEPs, their family members, and close associates, calibrated to a risk-based assessment rather than a fixed response. Enhanced due diligence, senior management approval, and ongoing monitoring are typical requirements. A block on the relationship is not.
A sanctions match sits in a different category entirely. It identifies a name appearing on a list such as OFAC's Specially Designated Nationals list, and dealing with that person or entity may be legally prohibited. Sanctions compliance in the US operates on a strict liability standard, meaning intent isn't a required element of a violation. The 2022 enforcement action against MidFirst Bank shows the consequence plainly: the bank processed payments for individuals newly added to the SDN list, and the violation stood regardless of the bank's belief that its screening covered the gap.
Both findings can be produced by the exact same automated screening pass, a name matched against a reference list. Nothing in that output format distinguishes a status that calls for enhanced due diligence from a prohibition that calls for an immediate freeze.
Consider how the same underlying finding, a name match, plays out under each response. A PEP flag on a prospective customer typically triggers a documented risk assessment: source of wealth checks, senior management sign-off, and a decision about whether to proceed with enhanced monitoring in place. The relationship can, and often does, continue. A sanctions match on the same customer triggers a fundamentally different sequence: funds get frozen, the match gets reported to the relevant authority, and the relationship doesn't continue pending that authority's guidance. An automated alert that reads simply "name match, 94 percent confidence" gives a reviewer no signal about which of these two sequences applies, and a reviewer working through a high alert volume under time pressure is exactly the person a poorly differentiated alert puts at risk of choosing wrong.
The strict liability standard attached to sanctions is worth sitting with, because it changes the calculus for how a screening programme should be designed. Under a risk-based approach to PEP due diligence, a reasonable but ultimately mistaken judgement call about someone's political exposure is defensible if the reasoning was documented and the process was followed. Under strict liability, a sanctions violation stands even where the institution believed its screening was adequate, as the MidFirst case shows. That asymmetry argues for treating a possible sanctions match with a lower tolerance for delay than a possible PEP flag, even though both can look identical the moment they surface.
Why an automated system can surface the match but not the classification
Fuzzy matching and entity resolution have improved considerably at catching that a name on a corporate filing corresponds to a name on a reference list, even across transliteration variants and formatting differences. That capability answers a narrower question than compliance teams sometimes assume it does. It confirms a name match. It doesn't confirm which category of finding that match represents, or what obligation follows from it.
FATF's guidance is explicit that the classification step requires judgement a database lookup doesn't supply. Determining whether an individual's specific role meets the threshold for PEP status in a given jurisdiction, assessing whether a family member or close associate relationship applies, and deciding what level of enhanced due diligence a specific risk profile warrants are all judgement calls FATF places with the reporting institution, not the screening tool. The same holds in reverse for sanctions: confirming a match against the SDN list is a lookup, but working out which of the many overlapping, jurisdiction-specific sanctions regimes applies, and what exception or licence might change the answer, isn't something a matching engine resolves on its own.
The close associate category illustrates the gap particularly well. FATF leaves the definition deliberately open, citing business partners, members of the same political organisation, and others connected to a PEP through relationships that rarely appear in structured data at all. A screening tool can match a name it's been given. It can't independently discover that an unlisted business partner shares beneficial ownership with a known PEP through a chain of holding companies, exactly the kind of relationship that turns a clean-looking name search into a missed PEP association. That discovery work sits closer to investigation than screening, and it's where automated matching hands off to a human process almost by definition.
What this means for screening programme design
The practical implication is that a compliance screening programme needs a documented classification step between the automated match and the response, not just a faster matching engine. That step should specify how a PEP determination gets made once a name match surfaces, who has authority to confirm or dismiss it, and how that decision gets recorded for examination purposes. It should do the same, separately, for sanctions matches, given the strict liability standard attached to getting that one wrong. Folding both into one undifferentiated review queue tends to produce exactly the confusion this article opened with, treating a status assessment and a legal prohibition as steps on the same checklist rather than genuinely different obligations.
Jurisdiction matters more here than a single global screening policy tends to account for. PEP thresholds, family member definitions, and enhanced due diligence expectations vary by country, consistent with FATF's own guidance that each jurisdiction defines aspects of PEP status according to its own administrative and cultural context. Across the Middle East and Africa specifically, that variation sits on top of the registry fragmentation and layered ownership structures common to the region, meaning a name match is frequently just the first step in establishing who is actually connected to the entity being screened, not the last one. Cedar Rose's compliance and AML screening service is built around that distinction directly, and cases requiring deeper political association analysis route into investigative due diligence rather than being resolved inside the automated screening pass alone.
Documentation matters as much as the classification decision itself. A compliance file showing that a PEP flag was reviewed, by whom, against what criteria, and with what outcome holds up in an examination in a way a bare "cleared" status doesn't. The same applies with more force on the sanctions side, given that a regulator assessing a strict liability violation looks for evidence of a functioning process, not just a favourable outcome. Programmes that log the classification reasoning as routine practice, rather than only when a reviewer happens to add a note, tend to hold up better under scrutiny than ones treating the screening system's alert log as sufficient records on its own.
Documentation matters as much as the classification decision itself. A compliance file showing that a PEP flag was reviewed, by whom, against what criteria, and with what outcome is defensible in an examination in a way that a bare "cleared" status is not. The same applies with more force on the sanctions side, given that a regulator assessing a strict liability violation will look for evidence of a functioning process, not just a favourable outcome. Programmes that log the classification reasoning as a matter of course, rather than only when a reviewer happens to add a note, tend to hold up better under scrutiny than programmes that treat the screening system's alert log as sufficient records on its own.
None of this argues against automation in screening. Catching the name match at scale, continuously, and across name variants is precisely the problem automated screening solves well, and manually screening a large customer base against sanctions lists that update in real time is not a realistic alternative. The argument is that the match is the beginning of the compliance process, not the end of it, and a programme that treats a flagged name as a finished determination is building exactly the gap FATF's own guidance warns against. Cedar Rose's white paper, Faster Verification, Same Decision: AI and the Future of KYB in MEA, makes the same argument for business verification more broadly: automation changes how fast a finding surfaces, not who is accountable for what it means.
Conclusion
FATF's own guidance settles the question this article opened with. A database match, however fast or accurate the matching engine behind it, is not sufficient on its own to meet PEP compliance requirements, and the same logic extends naturally to sanctions matches given the strict liability standard attached to getting that classification wrong. Automated screening should be trusted to do what it does well: catching a name match at scale, continuously, across variants a manual process would struggle to track. The classification that follows- PEP or sanctions, what response it requires, and who is accountable for that decision, belongs with a documented, jurisdiction-aware review process, not with the matching engine itself. Cedar Rose's approach to compliance AML screening across the Middle East and Africa is built around that same separation, pairing automated matching with regional expertise for exactly the classification step a database cannot resolve alone. For related reading on where AML programmes tend to fall short in practice, see Cedar Rose's earlier posts on complying with the UAE's AML framework and the role of AI and automation in AML checks.
Sources & References:
Financial Action Task Force, FATF Guidance: Politically Exposed Persons (Recommendations 12 and 22). https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Peps-r12-r22.html
U.S. Department of the Treasury, Office of Foreign Assets Control, Finding of Violation to MidFirst Bank (2022). https://ofac.treasury.gov/recent-actions/20220721
Faster Verification, Same Decision AI and the Future of KYB in MEA. https://www.cedar-rose.com/insights/faster-verification-same-decision-ai-and-the-future-of-kyb-in-mea
.png?width=352&name=website%20img%20(1).png)