FATF's guidance on politically exposed persons records an uncomfortable finding. Drawing on corruption case typologies and supervisory reports, it notes that in many cases the institution knew, within at least a year of the relationship starting, that it was dealing with a PEP, yet failed to apply the appropriate risk classification and controls.
That is a failure of follow-through, not of the name search. The name search is the part of PEP screening most programmes get right. The misses sit around it: in who gets screened, who surrounds the PEP, when status is checked, how names travel between scripts and where the risk assessment starts.
This article covers five of those gaps. Each is framed as a question a programme operator can put to its own process, because the decisions belong to the operator and not to the screening tool. It does not restate who counts as a PEP or what FATF Recommendation 12 requires. Our guide to politically exposed persons covers definitions, categories and obligations. Here the focus is practice.
A PEP is often not the customer. FATF's guidance says the PEP can be the customer or the beneficial owner of a legal entity that is the client, and that corrupt PEPs often use legal entities to distance themselves from transactions. Intermediaries such as lawyers, real estate and escrow agents and bankers have also been used to access the financial system on a PEP's behalf and to conceal who controls the assets.
A programme that screens only the contracting entity and its named directors returns a clean result on a structure where the PEP sits two layers up, or where an introducer acts for the PEP. FATF expects customer due diligence to identify the beneficial owner and take reasonable measures to verify that person's identity, and expects the PEP requirements to apply where a customer or beneficial owner is a PEP or someone acts on a PEP's behalf. Where a person purports to act for a beneficial owner, FATF describes asking why as best practice, because the answer can reveal who the beneficial owner is.
The gap has a second edge, which the UK regulator has spelled out. The FCA's finalised guidance FG25/3, published on 7 July 2025, says a legal entity should not be treated as a PEP simply because a PEP is among its beneficial owners. The entity is treated as a PEP only where the firm is satisfied that the PEP exercises significant control, and the other owners are not automatically close associates. Screening the ownership layers is half of the work. Judging control is the other half, and it is a judgement for the programme operator, not a result a system returns.
Establishing who owns and controls a customer, through beneficial ownership records and business verification, comes before any PEP list is run. In markets where corporate registries are fragmented or not digitised, this is also the stage where screening depends most on research rather than a database lookup.
PEP lists name the PEP. They seldom name the people around them. FATF notes that family members and close associates might never be listed, but must still be treated as PEPs.
Scope compounds the problem. FATF does not define either term, because the answer depends on the social and cultural structure of the PEP's country. In some societies the relevant family circle is limited to parents, siblings, partners and children. In others it extends to grandparents, grandchildren, cousins or wider clan links, and FATF observes that ethno-cultural ties such as tribe, clan, caste or sect can fit the description of both family and close associates. Its examples of close associates include partners outside the family unit, prominent members of the same political party or union, and business partners, especially those who share beneficial ownership of a legal entity with the PEP or sit with them on a company board.
Regimes then draw the line in different places. The FCA lists a spouse or civil partner, children and their spouses, parents and, in its view, siblings as family members, treats a wider circle as a risk-based call, and says the family of a former PEP should be treated as ordinary customers from the point the PEP leaves office. FATF ties the period for which relatives are treated as PEPs to the assessment of the PEP's own risk. A programme serving customers in more than one jurisdiction needs a written position on which definition it applies, where, and why.
Three practical gaps follow. The first is list dependence: a programme that relies on list matching alone cannot find a relative who is on no list. FATF treats the customer as the key source of information and says self-declaration alone is not enough, so businesses are expected to engage with customers and draw out information on each element of the PEP definition. The second is the missing look-back: when a PEP is identified, FATF expects the institution to search its own records for known family members and close associates it may already serve, and to classify them accordingly. The third is the unwritten definition. Without a documented view of who counts as a family member or close associate, two analysts will answer the same case differently.
A customer who was not a PEP at onboarding can become one, and a PEP can stop being one. Both changes need an owner.
FATF says existing clients sometimes become PEPs after the relationship begins, so non-PEP accounts need monitoring for changes in PEP status, customer profile and account activity, based on risk. It adds that institutions should periodically monitor their existing client base against changes in the PEP universe and not only at onboarding. The FCA's guidance offers a practical trigger: planned elections, whose outcomes are public, can prompt a status review, and firms can ask customers to tell them when their circumstances change.
The reverse change is a judgement. FATF sets no expiry on PEP status and says the handling of a former PEP should rest on an assessment of risk, not on prescribed time limits. Some regimes set a floor. UK rules require risk-based enhanced due diligence to continue for at least 12 months after a PEP leaves office, and the FCA says a firm that wants to continue beyond that period must document its rationale. The mechanics of declassification are covered elsewhere. The operational gap is the trail. A programme without dated reviews cannot show why a status was kept or removed.
Three questions test this gap. Which events trigger a status review: an election, a cabinet change, a change in the customer's declared occupation, adverse media? Who owns the review? Where is the outcome recorded? How often the whole customer book is re-screened is a risk-based decision for the operator, as FATF fixes no frequency. This is the territory of ongoing monitoring.
A name search is only as good as the identifiers behind it. FATF warns that inconsistent transliterations and spellings affect the ability to match names, that screening a customer base against a commercial database can produce many false positives where identifier information is thin, and that the same weakness increases the risk of missing true matches.
For programmes working with MEA markets, the problem is structural. An Arabic name can appear in Latin script in several accepted spellings across passports, registry extracts and press coverage, and documents from French-speaking North Africa add a further rendering. The table below shows how one family name can be written four ways in four documents.
Vendor definitions are a second source of error. FATF notes that the definition of a PEP used by a database provider may not align with the definition in a particular country, and that a subscribing institution may not fully understand the parameters used to build the database or the categories it leaves out. The FCA makes the same point from the user's side: a firm that chooses a commercial database must understand how it is populated and make sure the people it flags fall within the regulatory definition.
A match is also the start of a decision, not the end of one. PEP sanction screening often runs through the same matching engine, so name-matching quality is shared, but a hit means something different in each case. We explain why a match is not a classification in PEP Exposure vs. Sanctions Match.
Questions for the programme: which identifiers does intake capture beyond the name, such as date of birth, nationality and role; how are variant spellings handled; and does the vendor's PEP definition match the one the programme is bound by? Local knowledge of how names and records are written in each market is often what resolves a match, and a larger database does not replace it.
There is no single global default for domestic PEPs, and a programme that carries one jurisdiction's default into another creates a gap.
FATF's guidance says countries should not assume that the risk of domestic PEPs is always lower than that of foreign PEPs, and notes that in some jurisdictions the risk can equal that of foreign PEPs. It adds that institutions operating in domestic markets with known corruption issues should consider whether their exposure to domestic PEPs is higher than their exposure to foreign ones.
Some national regimes set a different starting point. In the UK, Regulation 35(3A) of the Money Laundering Regulations 2017 makes a lower level of risk the starting point for a UK domestic PEP, and for their family members and known close associates, unless other risk factors are present. The FCA applied that in FG25/3. The DFSA's rulebook for firms in the Dubai International Financial Centre takes another route: PEP status does not automatically mean a customer must be assessed as high risk, each PEP's circumstances need assessing, and a foreign PEP generally presents a higher risk.
These positions sit together only if a programme applies the one that binds it, where it binds. The gap opens when a group policy carries a UK-style default into a market where it is not the rule, or treats every domestic PEP as high risk where the local regime asks for an assessment. Neither is a risk finding. Both are borrowed starting points.
Whatever the starting point, the risk factors give a programme something to test it against. FATF points to the PEP's seniority, access to or control over public funds, involvement in public procurement, conflicts between business interests and public functions, and a public function in sectors known to be exposed to corruption, such as oil and gas, mining, construction, defence and gaming. The FCA's higher-risk indicators add influence over the allocation of licences and concessions.
Identification is not the aim. FATF warns against a box-ticking approach to PEPs and puts the weight on how the risk of higher-risk PEPs is handled. A programme that has closed the five gaps above can answer seven questions on paper:
The answers belong to the programme operator. What informs them is evidence: ownership records, local-language media and the review that turns a hit into something a supervisor can follow. That regional evidence layer is where Cedar Rose focuses its compliance and AML screening, including PEP screening, for programmes working with MEA markets.