Section 01
Real-world case studies: lessons from failure
The most powerful way to understand what PEP compliance requires is to study where it has gone wrong. These cases, drawn from enforcement actions, regulatory findings, and publicly documented financial crime, illustrate the real consequences of PEP compliance failures.
Raiffeisen Bank International came under sustained regulatory pressure following Russia's invasion of Ukraine in 2022, as one of the largest Western banks still operating in Russia. The ECB pushed the bank to substantially reduce its Russian business. Separately, Austria's FMA brought an administrative proceeding concerning correspondent-banking know-your-customer due diligence, RBI had not, in the FMA's view, sufficiently satisfied itself that two correspondent banks maintained appropriate due diligence procedures, resulting in a €2.07 million fine in June 2024. The FMA explicitly stated this finding did not establish that money laundering or another crime had occurred.
Neither the ECB pressure nor the FMA proceeding is a documented finding of PEP-specific EDD failure. No named enforcement decision establishes the PEP-control weaknesses below as proven facts about Raiffeisen; they are presented as illustrative risk factors a bank in this position would need to manage, not as an established PEP enforcement case.
Illustrative risk factors in this scenario
- PEP EDD would need to be especially robust for Russian state officials and oligarchs given the pace of designations
- Processes for identifying when an existing customer becomes sanctioned need to keep pace with rapidly expanding lists
- Source of wealth scrutiny matters most for PEP customers with government or state-enterprise connections
- Adverse media monitoring is a key early-warning control ahead of a formal sanctions designation
Lesson: PEP EDD should anticipate the possibility of future sanctions designation. Robust SoW scrutiny at onboarding, and continuous adverse media monitoring, are the controls most likely to identify risk before a formal designation occurs, this is a general lesson from the wider Russia-exposure episode, not a finding specific to Raiffeisen.
The Danske Bank Estonia scandal is one of the largest money laundering cases in European history. Between 2007 and 2015, approximately €200 billion flowed through Danske Bank's Estonian branch via its non-resident customer portfolio, many transactions linked to Russia and former Soviet states. Danske Bank's own investigation found the portfolio was overwhelmingly high-risk and inadequately controlled, but stated it could not reliably estimate what proportion of that total flow was actually suspicious.
A significant proportion of the customers involved were PEPs, RCAs of PEPs, or companies connected to Russian and Ukrainian political figures. The bank's PEP identification and EDD processes were fundamentally inadequate, and the Estonia branch operated with minimal oversight from Copenhagen.
PEP-specific failures
- PEP screening not applied systematically to the Estonia branch customer base
- Beneficial ownership not adequately investigated: shell companies used by PEPs not identified
- Source of wealth not established for customers with obvious public sector connections
- No meaningful adverse media monitoring: documented corruption involvement of customers ignored
- Internal whistleblower warnings about PEP-connected customers dismissed
Lesson: PEP compliance cannot be a head office exercise applied inconsistently to branches. Firms with international operations must ensure consistent PEP identification and EDD standards across all entities, and must act on internal warnings about PEP-connected customers.
Standard Chartered was fined £102.2 million by the FCA in 2019 for AML failures including inadequate treatment of PEP customers. The FCA found that the bank had failed to apply adequate enhanced due diligence to a number of customers who were PEPs or connected to PEPs, concentrated in its UK wholesale correspondent banking business and its UAE branches, not private banking.
PEP-specific failures
- PEP status not identified for customers meeting the definition
- EDD not applied where PEP status was identified
- Source of wealth not established or not adequately documented
- Senior management approval not obtained for some PEP relationships
- Ongoing monitoring not enhanced for known PEP customers
Lesson: The FCA's enforcement approach to PEP failures focuses on the completeness of the EDD file, not just whether EDD was "done." Firms must be able to demonstrate, through documented evidence, that each of Regulation 35(5)'s three statutory measures, senior management approval, source of wealth/funds measures, and enhanced ongoing monitoring, was actually applied and is current.
Section 02
FCA enforcement patterns: what triggers action
Analysis of FCA enforcement actions involving PEP compliance failures reveals consistent patterns. Understanding these patterns helps firms prioritise their compliance investment.
Five common PEP enforcement triggers we see across published Final Notices
This is FinCrimeRadar's own synthesis of recurring patterns across published enforcement cases, not an FCA-named list of official triggers.
- No EDD file at all: PEP identified but no enhanced measures applied and no documentation of why not. This is the most basic failure and the hardest to defend.
- Inadequate SoW: EDD conducted but source of wealth not genuinely established. Accepting general statements ("successful businessman") without documentary evidence.
- Stale EDD: EDD completed at onboarding but not refreshed. A five-year-old EDD file for a PEP who has changed role, accumulated new wealth, or whose risk profile has changed significantly.
- Missing senior management approval: EDD conducted but approval not obtained or not documented. Verbal approvals without file notes are a common gap.
- Inadequate ongoing monitoring: PEP flagged but monitoring not enhanced. Standard transaction monitoring rules applied without adjustment for PEP risk.
💡
A useful file review test, our own heuristic
A practical self-check we recommend, not a quoted FCA test: "Could I, reading this file, form a clear picture of who this customer is, where their wealth comes from, why we accepted this relationship, and what monitoring is in place?" If the answer is no, if the file is incomplete, inconsistent, or generic, enforcement risk is high. Good PEP compliance is as much about documentation quality as about the substance of the checks performed.
Section 03
Building an effective PEP screening programme
An effective PEP screening programme is more than a database subscription and a policy document. It is an integrated set of people, processes, systems, and governance that together ensure PEPs are identified, assessed, and managed appropriately throughout the customer lifecycle.
1
PEP policy
Written policy covering definition, categories, domestic vs foreign distinction, RCAs, EDD requirements, approval levels, and monitoring standards.
2
Screening technology
PEP database subscription (or free tools like FinCrimeRadar for learning). Automated screening at onboarding and ongoing. Alert management workflow.
3
EDD process
Documented SoF and SoW collection process. Questionnaire templates. Evidence standards. Escalation pathways. Senior management approval workflow.
4
Monitoring framework
Enhanced TM rules for PEP accounts. Adverse media monitoring schedule. Periodic review triggers. Sanctions rescreening frequency.
5
Governance & MI
Portfolio-level oversight by the MLRO or another senior function the firm's governance designates. Board/senior management reporting on PEP portfolio. Periodic review of PEP policy against regulatory developments.
6
Staff training
PEP-specific training for onboarding, relationship management, and compliance teams. Updated training following FG25/3 and future regulatory changes.
✅
Good practice: annual PEP programme review
Best practice firms conduct an annual review of their PEP programme against regulatory developments, enforcement trends, and the firm's own PEP portfolio composition. The July 2025 FG25/3 guidance should have triggered a review of domestic PEP policies and approval processes across the industry. Firms that haven't updated their PEP framework to reflect FG25/3 are operating on outdated guidance.
Interactive tool
The complete PEP EDD checklist
Use this interactive checklist to ensure your PEP EDD is complete. Tick each item as it is completed and documented in the customer file. The checklist's sections map to MLR 2017 Regulation 35(5)'s three statutory measures, senior management approval, source of wealth/funds measures, and enhanced ongoing monitoring, plus the Regulation 35(1) identification duty and general documentation practice; the specific evidence types and sub-items within each section are recommended good practice for satisfying those measures, not independently mandated line items in their own right.
🔍 PEP Identification
Customer screened against PEP database at onboarding
PEP status confirmed: category identified (head of state / minister / judiciary / military / SOE / international org)
Domestic vs foreign PEP determination made and documented
RCA screening conducted: family members and known close associates identified
PEP risk rating assigned (High / Medium / Lower) with documented rationale
💰 Source of Funds
Source of funds for the specific transaction/relationship established
Documentary evidence obtained and verified (bank statement, completion statement, payslip, etc.)
SoF is consistent with the customer's known profile and the nature of the relationship
🏦 Source of Wealth
Source of wealth established: full career/business history documented
SoW documentary evidence obtained (tax returns, company accounts, property records, inheritance documentation)
SoW tested for consistency with official salary history and publicly available information
Any inconsistencies between declared SoW and known information investigated and resolved
👔 Senior Management Approval
Senior management approval obtained before relationship commenced (or as soon as practicable for existing customers)
Approver's seniority is appropriate to the risk level of the PEP
Approval documented in writing with date and rationale (not a rubber stamp)
Portfolio-level oversight confirmed by the MLRO or the firm's designated senior function (individual case-by-case MLRO approval is not required under FG25/3 for domestic PEPs where risk factors don't warrant it)
📡 Ongoing Monitoring
Transaction monitoring rules enhanced for PEP account: lower thresholds, additional rules
Adverse media monitoring scheduled: frequency set by the firm's own risk-based assessment, not a fixed regulatory minimum
Sanctions rescreening frequency set according to the firm's risk-based assessment, MLR 2017 requires ongoing monitoring but does not itself prescribe a rescreening cadence
Periodic EDD review scheduled: annually for most PEPs, more frequently for high-risk
Periodic senior management review of relationship continuance documented, at a frequency the firm's own risk assessment supports
📋 Documentation & Record Keeping
Complete EDD file maintained: all evidence, decisions, and approvals documented
File would satisfy FCA "file review test": clear picture of who, what, why, and how monitored
Record retention set for 5 years from end of relationship
FAQ
Frequently asked questions
How do I handle a PEP who is also on a sanctions list? +
If a PEP is also on a sanctions list, the sanctions obligation takes precedence and is immediate: you must freeze assets, refuse transactions where required, and report to OFSI as soon as practicable, there is no fixed statutory reporting deadline. Not every appearance on the UK Sanctions List necessarily triggers an asset freeze, the list also records other designation types, and some transactions may fall within an applicable exception or licence, so confirm the specific prohibition against the actual designation and any available licence before acting. The PEP EDD obligations continue to apply alongside the sanctions obligations, but the sanctions measures are non-discretionary. If the customer was previously known as a PEP and has now been sanctioned, you should review your PEP EDD file to assess whether signs of the eventual designation were present earlier and whether a SAR should have been filed sooner.
Our PEP customer has now left office: what changes? +
For the first 12 months after leaving office, treat the individual the same as an active PEP: full EDD applies. Under Regulation 35(9)(b) and FG25/3, firms must document their reasoning specifically when continuing EDD measures beyond that 12-month minimum; FG25/3 doesn't state an equivalent specific requirement for documenting a decision to end those measures once past that point, though its broader expectations concerning documented PEP risk assessments and EDD decisions still apply either way. Factors to consider: the nature of the role held, the jurisdiction, the level of corruption risk, whether the individual remains publicly active, and any adverse media since leaving office. A bare note that "12 months have passed" is insufficient, either continuing or ending measures should reflect an actual risk-based assessment.
What technology do firms typically use for PEP screening? +
Commercial PEP screening solutions include World-Check (Refinitiv/LSEG), Dow Jones Risk & Compliance, LexisNexis Bridger Insight, ComplyAdvantage, and Acuris Risk Intelligence. These provide regularly updated, comprehensive PEP databases with fuzzy name matching and integration capabilities. For educational purposes and smaller firms, open-source solutions like FinCrimeRadar provide access to PEP data from OpenSanctions. Neither the MLRs nor FG25/3 mandates use of a commercial PEP database specifically, and FATF's own PEP guidance is explicit that a commercial database alone is not sufficient for Recommendation 12 compliance and that FATF does not require their use. The FCA expects firms to use screening solutions that are effective and proportionate to the size, complexity, and risk profile of their business, a documented audit trail matters more than which specific product generates it.
Can we accept a PEP from a country on the FATF blacklist? +
There is no absolute prohibition on accepting PEPs from any jurisdiction, but the risk management burden is very high. Since S.I. 2026/621 took effect on 30 June 2026, mandatory country-based EDD under Regulation 33 is tied to FATF "Call for Action" (blacklist) countries; grey-list status remains a geographical risk factor to weigh rather than an automatic EDD trigger. For a PEP from a FATF blacklist country, EDD is mandatory under Regulation 33 and should be robust, calibrated to the specific relationship and risk, intensive source-of-wealth scrutiny, enhanced monitoring, and senior-level approval are all realistic components, though the precise measures applied depend on the firm's own risk assessment rather than being fixed additional requirements imposed on every case. Many firms' risk appetites do not extend to accepting PEPs from FATF blacklist countries, and there is no regulatory obligation to accept such relationships.
✓ Series complete
You've completed the PEP Screening Handbook
You now have a comprehensive understanding of PEP identification, EDD obligations, real-world case studies, and how to build an effective PEP screening programme.