Managing PEPs in 2026: Why Politically Exposed Person Frameworks Need a Strategic Overhaul

Politically exposed persons have been a cornerstone of anti-money laundering frameworks since FATF first formalised the concept. The logic is sound: individuals who hold or have held prominent public positions, along with their family members and close associates, present elevated risks of corruption, bribery, and the laundering of illicit wealth. Yet two decades into the PEP compliance era, financial institutions continue to struggle with the practical challenges of identifying, risk-assessing, and monitoring PEP relationships effectively.

The problem is not a lack of data. PEP screening databases have grown exponentially, now containing millions of records. The challenge lies in the gap between screening and genuine risk understanding. Many institutions screen for PEP status as a binary classification — PEP or not PEP — without the contextual analysis needed to differentiate between a low-level municipal official in a well-governed jurisdiction and a senior government minister in a country with endemic corruption. This one-size-fits-all approach generates excessive false positives, overwhelms compliance teams, and paradoxically reduces the quality of risk management.

The regulatory landscape is evolving, and institutions that do not modernise their PEP frameworks risk both enforcement action for under-management and commercial damage from over-compliance that drives away legitimate customers.

Regulatory, Enforcement, and Market Context

The EU's Anti-Money Laundering Regulation, which came into force in 2025, introduced significant changes to PEP management requirements. For the first time, the regulation establishes a harmonised EU-wide list of PEP functions, reducing ambiguity about who qualifies. It also codifies the requirement for risk-based rather than blanket enhanced due diligence, explicitly criticising the practice of applying identical measures to all PEPs regardless of risk profile. The UK's FCA has similarly emphasised that PEP de-risking — refusing to bank PEPs rather than managing the risk — is not an acceptable approach.

Enforcement continues to demonstrate the consequences of getting PEP management wrong. The Luanda Leaks investigation, the 1MDB scandal, and ongoing cases involving kleptocratic wealth flowing through European and North American banking systems all centred on PEP relationships that were either inadequately screened, poorly risk-assessed, or insufficiently monitored. Transparency International's analysis of major corruption cases consistently identifies failures in PEP due diligence as a critical enabler of grand corruption.

What the Data Is Showing

Industry data reveals the scale of the operational challenge. A 2025 survey by LexisNexis Risk Solutions found that the average Tier 1 bank maintains over 47,000 active PEP relationships, with annual screening and monitoring costs exceeding USD 85 million. False positive rates on PEP screening remain stubbornly high, with some institutions reporting that over 90% of initial PEP screening alerts are resolved as false matches or low-risk true matches that require no enhanced action. This represents an enormous and largely unproductive consumption of compliance resources.

Conversely, the Stolen Asset Recovery Initiative at the World Bank estimates that over USD 40 billion in corruption-related assets have been frozen or recovered globally since 2010, with the majority linked to PEPs whose financial activities should have been subject to enhanced scrutiny. The gap between the volume of screening activity and the quality of outcomes suggests that current approaches are both over-engineered in their breadth and under-developed in their analytical depth.

Implications for Financial Institutions

Institutions must move toward genuinely risk-based PEP management frameworks that differentiate based on the nature of the public function, the corruption risk profile of the jurisdiction, the source of wealth, and the complexity of the relationship structure. This requires investment in contextual risk scoring that goes beyond binary PEP classification to produce nuanced risk assessments capable of directing enhanced due diligence resources toward the highest-risk relationships.

Ongoing monitoring of PEP relationships must also be enhanced. Annual reviews of static documentation are insufficient. Institutions should implement event-driven monitoring that triggers reassessment when material changes occur — changes in political status, adverse media, sanctions designations, or significant changes in transaction patterns. The integration of open-source intelligence and adverse media monitoring with transaction monitoring creates a more dynamic and responsive PEP risk management capability.

Conclusion

PEP management is at a crossroads. The regulatory direction is clear: risk-based, proportionate, and effective. Institutions that continue to rely on broad-brush screening and blanket enhanced due diligence will face both regulatory criticism and commercial disadvantage. Those that invest in contextual risk assessment, dynamic monitoring, and intelligent resource allocation will achieve better compliance outcomes while maintaining the ability to serve legitimate PEP customers.

Suggested Next Steps

• Redesign your PEP risk scoring methodology to incorporate jurisdictional corruption indices, function-specific risk weightings, and source of wealth complexity.

• Implement event-driven PEP monitoring that triggers reassessment based on political status changes, adverse media, and material transaction pattern shifts.

• Benchmark your false positive rates on PEP screening and set reduction targets through improved matching algorithms and contextual filtering.

• Review your PEP governance framework to ensure senior management sign-off processes are proportionate and that de-risking decisions are documented and justified.

Sources: FATF, EU AMLR, FCA, Transparency International, LexisNexis Risk Solutions, World Bank StAR Initiative, ACAMS

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai