PEPs and High-Risk Customers: Moving Beyond Checkbox Compliance to Genuine Risk Intelligence

Politically exposed persons have been a focal point of anti-money laundering frameworks since FATF first codified the concept over two decades ago. Yet PEP management remains one of the most problematic areas of compliance practice. Institutions oscillate between two failure modes: over-screening that generates unmanageable volumes of false positives and de-risks legitimate customers, and under-screening that fails to identify genuinely high-risk political connections and the proceeds of corruption.

The root cause is a reliance on list-based screening as the primary — and often sole — mechanism for PEP risk identification. Commercial PEP databases capture a fraction of the individuals who should be classified as politically exposed, and the quality of data varies enormously between jurisdictions and providers. Meanwhile, the risk associated with PEPs is not static: an individual's risk profile changes with their position, their jurisdiction's governance environment, and the nature of their financial activity.

For compliance leaders seeking to build a defensible and effective PEP risk management framework, the path forward requires moving beyond list-matching toward a more dynamic, intelligence-driven approach that integrates screening with enhanced due diligence, source-of-wealth verification, and ongoing behavioural monitoring.

Regulatory, Enforcement, and Market Context

FATF's Recommendation 12 requires enhanced due diligence for PEPs, their family members, and close associates. The 2025 revision to the interpretive note clarifies that the risk-based approach applies to PEP management — not all PEPs present the same level of risk, and institutions are expected to differentiate their controls accordingly. However, this nuance is often lost in practice, where binary PEP/non-PEP classifications drive uniform, resource-intensive processes regardless of actual risk.

The EU's Sixth Anti-Money Laundering Directive and the new AML Regulation expand the definition of PEPs and strengthen the requirements for source-of-wealth and source-of-funds verification. The European Anti-Money Laundering Authority is expected to issue detailed technical standards on PEP risk assessment methodology, setting a new benchmark for institutions operating in the EU.

In Asia-Pacific, MAS and HKMA have both issued guidance emphasising that PEP screening must be supplemented with risk-proportionate enhanced due diligence. HKMA's supervisory reviews have found that many institutions conduct PEP screening at onboarding but fail to implement effective ongoing monitoring, missing situations where customers acquire political exposure after the relationship has been established.

What the Data Is Showing

Research by Transparency International's 2025 assessment of PEP risk management found that only 28% of financial institutions surveyed had implemented dynamic PEP risk scoring that adjusts based on changes in political exposure, jurisdictional risk, and customer behaviour. The majority rely on static screening against commercial databases, supplemented by periodic manual reviews — an approach that is both resource-intensive and prone to gaps.

Analysis by the Stolen Asset Recovery Initiative — a joint World Bank-UNODC programme — estimates that the proceeds of corruption by PEPs account for approximately $20–40 billion in cross-border illicit flows annually. The recovery rate for these assets remains below 5%, reflecting the challenges of tracing and repatriating funds that have been layered through complex corporate structures, trust arrangements, and real estate investments across multiple jurisdictions.

Implications for Financial Institutions

Financial institutions must evolve their PEP risk management from a screening exercise to a risk intelligence function. This means investing in data quality — ensuring PEP databases are supplemented with adverse media monitoring, corporate registry analysis, and open-source intelligence — and in analytical capability to assess the risk significance of political connections rather than simply flagging them.

Source-of-wealth verification is the critical differentiator between superficial and substantive PEP due diligence. Institutions must develop the capability to assess whether a PEP customer's financial profile is consistent with their known legitimate income and business activities. This requires skilled analysts, access to public records and financial databases, and a willingness to ask difficult questions.

Technology can play a significant role in improving PEP risk management efficiency. AI-powered entity resolution, network analysis, and natural language processing for adverse media screening can reduce false positives, identify hidden connections, and surface risk-relevant information that manual processes would miss. However, technology must augment — not replace — skilled human judgment.

Conclusion

Effective PEP risk management is a cornerstone of any credible anti-money laundering programme. It is also one of the most resource-intensive and analytically demanding areas of compliance. Institutions that invest in dynamic risk intelligence, robust source-of-wealth verification, and technology-enabled screening will not only meet regulatory expectations but will meaningfully contribute to the global fight against corruption and kleptocracy.

Suggested Next Steps

• Review your PEP screening framework against FATF's revised Recommendation 12 guidance, ensuring risk-based differentiation between PEP categories and risk levels.

• Invest in source-of-wealth verification capabilities, including access to corporate registries, financial databases, and open-source intelligence tools.

• Implement dynamic PEP risk scoring that incorporates changes in political exposure, jurisdictional risk, adverse media, and customer behaviour over time.

• Evaluate AI-powered screening and entity resolution tools to reduce false positives and improve the efficiency of PEP due diligence processes.

Sources: FATF Recommendation 12 and Interpretive Note (2025 Revision), EU 6AMLD and AML Regulation, HKMA AML/CFT Supervisory Review, Transparency International PEP Assessment 2025, World Bank-UNODC StAR Initiative.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai