Category: Politically Exposed Persons

PEP Categorization

Also known as: PEP, PEP Classification, PEP Types, Categories of Politically Exposed Persons

Simply put

PEP categorization is the practice of sorting politically exposed persons, people who hold or have held prominent public functions, into different groups so that firms can assess the risk each may present. Common categories include domestic PEPs, foreign PEPs, and those who work in international organisations, as well as their family members and close associates. Because such positions can potentially be abused for purposes such as bribery or corruption, categorizing PEPs helps firms decide how closely to scrutinise a customer.

Formal definition

PEP categorization refers to the classification of individuals entrusted with a prominent public function into defined groups to inform the risk-based application of due diligence measures. Under the FATF Recommendations (notably Recommendations 12 and 22, which are international standards rather than binding law), a PEP is broadly an individual who is or has been entrusted with a prominent function. Categorization commonly distinguishes domestic PEPs, foreign PEPs, PEPs entrusted with prominent functions by international organisations, and family members and close associates of such persons. Notably, in US practice under the FFIEC BSA/AML framework the term 'PEP' is commonly used to refer specifically to foreign individuals entrusted with a prominent public function; other regimes extend coverage to domestic and international-organisation PEPs, so the precise categories and their treatment vary by jurisdiction and should be confirmed against the applicable regulation. Categorization is a risk-management and CDD input used to determine whether standard or enhanced measures apply; it does not itself establish that any individual has engaged in wrongdoing.

Why it matters

PEP categorization matters because not all politically exposed persons present the same level of risk, and treating them uniformly can lead firms to either over-apply resource-intensive controls or under-scrutinise genuinely higher-risk relationships. The rationale for identifying PEPs at all is that individuals entrusted with a prominent public function may hold positions that can potentially be abused for purposes such as bribery or corruption. By sorting PEPs into categories, commonly domestic PEPs, foreign PEPs, PEPs entrusted with prominent functions by international organisations, and family members and close associates, firms can calibrate the intensity of their due diligence to the risk each grouping may present under a risk-based approach.

The stakes are heightened by the fact that the meaning of 'PEP' itself is not uniform across regimes. Under the FATF Recommendations (Recommendations 12 and 22), which are international standards rather than binding law, coverage is broad and extends to foreign, domestic, and international-organisation PEPs as well as their family members and close associates. In US practice under the FFIEC BSA/AML framework, however, the term is commonly used to refer specifically to foreign individuals entrusted with a prominent public function. A firm operating across borders that misaligns its categorization with the applicable regime risks compliance gaps or inconsistent treatment of comparable customers.

It is important to stress that categorizing a customer as a PEP is a risk-management and due diligence input, not a finding of misconduct. Being classified as a PEP indicates that an individual may be more susceptible to involvement in bribery or corruption because of their position; it does not establish that any individual has engaged in wrongdoing. The categorization simply informs how closely a firm chooses to scrutinise the relationship.

Who it's relevant to

Compliance Officers and MLROs

Those responsible for CDD programmes use PEP categorization to design proportionate policies that map each category, domestic, foreign, international-organisation, and family members and close associates, to appropriate levels of scrutiny. They must ensure the categories applied align with the definitions and obligations in the specific regime governing the firm, which may differ between a FATF-aligned framework and the US FFIEC BSA/AML framework.

Financial Intelligence and Screening Analysts

Analysts who run PEP screening rely on categorization to interpret matches and prioritise reviews, recognising that a PEP classification reflects potential susceptibility to bribery or corruption rather than evidence of wrongdoing. Correctly distinguishing PEP types helps them apply the right degree of scrutiny without conflating identification with a finding of misconduct.

Onboarding and Relationship Management Teams

Front-line staff collecting customer information contribute to identifying whether a customer or connected party holds or has held a prominent public function, and to which category they belong. Accurate categorization at onboarding determines whether standard or enhanced due diligence measures are triggered.

Risk and Legal Professionals

Those advising on risk appetite and regulatory obligations use PEP categorization to reconcile differing definitions across jurisdictions and to ensure the firm's treatment of each category is defensible under the applicable regulation. They should confirm exact categories and their treatment against the relevant regime rather than assuming uniformity.

Inside PEP

Foreign PEPs

Individuals who are or have been entrusted with prominent public functions by a foreign country, such as heads of state, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, and important political party officials. Under FATF Recommendation 12, foreign PEPs generally require enhanced due diligence (EDD) as a matter of course, given the elevated risk profile typically associated with cross-border prominent functions.

Domestic PEPs

Individuals entrusted with prominent public functions within the obliged entity's own country. FATF standards and many national regimes generally require obliged entities to take reasonable measures to determine whether a customer is a domestic PEP, and to apply EDD where a higher-risk business relationship is identified, rather than automatically in all cases.

International Organisation PEPs

Persons who are or have been entrusted with a prominent function by an international organisation, such as directors, deputy directors, board members or equivalent senior management. These are typically treated similarly to domestic PEPs under many frameworks, with EDD applied on a risk-sensitive basis.

Family Members and Close Associates (RCAs)

Relatives and close associates of a PEP, sometimes referred to as RCAs. The definition of who qualifies (for example, spouses, partners, children and their spouses, parents, and persons with close business or beneficial ownership links) can vary by jurisdiction and should be confirmed against the applicable regulation. These parties are generally brought within scope because risk can attach to persons connected to the PEP rather than solely the PEP directly.

Prominent Public Function Threshold

The criterion that distinguishes a PEP from other public officials. The category is generally limited to senior or prominent roles and is not intended to capture middle-ranking or more junior officials. The precise list of qualifying functions may differ by jurisdiction and instrument.

Risk Classification Following Categorization

The operational step of assigning a risk rating to an identified PEP based on category (foreign, domestic, international organisation), role, jurisdiction, and other risk factors. Categorization informs, but does not by itself determine, the level of due diligence and ongoing monitoring applied.

Common questions

Answers to the questions practitioners most commonly ask about PEP.

Does being categorized as a PEP mean the person has done something wrong or is a criminal?

No. PEP categorization is a risk classification, not an allegation or finding of wrongdoing. It reflects that an individual holds or has held a prominent public function, or is a family member or close associate of such a person, which may present a higher potential exposure to bribery, corruption, or misuse of position. It does not establish that any offense has occurred. The categorization triggers enhanced due diligence and closer scrutiny as a risk-management measure, not a presumption of guilt. Treating a PEP match as proof of criminality would be a misuse of the concept.

Is a PEP always a foreign official, and does the categorization automatically expire when they leave office?

Not necessarily. Many frameworks distinguish between foreign PEPs, domestic PEPs, and persons entrusted with prominent functions by international organizations, and the applicable treatment can differ between these categories depending on the jurisdiction. So a PEP is not limited to foreign officials. Nor does the status necessarily end automatically on leaving office; a number of regimes expect obliged entities to continue applying a risk-based approach for a period after the person ceases to hold the function, taking account of the continuing risk they may pose. Exact treatment, categories, and any de-classification approach should be confirmed against the applicable regulation and the firm's own risk-based policies.

How should a firm approach categorizing family members and close associates of a PEP?

Family members and close associates are generally brought within scope because the risk associated with a prominent public function can extend to those connected to the individual. Firms typically define, in their internal policy, which relationships they treat as in scope, commonly certain family members and persons with recognized close business or personal ties, based on the applicable regulatory definitions and their own risk assessment. Because the precise definitions of "family member" and "close associate" can vary by jurisdiction, firms should align their categorization criteria to the relevant instrument and document how those relationships are identified and evidenced.

Can PEP categorization be tiered by level of risk rather than treated as a single status?

Yes, many firms operate a tiered or graduated approach within a risk-based framework, differentiating, for example, between higher-risk and lower-risk PEP relationships according to factors such as the nature and seniority of the function, jurisdiction, and other risk indicators. This can inform the intensity of enhanced due diligence, the level of senior management approval sought, and the frequency of ongoing monitoring and review. Any tiering should remain consistent with the treatment required under the applicable regime, which may set baseline expectations that cannot be reduced below a certain level.

What practical steps are involved in confirming and documenting a PEP categorization?

In operational terms, categorization typically follows an initial screening match, which then requires review to confirm whether the match is a true match, assess which category applies, and determine the appropriate risk classification. Firms generally document the basis for the decision, the source information relied upon, the outcome of any manual review to discount false positives, and any approvals obtained. Maintaining a clear audit trail supports consistency, review, and the ability to demonstrate the rationale for how a relationship was categorized and handled.

How often should PEP categorization be reviewed once assigned?

PEP categorization is generally not a one-time exercise. Because an individual's status and associated risk can change, for example, through appointment to or departure from a function, or changes in connected relationships, firms typically incorporate ongoing monitoring and periodic review into their processes, with the frequency and depth driven by the assessed risk level. The specific review cadence and triggers should be defined in the firm's risk-based policies and aligned with the expectations of the applicable regulatory regime.

Common misconceptions

Being categorized as a PEP means the individual is corrupt or engaged in wrongdoing.

PEP categorization is a compliance risk classification, not a finding of criminal conduct. It reflects that a person's position may present a higher potential exposure to bribery, corruption or related risks, and triggers enhanced scrutiny. It does not establish or imply that the individual has committed any offence.

All PEPs must receive the same automatic enhanced due diligence regardless of type.

Treatment can differ by category. Under FATF Recommendation 12, foreign PEPs generally require EDD as a matter of course, whereas for domestic PEPs and international organisation PEPs many regimes require reasonable measures to identify them and apply EDD on a risk-sensitive basis. Exact obligations vary by jurisdiction and should be confirmed against the applicable regulation.

Once a person leaves office they immediately cease to be a PEP.

Many frameworks provide that PEP status should be handled on a risk-sensitive basis for a period after the person has ceased to hold the prominent function, rather than ending automatically on the day they leave office. Whether and for how long residual risk is considered varies by jurisdiction, and the applicable regulation should be checked.

Best practices

Maintain a categorization framework that clearly distinguishes foreign PEPs, domestic PEPs, international organisation PEPs, and family members and close associates, and align the treatment of each with the specific requirements of the jurisdictions in which you operate rather than assuming a single global rule.

Define within internal policy which roles constitute a 'prominent public function' and which family members and close associates fall in scope, and confirm these definitions against the applicable regulation, since they can vary by jurisdiction.

Apply a risk-based approach after categorization, using category as one input among several (role, jurisdiction, source of wealth and funds, and business relationship risk) to determine the level of due diligence and ongoing monitoring, rather than treating categorization as the final risk decision.

Document the rationale for each PEP determination and the associated risk classification so that decisions are auditable and can be explained to regulators and internal reviewers.

Establish a defined, risk-sensitive process for handling individuals who have ceased to hold a prominent function, rather than removing PEP status automatically upon departure from office.

Treat a PEP match or categorization as a trigger for enhanced scrutiny and not as evidence of wrongdoing, and ensure staff are trained to escalate on a risk basis without presuming criminal conduct.