Skip to main content
FinCrime Institute
Category: Politically Exposed Persons

PEP Risk Scoring

Also known as: PEP Risk Assessment, PEP Risk Rating, Politically Exposed Person Risk Scoring
Simply put

PEP risk scoring is the process financial institutions use to assess how much money laundering or corruption risk a customer may present because they hold, or have held, a prominent public position. Because such individuals may be more exposed to bribery and misuse of public office, firms assign them a risk level that helps determine how closely the relationship should be monitored. A higher score does not mean the person has done anything wrong; it signals that additional scrutiny may be warranted.

Formal definition

PEP risk scoring is a risk-based methodology by which obliged entities evaluate and rate the AML/CFT risk associated with a business relationship involving a politically exposed person. The FATF Recommendations (notably Recommendations 12 and 22) call for the application of additional AML/CFT measures to PEP relationships owing to the heightened risks; the term PEP is commonly used in the financial industry to refer to individuals who are or have been entrusted with a prominent public function, with the FFIEC BSA/AML Manual framing this primarily around foreign individuals, though scope and categories (foreign, domestic, and international organization PEPs, and associated family members and close associates) vary by regime and should be confirmed against the applicable regulation. Operationally, a PEP status typically contributes a defined weighting to a customer's overall risk score, which may change over time as circumstances change; that score is generally used to inform the intensity of due diligence and ongoing monitoring rather than to establish wrongdoing. Scoring is an operational and risk-management measure intended to help detect and manage risk; it does not by itself guarantee prevention of financial crime, and a PEP designation or elevated score is not evidence of criminal conduct.

Why it matters

PEP risk scoring addresses a specific vulnerability recognized across AML/CFT frameworks: individuals entrusted with prominent public functions may be more exposed to bribery, corruption, and the misuse of public office, and business relationships with them can therefore carry heightened money laundering risk. The FATF Recommendations (notably Recommendations 12 and 22) call for the application of additional AML/CFT measures to relationships involving PEPs precisely because of these elevated risks. Assigning a structured risk score allows an obliged entity to calibrate the intensity of its due diligence and ongoing monitoring in a defensible, risk-based way rather than treating all customers uniformly.

It is essential to understand what a PEP score does and does not signify. A higher score, or a PEP designation itself, is not evidence that an individual has engaged in criminal conduct; it is a risk-management signal indicating that additional scrutiny may be warranted. Treating a score as proof of wrongdoing would be both operationally and legally inappropriate. Conversely, applying a score consistently and documenting the rationale helps a firm demonstrate to supervisors that it has identified and managed the risk in line with applicable expectations.

Scope and terminology in this area vary by regime and should be confirmed against the applicable regulation. The FFIEC BSA/AML Manual frames the term primarily around foreign individuals entrusted with a prominent public function, whereas other regimes recognize additional categories, including domestic PEPs, PEPs in international organizations, and associated family members and close associates. Because these distinctions affect who is captured and what measures apply, firms should align their scoring methodology with the specific requirements of the jurisdictions in which they operate rather than assuming a single global standard.

Who it's relevant to

Compliance Officers and MLROs
Those responsible for designing and maintaining CDD frameworks use PEP risk scoring to calibrate the additional AML/CFT measures applied to PEP relationships, consistent with FATF Recommendations 12 and 22 and the requirements of their applicable regime. They must ensure the methodology reflects the correct scope of PEP categories for their jurisdictions and that scoring outcomes are documented and defensible.
Financial Intelligence and Onboarding Analysts
Analysts who screen and onboard customers apply PEP scoring to determine the level of due diligence and monitoring a relationship warrants. They should treat an elevated score as a prompt for further scrutiny, not as an indication of wrongdoing, and understand that a customer's PEP contribution to the overall risk score may change over time.
AML Risk and Model Governance Teams
Teams that own risk-scoring models and their weightings are responsible for how PEP status feeds into a customer's overall score, and for confirming that captured categories and weightings align with the applicable regulation. They should recognize that scoring helps manage risk but does not guarantee prevention of financial crime.
Supervisors, Auditors, and Regulators
Those reviewing an institution's AML/CFT program assess whether PEP risk scoring is applied on a genuinely risk-based basis and whether the additional measures expected for PEP relationships are appropriately triggered. Because scope and terminology differ across regimes, they evaluate scoring against the specific requirements applicable to the firm.

Inside PEP Risk Scoring

PEP Classification Tier
A categorization of the customer or connected party by PEP type, typically distinguishing domestic PEPs, foreign PEPs, and officials of international organizations, alongside family members and known close associates (RCAs). Many risk-scoring models assign a higher inherent baseline to foreign PEPs, though classification approaches vary by jurisdiction and by institutional policy.
Prominence and Position Factors
Consideration of the nature, seniority, and influence of the public function held. Positions with greater access to public funds, procurement, or discretionary authority are generally weighted as higher risk. This factor reflects the potential for abuse of position rather than any finding that abuse has occurred.
Geographic and Jurisdictional Risk
The risk contribution associated with the country of the public function, residence, or activity, often informed by corruption perception, governance, and AML/CFT effectiveness indicators. This is one input among several and should not be treated as a standalone determinant.
Product, Service, and Channel Risk
Assessment of how the PEP interacts with the institution, including account types, private banking or wealth products, cross-border activity, and non-face-to-face onboarding, each of which may raise or lower the assessed risk depending on exposure to misuse.
Source of Wealth and Source of Funds Considerations
Inputs reflecting whether the origin of the customer's wealth and the funds involved in the relationship are understood and plausible relative to their known profile. Under many regimes, establishing source of wealth and funds is an enhanced due diligence expectation for PEP relationships.
Adverse Media and Screening Outputs
Signals derived from negative news, sanctions screening, and PEP list matches. These are distinct processes, sanctions screening, PEP screening, and adverse media each address different risks, and a match or hit is an indicator warranting review, not evidence of wrongdoing.
Composite Risk Rating and Treatment
The aggregated output that places the relationship into a risk band, driving the level of due diligence (typically EDD for PEPs), senior management approval requirements, and ongoing monitoring intensity.

Common questions

Answers to the questions practitioners most commonly ask about PEP Risk Scoring.

Does a PEP risk score indicate that a customer has committed a financial crime?
No. A PEP risk score reflects the potential risk exposure associated with a politically exposed person's position, influence, and susceptibility to bribery or corruption, not evidence of wrongdoing. PEP status is a risk indicator, not an accusation. The FATF Recommendations and most national regimes treat PEPs as warranting enhanced scrutiny precisely because their position may make them vulnerable to abuse, but this scrutiny is preventive and risk-based. A high score should drive the application of enhanced due diligence and closer monitoring, not a presumption of criminality, and it does not by itself justify adverse action against the customer beyond the applicable regulatory measures.
Are all PEPs automatically treated as high risk and scored the same way?
Not necessarily. While some jurisdictions and institutions apply a baseline classification for PEPs, a risk-based approach generally allows firms to differentiate among PEPs according to factors such as the nature and seniority of the position, the jurisdiction involved, and the individual's specific circumstances. Distinctions are also commonly drawn between foreign PEPs, domestic PEPs, and persons entrusted with prominent functions by international organisations, and treatment of these categories can vary by regime. Family members and close associates may be scored differently again. Firms should confirm the specific classification and scoring expectations against the applicable regulation and their own risk appetite rather than assuming uniform high-risk treatment.
What factors are typically incorporated into a PEP risk-scoring model?
Models generally weight a combination of position-related, geographic, and behavioural factors. These may include the seniority and nature of the public function, the perceived corruption risk of the relevant jurisdiction, the category of PEP (for example foreign versus domestic, or a family member or close associate), the products and services used, expected transaction patterns, and the source of wealth and source of funds where established. The precise factors and weightings are a matter of institutional methodology informed by the risk-based approach, and firms should ensure their model is documented, justifiable, and aligned with their obligations under the applicable regime.
How should firms handle changes in a customer's PEP status over time?
PEP status is not static, so scoring should be refreshed as part of ongoing monitoring and periodic review. A customer may become a PEP after onboarding, or may leave a prominent public function. Where an individual ceases to hold a relevant position, some regimes contemplate that firms may, on a risk-sensitive basis, reduce the level of enhanced measures over time rather than removing them immediately, taking account of continued influence and residual risk. Firms should confirm the specific treatment of former PEPs against their applicable regulation, as approaches differ, and should document the rationale for any change in scoring or treatment.
How does PEP risk scoring interact with sanctions and adverse media screening?
PEP screening, sanctions screening, and adverse media (or negative news) screening are distinct processes that should not be conflated. A PEP match indicates political exposure; a sanctions match indicates a potential listing under a sanctions regime and carries different, often more immediate, legal consequences; and adverse media screening surfaces reputational or investigative information. In practice, results from these processes may feed into an overall customer risk assessment, and adverse media relating to a PEP may raise the score or trigger enhanced review. However, each source should be treated according to its own significance, and a PEP match alone should not be interpreted as a sanctions concern or vice versa.
What governance and documentation should support a PEP risk-scoring approach?
Because PEP handling in many jurisdictions requires senior management approval to establish or continue a relationship, the scoring methodology and its outputs should be documented, auditable, and subject to appropriate oversight. Firms generally maintain records of how scores are derived, the factors and weightings applied, the enhanced due diligence measures triggered at given thresholds, and the rationale for decisions such as onboarding, exit, or reclassification. Clear governance supports consistency, enables independent review or audit, and helps demonstrate that the risk-based approach is being applied deliberately rather than arbitrarily. Specific approval and record-keeping requirements should be confirmed against the applicable regulation.

Common misconceptions

A high PEP risk score means the customer is engaged in corruption or money laundering.
PEP status and a high risk score reflect potential exposure to bribery, corruption, or misuse of position, not a finding of criminality. PEP measures are risk-management and due diligence controls; they do not establish wrongdoing and are not a criminal-law determination.
All PEPs must be scored and treated identically, and PEP status must trigger automatic account refusal or closure.
Many regimes and guidance (including the FATF Recommendations as standards rather than binding law) support a risk-based approach that differentiates among PEPs, for example, between foreign and domestic PEPs. Being a PEP generally triggers enhanced scrutiny, not an automatic prohibition; treatment and any de-risking decisions depend on institutional policy and applicable law.
Once a PEP relationship is scored at onboarding, the rating is fixed.
PEP risk scoring is generally intended to be dynamic. Changes in position, jurisdiction, screening or adverse media outputs, and account behavior may warrant reassessment. Many frameworks also address how long RCA or former-PEP status should continue to influence scoring, though specific timeframes vary by regime and policy.

Best practices

Score PEP relationships using multiple weighted factors, classification tier, prominence of position, geography, product and channel, and screening outputs, rather than relying on PEP status alone as a single determinant.
Apply a risk-based approach that differentiates among PEP types (for example, foreign versus domestic PEPs and RCAs) consistent with applicable law, and document the rationale for the weightings used.
Treat sanctions screening, PEP screening, and adverse media as distinct inputs, and ensure matches or hits are reviewed as indicators requiring investigation rather than as proof of wrongdoing.
Establish and evidence source of wealth and source of funds as part of enhanced due diligence for PEP relationships, and record senior management approval where required by the applicable regime.
Reassess PEP risk scores on an ongoing and event-driven basis, including changes in position, jurisdiction, behavior, or screening results, and define clear policy on how former-PEP and RCA status continues to affect scoring over time.
Confirm classification criteria, thresholds, EDD triggers, and any timing rules against the specific applicable regulation (such as the EU AML framework, the US BSA/FinCEN rules, or the UK Money Laundering Regulations), as these diverge across jurisdictions.