Politically Exposed Persons (PEPs): The Complete Screening Hub for Crypto Compliance

A politically exposed person is anyone holding or having held a prominent public function, with the label extending to family members and close associates. For crypto teams the work is a five-step loop: identify who is in scope, screen them, tier the risk, monitor for change, and record the decisions. This hub maps the loop and links a guide for every stage.

The page reads in the order teams usually meet the problem. First what the term means and why regulators care, then the requirements at a glance, then how screening actually works in practice. Finally comes the full family of guides: seven pages that each take one stage deep, three neighboring hubs on this site, and four published explainers on the definitions behind it all. If you are building a program from zero, read top to bottom and open each guide as its stage becomes your problem. If you are answering one specific question today, the table of five steps and the family list below are the fastest way in.

What Is a Politically Exposed Person?

A politically exposed person is a natural person who is or has been entrusted with a prominent public function. The definition comes from FATF and covers senior roles: heads of state and government, ministers and members of parliament, senior judges, ambassadors, central bank board members, and directors of international organizations. It explicitly excludes middle-ranking and junior officials. The label is a risk classification, never an accusation.

The source text is FATF guidance on PEPs (Recommendations 12 and 22). Recommendation 12 defines the category and the duties financial institutions owe it; Recommendation 22 extends comparable expectations to other covered businesses. The FATF wording is careful on one point worth repeating inside any program document. The requirements are preventive in nature, not criminal, and should not be read as saying that politically exposed persons are involved in criminal activity.

Three types cover the field, foreign, domestic, and figures at international organizations, and how each one obliges you to act is the classification guide's ground. The scope then extends through relationships, family members and close associates, because assets controlled through those ties are a classic pattern in corruption cases.

Two boundary questions come up constantly. The first is seniority: the definition attaches to prominent functions and explicitly skips middle-ranking and junior officials, so a senior central bank board member counts while a desk officer at the same institution does not. The second is time: leaving office does not erase the status, and the EU keeps a former officeholder inside the risk scope for a window set at a minimum of 12 months. Influence and ill-gotten assets both outlast the title. Both boundaries are judgment areas, which is why the classification guide in the family below walks them with examples.

Jurisdictions color the definition differently at the edges. The European Union wrote domestic officials directly into its anti-money laundering directive, while other jurisdictions concentrate on foreign officials and treat domestic exposure as a risk-based call. How the types differ, and what each one obliges you to do, has its own guide in the family below. If you want the definitional layer in full, the four explainers listed under Related Guides cover the term, the definition, the three types, and how the major frameworks word it differently.

Why PEP Risk Matters in Crypto Compliance

The risk is position applied to money. Public office gives a person influence over contracts, budgets, and approvals, and where that influence meets weak controls, bribes and diverted state funds follow. Crypto inherits the same exposure with an extra layer: wallet addresses do not carry names, and funds can move across chains in minutes.

For a crypto business the exposure is concrete in both directions. A customer who is a politically exposed person brings source-of-wealth questions that pseudonymous onboarding does not answer by itself. And funds that originated in corruption can arrive at your platform already layered, which means the onboarding stage is often the only checkpoint you control cleanly.

Regulators have closed the distance between crypto and traditional expectations. FATF standards for virtual asset service providers pull VASPs into the same AML framework banks already operate under, PEP duties included, and licensing rules write those duties into their conditions. The practical translation: a crypto compliance team answers the same questions a bank compliance team answers, usually with fewer staff.

The label itself deserves one more sentence, because teams misread it in both directions. Calling someone a politically exposed person is not a claim that they are corrupt, and treating the label as an automatic refusal contradicts the preventive design of the rules. What the classification says is narrower and more useful: this person's position creates conditions where misuse could happen, so the relationship needs stronger checks than an ordinary customer file. The entire five-step loop exists to turn that one sentence into a repeatable process.

What happens when the answer is no program at all is easy to picture, because the failure mode is structural. Nothing determines whether customers are politically exposed, enhanced measures never reach the relationships that required them, and no records show who decided what. Where regulators find those gaps, the penalties are the visible part, and the operational aftermath usually costs more. Remediation programs arrive imposed from outside, licensing conditions tighten, and every future decision gets reviewed by someone who no longer trusts the file. Building the five-step loop before anyone demands it is the cheap version.

PEP Screening Requirements at a Glance

The duties stack into five steps, and each step has a dedicated guide in this family:

Step five deserves its own sentence, because it is where inspections are won or lost. The duties themselves, from senior management approval to source of funds checks, live in FATF Recommendation 12 and its national translations. The US customer due diligence rule treats PEP status as a risk factor inside four core requirements. US regulators confirmed in a 2020 joint statement that the rule does not itself require PEP screening; the status is handled through risk-based customer due diligence. What regulators test is rarely whether you screened. They test whether the file proves you screened, reasoned, and decided. The PEP screening requirements guide covers the duty set and the enhanced due diligence measures behind it, step by step.

One reading tip for the table: the steps are a loop, not a line. Step four feeds back into step two, because a re-screen is the same screen run again under new circumstances. Step five wraps the other four, because every step leaves the records that step five owns. Teams that treat the five steps as a one-time onboarding sequence are the teams that fail the re-screening question, because they stopped watching after the first pass.

The table also doubles as a staffing map. Step one and step three belong to policy owners, because they set rules the whole institution follows. Step two and step four belong to operations, because they run daily and their volume scales with the customer base. Step five belongs to whoever faces the examiner, usually the money laundering reporting officer. When a program feels understaffed, the table tells you which step is thin, and the guide behind that step tells you what the minimum defensible version looks like.

How PEP Screening Works in Practice

Mechanically, a working program runs three processes side by side.

Name screening checks customers, owners, and business partners against the PEP scope. The data sources behind it each read the FATF definition slightly differently, since there is no single official list. Match quality therefore depends heavily on identity fields: date of birth, jurisdiction, and tenure do most of the work of separating your customer from a same-name stranger. A program that screens against one thin source will generate noise faster than it generates confidence, which is why source selection has its own guide in the family below.

Ongoing re-screening keeps the picture current, because elections and appointments re-price risk on their own schedule. A file that was clean at onboarding can become a different file halfway through the relationship, and nothing tells you unless something is watching. That means a periodic sweep of the whole book, event-driven checks when news moves, and scheduled reviews of the files already flagged. Without one of those three lanes, every clean result is quietly expiring.

Tiered response routes confirmed matches into the treatment required by applicable law and the relationship's risk. PEP type and jurisdiction set the legal minimum; role seniority, corruption exposure, and relationship characteristics inform additional scrutiny above it. A documented low-risk call can reduce additional measures only where local law permits discretion, never waive mandatory PEP measures. The institution records both the legal basis and its tiering judgment.

A fourth thread runs through all three processes: documentation. Every screen, every re-screen, and every tier decision has to leave a record at the moment it happens, because reconstructing judgments two years later from memory is how files fail. Good programs treat the record not as paperwork after the work but as the output of the work, produced by the same tools that run the checks. That is also where tooling earns its place, which is what the next paragraph describes.

On the address side, Phalcon Compliance screens addresses and transactions, with sanctioned entities among 17 risk indicator categories, and the label library behind it draws on more than 600 million labeled addresses. This is the other half of a complete program, and the halves complement rather than overlap. The person-side screening this family describes runs on your names and your process, while the address side answers what the wallets behind a relationship actually touch, sanctioned and scam labels among them. Results come back on five risk levels, and exports on paid plans turn the address-side record into evidence that sits beside the person-side file.

Explore the PEP Family

Seven guides take the stages deep. Each one answers the question a compliance team actually asks at that point in the work, and each one stands alone, so you can land on the one you need without reading the others first.

• PEP screening: how it works: the full five-step process from risk profiling to record keeping, for the team told to build the workflow and hand over a plan. This is the widest guide in the family and the right starting point for program design.
• How to run a PEP check: the single-check guide, for the analyst with one specific customer or business partner to clear today. It covers who falls in scope, which sources to query, how to confirm a positive match, and what the record needs to hold.
• Is there a PEP list?: where PEP data actually comes from, for anyone hunting the official list that does not exist and evaluating data sources instead. It explains why directories disagree and which fields make a source usable.
• Domestic PEP, foreign PEP, and risk tiers: classification and tiered response, for the officer writing the internal policy and explaining it to management. It covers the three types, the domestic-foreign split, and what each tier obliges.
• PEP and AML: where PEP duties sit inside the wider AML program, for the owner assembling the whole framework. It maps the five places the duties appear, from customer due diligence to suspicious activity reporting.
• PEP monitoring: what changes after the first screen, for the operations team answering "and then what". It covers the three monitoring lanes and how to handle promotions, exits, and tier changes mid-relationship.
• PEP screening requirements: the duty set and the enhanced due diligence measures, for the MLRO preparing a file that survives inspection. It lists the four requirements, the EDD measure list, and the records that answer an examiner.

Related Guides

Three neighboring hubs on this site cover the wider terrain. The AML hub holds the screening picture this family sits inside, from program foundations to the duties every covered business shares. Read it when the question is how PEP work fits the program you already run. The VASP compliance hub covers the licensing and duties layer for virtual asset service providers specifically, which is where many PEP duties enter a crypto firm's rulebook in the first place. The KYT hub goes deep on transaction-flow monitoring, the watch that runs beside the identity-side work this family describes; the two together cover both halves of a complete program.

For the definitional layer, four published explainers walk the groundwork this hub compresses. They cover what PEP means in practice, the politically exposed person definition clause by clause, the three types of PEPs in introductory terms, and how PEP definitions compare across the major frameworks. They are already live on the blog: the explainers carry the definitions, these guides carry the workflow.