The Short Answer
PEP duties are not a standalone rulebook. They thread through five places in your AML program: customer due diligence, risk rating, ongoing monitoring, suspicious activity reporting, and record keeping. FATF Recommendation 12 is the source, and AML PEP screening is the standard phrase for the screening step. Crypto firms carry the same duties as any covered business. The PEP compliance hub collects the related guides.
The Five Places PEP Shows Up in AML
Every AML program has the same five load-bearing points, and PEP duty touches all of them. Onboarding identifies the status, risk rating prices it, monitoring watches it drift, reporting escalates suspicion, and records hold the chain together. Miss one point and the program has a gap an examiner will find from the outside.
First, customer due diligence. When a relationship starts, CDD work establishes who the customer is and what risk they carry, and PEP status is one of the questions CDD has to answer. Skip it here and every later stage inherits the gap, because the whole chain keys off what onboarding established. Second, risk rating. The status feeds the customer's risk score, which in turn sets how much attention the relationship gets for its whole life: a rating that ignores political exposure prices the file wrong from day one. Third, ongoing monitoring, where status changes surface: the customer who was clean at onboarding and has since entered public life now belongs in a different file. The cadence and event types are covered in the guide on PEP monitoring.
Fourth, reporting. When monitoring surfaces behavior that looks suspicious, the path runs through internal escalation to a suspicious activity report, and the PEP context shapes both the escalation and the report. Fifth, records. Every step above has to leave evidence that survives to inspection day. That is why records are a load-bearing point rather than an afterthought: the file is the only artifact that still exists when the examiners arrive. FATF guidance on PEPs (Recommendations 12 and 22) are the source text for this stack, and the rest of this page walks the stack in order.
The order of the five points is also the order to build them. A team assembling an AML program from scratch that tries to bolt PEP handling onto a finished system usually ends up reworking onboarding anyway, because the status question changes what onboarding has to collect. Designing the five points together, with the PEP dimension threaded through each, costs less than retrofitting it later.
Those five places each have a guide, and the PEP compliance hub keeps them in one drawer.
What FATF Actually Requires
Recommendation 12 gives the measures: risk systems to determine whether a customer is a PEP, senior management approval for the relationship, checks on the source of wealth and funds, and enhanced ongoing monitoring. Recommendation 22 extends the same thinking to other covered businesses. The standard is risk-based rather than one-size, and it reaches virtual asset businesses.
The measures are concrete: institutions must have risk management systems that determine whether a customer or beneficial owner is a politically exposed person. A specific set of enhanced measures attaches to foreign PEP relationships, walked in full in the family's requirements guide. Recommendation 22 extends comparable expectations to "designated non-financial businesses and professions", which is how the duty reaches far beyond banks.
Two framing points matter for program design. The approach is risk-based: not every PEP relationship gets identical treatment, and institutions are expected to set measures to match exposure rather than apply one blanket rule. And the duties apply to virtual asset service providers: FATF's standards for the virtual asset sector pull VASPs into the same AML expectations, which the VASP compliance hub covers from the licensing side.
From Screening to SAR: The Reporting Chain
The chain runs: screen, tier, escalate, file, archive. Suspicion is judged on activity and context, not on PEP status alone. A normally behaving PEP relationship remains subject to the monitoring required by local law and risk; unusual activity is reviewed and escalated as appropriate. Every decision needs a timestamp and a reason.
The chain starts when screening or monitoring produces something that does not add up: transactions that mismatch the customer profile, funds whose source resists explanation, or activity that echoes known laundering patterns. An analyst escalates internally, the money laundering reporting officer assesses, and where suspicion holds, a suspicious activity report or suspicious transaction report goes to the financial intelligence unit. The file then archives: the alert, the analysis, the decision, and the report itself.
PEP status informs the customer risk assessment, including the relevance of wealth, funds, role influence, and jurisdiction. Additional checks and enhanced monitoring apply according to the governing rules and assessed risk; status alone does not establish suspicion or an automatic reporting threshold. The US customer due diligence rule covers customer identification, beneficial ownership, risk profiling, and ongoing monitoring. The 2020 joint statement confirms that the CDD rule creates no standalone PEP screening requirement: reporting follows suspected activity, not the label on the file.
Making the Chain Survive an Audit
Audits break at the evidence layer. Screens ran and decisions got made, but months later nobody can reconstruct why. The fix is tooling that keeps the reasoning attached to the result: scores with explanations, logs with timelines, and exports that assemble the file without a week of manual assembly.
On the address side, that is the layer Phalcon Compliance addresses. It screens addresses and transactions rather than people, so the person-side judgments stay with your team. On paid plans the STR and SAR drafts it exports give that team a starting document a person reviews, edits, and files through your own process. Audit Logs keep the timeline of screening events, and the notes your team adds sit beside them.
The wider AML picture beyond the PEP slice has its own AML hub. Every guide in this PEP family is mapped on the PEP compliance hub.