The Short Answer
A PEP check answers one question about one person: does this customer or the person across the deal fall inside political exposure scope as the person themselves, a family member, or a close associate? Four moves follow: collect identity details, check PEP data sources, confirm any match, and record the conclusion. It is the single-shot version of a screening program. The PEP compliance hub collects the related guides.
What a PEP Check Covers
The scope is wider than most people expect. The person themselves always counts, and so do their family members and their close business associates. You are checking the network around a position, not just the name printed on an ID document.
The starting point is the person. Anyone who currently holds, or has previously held, a prominent public function can be a politically exposed person: ministers, members of parliament, senior judges, ambassadors, central bank board members, and their peers at international organizations. FATF guidance on PEPs (Recommendations 12 and 22) set out the functions that count and the expectations that follow.
In crypto the check reaches one layer deeper than the account. The named holder of a corporate account is rarely the only person who matters. The beneficial owner behind the entity, the person who controls the withdrawing wallet, and the person on the other side of a recurring flow each bring their own exposure. A check that clears the account name and stops there answers the easiest question and skips the ones regulators ask.
The scope then extends outward. Family members, typically spouses, children, and parents, carry the same treatment because they can hold or move assets on behalf of the official. Close associates count too: people with joint beneficial ownership of a company, close business partners, or the sole owner of an entity clearly set up for the official's benefit. In formal policy language this wider net is what a politically exposed person check has to clear, and auditors commonly probe whether it was actually cleared.
Where to Run a PEP Check
Three source families exist: official public records such as asset declarations and appointment announcements, commercial data vendors that assemble PEP directories, and the internal list you build from your own casework. Each answers a different question, and none of them is complete on its own. There is no single official PEP list.
Official records are the cheapest starting point and the most authoritative for what they cover: asset and interest declarations, government gazettes and appointment announcements, parliamentary directories, and the EU's list of covered functions. They record what a person's position actually is, which is the question PEP scope turns on. Sanctions and wanted lists are a different tool: they record bans and warrants, not political exposure, so they are not PEP sources. Commercial directories assemble much wider coverage from appointments, news, and public records, which makes them the workhorse for PEP scope, at the price of licensing fees and varying quality. An internal list captures what your own investigations have already established and keeps institutional memory from leaking away.
The internal list earns its keep over time. Every confirmed match, every cleared false positive, and every former customer with confirmed exposure belongs in it, because that history is exactly what a fresh check has no access to. An internal entry says this person was examined before, here is what was found, and here is the decision that followed, which turns the next check from an investigation into a confirmation. Teams that skip this step pay for the same discovery twice.
Because no single source is complete, a serious check crosses at least two. The guide on where PEP data actually comes from covers how these sources are built and why they disagree with each other.
When one check grows into a whole program, the PEP compliance hub maps every moving part.
What to Do When a Check Comes Back Positive
A positive result means diligence, not exit. First confirm that the match is the right person, then place the risk into a tier, then act on it with enhanced measures, closer review, or a decision to decline. A hit is a prompt to work, not a verdict.
Confirmation comes first because names collide constantly. A shared name alone proves nothing. Cross-check the identity fields you hold, date of birth, jurisdiction, and tenure of the public function, because a match whose function does not overlap your customer's timeline is probably the wrong person. Regulators expect exactly this discipline: the US customer due diligence rule is built on "identifying and verifying the identity of customers" as its first core requirement. A 2020 joint statement by US regulators confirms the rule does not itself require PEP screening; the status is treated as one risk factor inside risk-based customer due diligence. Write the confirmation down as you do it: which fields matched, which were silent, and what the remaining uncertainty is. A confirmation that lives in an analyst's head does not exist on inspection day.
Once the match is real, identify the PEP type and minimum measures required by applicable law, then place the relationship in an internal risk tier. Role influence, jurisdiction, and relationship characteristics inform scrutiny above that legal floor; a lower tier does not waive mandatory measures. PEP risk tiers walks the tiering logic in detail.
Then act. The response menu runs from enhanced due diligence with senior approval, through restricted products and limits, to declining the relationship when the risk does not fit your appetite. The duties behind each option are covered in the guide on PEP screening requirements.
Keeping a Record of Every Check
Every check needs a paper trail: when you ran it, what you compared against, what you found, and why you reached the conclusion you reached. Records are what turn a finished check into defensible evidence months later, when the context is gone and only the file remains.
A complete record holds four elements: the input details, the sources queried, the raw result, and the reasoned conclusion. The conclusion is the part people skip, and it is the part regulators read first, because it is the only element that explains the other three. Statuses also drift over time, so the record needs a re-check date, because a clean answer today says nothing about next year. The monitoring guide covers how to schedule that rework.
On the crypto side there is a second evidence line to capture. A wallet address on the other side of a transaction carries its own risk profile, independent of the person behind it. Phalcon Compliance screens the wallets in the picture, with sanctioned entities among the risk categories it flags, and Audit Logs timestamp every screening, so the address-side half of your file carries its own evidence. The person-side confirmation above stays in your own records.
The full family of PEP guides, from process design to record keeping, is mapped on the PEP compliance hub.