The Short Answer
No single official PEP list exists. PEP is a risk class defined by FATF, not a registry any authority publishes. Every directory you can query is an assembly built by a vendor or a compliance team from public records and disclosures. This guide covers where that data comes from, why sources disagree, and how to search it well. The PEP compliance hub collects the related guides.
Why There Is No Single Official PEP List
The term comes from a definition, not a registry. FATF describes who counts as a politically exposed person by the function they hold, and each country then writes that definition into its own law with local choices attached. Directories are assembled products, which is why two of them can disagree about the same person.
A sanctions list is a list: a named authority publishes entries, additions, and removals. PEP status is different. FATF guidance on PEPs (Recommendations 12 and 22) define the risk class by role. The FATF text is explicit that the requirements are preventive rather than criminal, and that the label is not an accusation. Nobody gets added to a PEP register the way an entity lands on a sanctions list, because there is no register and no such listing.
The FATF guidance is also blunt about what databases can do. It says a directory is not sufficient on its own to comply with the PEP requirements, and that the standards do not oblige anyone to use one. The compliance duty sits with the institution: the list is an input to your judgment, never a substitute for it. That position explains both why vendors compete on quality rather than authority, and why an examiner keeps asking what you did with a match after the tool reported it.
Jurisdictions then diverge on the edges. The European Union pulled domestic officials directly into scope with its anti-money laundering directive, while other jurisdictions concentrate on foreign officials and treat domestic cases as a risk-based call. Those national choices, and how each type is handled, are covered in the guide on PEP categories and risk tiers.
What you can buy or build is therefore an assembly: a data vendor's editorial team, or your own analysts, collecting appointments, tenures, and family ties from public sources. Every directory is one organization's reading of a definition, which is the root fact behind most data-quality complaints.
The One Official List That Does Exist
There is no official list of names, but the EU publishes an official list of the functions that qualify. Its directive makes each member state name which public positions count as prominent, and the Commission collected those answers into a published document. It is the closest thing to an authority-issued PEP source, and it lists jobs, not people.
The EU's anti-money laundering directive requires every member state to define which public functions count as prominent. The European Commission consolidated those answers into an official list of prominent public functions published in November 2023. FATF's guidance likewise suggests that countries make their covered positions public. What neither body publishes is a register of names, which is why the function list answers what counts while the name side stays with directories and your own casework.
Where the data actually comes from fills this page, and the PEP compliance hub holds the wider family.
What Goes Into a PEP Database
A PEP database holds people, but the useful part is the identity fields attached to them: full name, date of birth, jurisdiction, role, and tenure. Coverage spans current officials, former officials, family members, and close associates, and inclusion rules differ by vendor, so the same query can return different answers from different sources.
The identity fields are what make a database usable, because they are what separates your customer from every same-name stranger on earth. A directory with rich fields turns a scary match into a quick confirmation or a quick dismissal. A directory with thin fields turns every common surname into an investigation. When you evaluate a source, read the field list before the coverage claims, because the fields decide how much of your analyst time each match will burn.
Coverage decisions vary too. Some vendors keep former officials listed for a fixed risk window after they leave office; others drop them faster. Some extend coverage deep into family networks; others stop at the officeholder. Since tenures and listings move constantly, the answer you get today is perishable, and the file needs a re-check date. How that ongoing work is scheduled has its own guide on PEP monitoring.
Most false-positive pain traces back to this section, not to your process. When search results feel persistently noisy, the usual cause is thin disambiguation fields in the source, not a screening program that needs more staff.
How to Search PEP Lists Effectively
One source always has blind spots, so serious checks cross sources. Use identity fields to separate the right person from same-name noise: date of birth, jurisdiction, and tenure do most of the work. Judge a source by update cadence, disambiguation fields, and jurisdiction coverage rather than raw size.
Cross-checking is the first habit. Run the name against at least two sources with different collection methods, because a person missed by an appointments-driven collection can surface in a news-driven one, and vice versa. The overlap is where confidence comes from.
Disambiguation is the second habit. Search with the fields you have, not just the name: add jurisdiction and date of birth wherever you hold them, and compare tenure against your customer's timeline. A match whose public function does not overlap your customer's whereabouts is probably the wrong person.
Source selection is the third. The dimensions that matter are how often the data refreshes, which identity fields each entry carries, and which jurisdictions the collection actually covers. Raw entry count is the least informative number on a vendor's pricing page, because a huge list with weak fields mostly produces noise.
When a search does come back positive, the check is only half done: the result still needs confirmation, tiering, and a recorded decision. The full sequence is walked through in the guide on how to run a PEP check.
What Lists Cannot Tell You
A PEP list answers one question: whether a person falls inside a risk class. It says nothing about whether a specific wallet address or transaction partner is clean, because address risk is a separate evidence line with its own sources. Person-side and address-side checks complete each other, not replace each other.
A PEP list answers the person-side question. The address side is a separate evidence line: Phalcon Compliance screens the wallets behind a relationship, with sanctioned entities among the risk categories it flags.
The rest of the PEP family, from process design to record keeping, is mapped on the PEP compliance hub.