The Short Answer
PEP monitoring is the work that keeps screening true after onboarding. People gain office, lose it, or move between risk tiers, and every change has to reach the customer file. A monitoring program runs three lanes: periodic re-screening of the whole book, event-driven checks when news or lists move, and scheduled reviews of existing PEP relationships. The PEP compliance hub collects the related guides.
Why One Screen Is Never Enough
An onboarding screen is a snapshot, and public office is a moving target. Elections, appointments, and resignations re-price customer risk on their own schedule. A customer who joined clean can win a seat halfway through the relationship. Snapshot compliance leaves gaps a regulator can date, which is why this page covers everything after the first screen.
The core intuition is familiar from the address side of crypto risk: a wallet that is clean today is only clean today, and the same holds for a person's political status. Listings change, tenures start and end, and the risk picture is continuous rather than binary-once.
Regulators read the gap the same way. FATF Recommendation 12 includes enhanced ongoing monitoring for the PEP relationships requiring additional measures, rather than treating an initial check as the whole duty. The US customer due diligence rule lists ongoing monitoring among its core requirements. A 2020 joint statement by US regulators confirms the rule handles PEP risk inside risk-based customer due diligence, not through a standalone screening rule. A file that was checked once and never again fails both readings.
What Ongoing PEP Screening Covers
Three lanes keep the picture current. Periodic re-screening sweeps the full customer base on a cycle, event-driven checks respond to news and list changes, and relationship reviews re-examine existing PEP files on a schedule. Each lane has a trigger, an owner, and an output.
Periodic re-screening is the baseline: the entire customer base goes through the screen again on a fixed cycle, with the frequency set by risk. Higher-risk segments cycle faster than normal ones, and the sweep catches slow-moving changes that no single news event would surface. The output is a refreshed status for every file, dated.
Event-driven checks react to the world. An election result, an appointment announcement, a sanctions listing, or adverse news about a customer's circle each trigger a targeted re-check of the affected files, without waiting for the next full sweep. This lane is what catches the customer who became a politically exposed person last month. FATF guidance on PEPs (Recommendations 12 and 22) cover enhanced ongoing monitoring where additional PEP measures apply; event-driven checks support a risk-based monitoring program.
Relationship reviews are the third lane, aimed at files already flagged. An existing PEP relationship gets re-examined on a schedule: does the source of wealth story still hold, is the transaction pattern still consistent, does the tier still fit. The review closes with a dated decision to keep, adjust, or exit.
The monitoring lanes cover the schedule; the PEP compliance hub covers the duties the schedule serves.
What Changes, and What Each Change Means
Three change types matter. A customer gains a public function and the file moves up. A customer leaves office and risk tapers rather than vanishing. A data source revises its inclusion rules and the scope itself shifts. Each change maps to a re-rating action, not just a note in the file.
A customer taking a prominent public role requires a prompt reassessment: confirm the PEP type, applicable jurisdiction, and relationship risk, then update the tier and handling. Senior management approval, source-of-wealth and source-of-funds checks, and enhanced monitoring apply where the law or assessed risk requires them, not automatically as the same package for every new PEP. The classification logic is covered in PEP risk tiers, and the measures in PEP screening requirements.
Downward moves are slower, and that is the point. When an official leaves office, the risk does not reset on departure day. The EU directive requires firms to keep treating a former officeholder as a risk for at least 12 months after the function ends. It applies risk-sensitive measures until the person is deemed to pose no further PEP-specific risk. Many institutions hold the file longer. A PEP status check at the right moment decides when the window genuinely closes, and the answer becomes a documented re-rating rather than a silent lapse.
Source changes are the quiet ones. A vendor revises who counts as included, a jurisdiction rewrites its domestic scope, and suddenly yesterday's clean file is inside the risk class. When a source shifts, the re-screening scope has to shift with it, which is one more reason the monitoring plan names its sources explicitly.
Keeping the Watch Alive Without Drowning
Manual re-screening does not scale, because the book grows faster than the headcount. The practical split runs tooling on the address side, where the addresses you choose to watch get re-checked continuously, and keeps humans on the person-side reviews that need judgment. Person-side work stays deep; address-side watching needs setup, then holds.
Phalcon Compliance covers the address side of that split. Its Monitor feature is narrower and more concrete than a whole-book watch: addresses you place under Monitor are re-checked automatically, and an alert fires when their risk status changes, in either direction. Monitor slots are allocated by plan, a seven-day trial on the free tier and one slot each on Essential and Scale, with more available as an add-on, so the watch list is a deliberate choice. Results come back on five risk levels, Audit Logs hold the timeline, and exports assemble the evidence when an examiner asks how long the watch has been running.
For the flow of transactions rather than the state of identities, the depth guide is the KYT and transaction monitoring hub; the two watches run side by side in a complete program.
Every guide in this family, from the first screen to the record file, is mapped on the PEP compliance hub.