The Short Answer
Four duties sit on every PEP relationship: identify the status, rate the risk, apply enhanced due diligence where the rules demand it, and keep records that survive inspection. The source is FATF Recommendation 12, which the EU wrote into its directive as a hard duty. This page walks those duties and the EDD measure list behind them. The PEP compliance hub collects the related guides.
The Four Requirements That Apply to Every PEP Relationship
The duties stack. Identification asks whether anyone in the relationship falls inside PEP scope. Rating prices how much risk that adds. Enhanced due diligence adds the stronger measures where required. Monitoring and records hold the file together over time. A regulator supervises the whole stack, not just the first screen.
Identification comes first. You must have risk management systems that determine whether a customer, or the beneficial owner behind a customer, is a politically exposed person, a family member, or a close associate. FATF guidance on PEPs (Recommendations 12 and 22) states the expectation, and it applies when the relationship starts as well as when circumstances change later. The word "systems" carries weight: an ad hoc search when someone remembers is not a system. Examiners test the difference by asking how the determination gets made for every customer, not just the ones that drew attention.
Rating comes second. The status feeds a documented risk assessment that sets how strong your measures must be, weighing the role's influence, the jurisdiction, and the relationship's nature.
Enhanced due diligence comes third. FATF requires additional measures for foreign PEP relationships and for higher-risk domestic or international-organization relationships; local law may require more. Apply the relevant legal minimum first, then calibrate the depth of checks and monitoring to the risk. The next section describes the enhanced measure set when it applies.
Monitoring and records come fourth and continue throughout the relationship, with records retained for the applicable period. Monitoring follows the legal requirements and assessed risk, including enhanced monitoring where required, and judgments are documented. Monitoring without records loses the analyst's knowledge; records without monitoring preserve an outdated picture. The cadence has its own guide on PEP monitoring.
Who supervises the stack depends on where you operate. National regulators write the FATF expectations into local law; EU member states transpose the directive into national law, and from 10 July 2027 the AML Regulation (EU) 2024/1624 applies directly. Crypto businesses meet the same duties through VASP licensing rules, which the VASP compliance hub covers. One boundary note: the definitions compared piece on our blog walks how FATF, the EU, and other bodies word the definition differently; this page is about the duties that wording triggers.
Each duty gets its own section in this guide, and the PEP compliance hub carries the rest of the family.
Enhanced Due Diligence for PEPs: The Measure List
Three measures make up enhanced due diligence. Senior management approval before the relationship starts or continues. Establishing the source of wealth and the source of funds. Enhanced ongoing monitoring. Deciding whether a customer is a PEP is a risk-management duty, not a fourth measure. The measures are institutional actions; software only carries the record of them.
Senior management approval means a person senior enough to own risk decisions signs off before the relationship is established or continued. The rule exists because PEP decisions carry reputational weight that belongs above the analyst level, and because an approver with authority is also an approver with accountability. What passes: a named approver, a date, and a stated basis. What fails: approval logged after the relationship went live, an approver with no visibility into the risk, or a standing blanket approval that covers a quarter's relationships in one signature.
Source of wealth and source of funds checks establish where the money came from, in two senses. Source of wealth is the origin of the customer's total assets: salaries, business ownership, inheritance. Source of funds is where the specific money in this relationship came from. What passes: documented evidence proportionate to the risk, such as declarations, audited accounts, or verifiable business records. What fails: accepting the customer's own sentence about their wealth as the file's entire basis.
Enhanced ongoing monitoring raises both the frequency and the depth of review for the relationship, so that pattern breaks surface faster than they would under standard treatment. The scheduling options are covered in the monitoring guide.
The check that runs before a foreign PEP relationship begins belongs to the risk-management duty above, not to the measure list. The EU directive wrote these measures into law for all obliged entities, not only credit and financial institutions, and extended them to domestic PEPs, so an EU examiner cites the national rule that transposes it.
Risk Assessment: How Much Diligence Is Enough
Diligence depth is risk-proportional. The same political function can carry very different exposure depending on the influence of the role, the corruption profile of the jurisdiction, and how complex the money is. The assessment has to be written down, because a mental model does not survive an inspection.
A senior figure with budget authority in a high-corruption jurisdiction, moving funds through layered structures, may justify deeper evidence and closer monitoring. A lower-risk domestic relationship may justify less additional scrutiny only in jurisdictions allowing that discretion, after all mandatory measures are met. Neither internal tier removes a statutory minimum, and both assessments need documented reasons.
The written assessment holds four elements: the factors considered, the weight each carried, the resulting tier, and the date. Revisit it when the role, the jurisdiction context, or the relationship changes. How tiers are built in the first place is covered in PEP risk tiers.
Records That Answer a Regulator
Inspection day does not accept "we did enhanced due diligence" as an answer. The file needs the timeline of judgments, the basis for each one, the approval trail, and the monitoring history, assembled into something you can hand across the table. The gap between doing the work and evidencing the work is where findings live.
The gap closes on your side of the wall: the approvals, the source of wealth evidence, and the tier reasoning live in your own systems, because that is where the duty sits. What the address side contributes is its own evidence line. Phalcon Compliance screens addresses and transactions, and its PDF and CSV exports, on paid plans, turn the address-side record into an exhibit that sits beside the person-side file. The two halves complement each other: person-side diligence answers who, address-side screening answers what the money touched.
Every duty on this page, and every guide behind it, is mapped on the PEP compliance hub.