The Short Answer
PEP screening checks every customer and business partner against political exposure risk: a current or past prominent public function, or a family or business tie to someone who holds one. A working program runs five steps: profile, screen, handle the match, re-screen over time, and record the decision. For crypto firms the duty traces to FATF Recommendations 12 and 22. The PEP compliance hub collects the related guides.
What Is PEP Screening?
Screening compares the people you do business with against a risk class, not a crime list. FATF defines a politically exposed person as someone entrusted with a prominent public function, and the label reaches their family members and close associates. Screening asks one question per person: does this customer land inside that scope?
A politically exposed person, or PEP, is anyone who has been entrusted with a prominent public function. The definition is about position, not behavior. FATF, the intergovernmental body whose standards most national AML laws copy, spells out who counts in FATF guidance on PEPs (Recommendations 12 and 22). Heads of state and government, ministers, members of parliament, senior judges, central bank board members, ambassadors, and high-ranking military officers all count, and so do directors of international organizations. The label also reaches family members and close associates, because the risk travels with the relationship, not just the job.
PEP screening is the workflow that applies this definition to your customer base. At onboarding, and again whenever something changes, you check whether a customer, a beneficial owner, or a business partner falls inside the scope. In formal policy documents you will see the full phrase, politically exposed person screening; most teams just say PEP screening.
It sits next to two other checks that look similar but answer different questions. Identity checks answer who this person is. Sanctions screening answers whether this person sits on a specific restricted list. PEP screening answers whether this person carries a risk category that calls for stronger due diligence. Each dimension needs its own answer, and one does not replace the others.
Why Crypto Businesses Screen for PEP Risk
The risk is position plus money. Public office gives a person influence over contracts, budgets, and approvals, and that influence can convert into bribes or diverted state funds. Crypto adds pseudonymous addresses and fast cross-chain movement, which makes the laundering side easier to hide. Screening is how the duty reaches you before the money arrives.
In traditional finance, PEP controls grew out of corruption cases where officials moved kickbacks through banks. Crypto firms inherit the same exposure with an extra layer: a wallet address does not announce its owner, and funds can hop between chains within minutes. The customer who looks like a retail user can be acting for someone else, and the onboarding file is often the only place you get to ask.
Regulators have made their expectations explicit. FATF Recommendation 12 asks financial institutions to treat foreign PEP relationships as higher risk, and domestic or international-organization PEPs as higher risk where the assessment says so. The measures that attach are walked in full in the requirements guide. In the United States, the customer due diligence rule frames the problem through four core requirements. A 2020 joint statement by US regulators puts it plainly: PEP screening is not a standalone US requirement, and the status operates as one risk factor inside risk-based customer due diligence.
Each step has its own guide, and the full set is indexed on the PEP compliance hub.
The PEP Screening Process, Step by Step
Most teams run the same five steps, and each step ends with an artifact you can show an examiner. You profile the customer base for exposure, screen names against the risk scope, route matches into tiered handling, re-screen as statuses change, and file the records that prove all of it happened. Here is each step with what it produces.
Step 1: Build a risk-based customer profile
Before the first screen, decide where exposure actually sits in your book. Which customer segments touch politically sensitive jurisdictions, large fiat ramps, or high-value institutional flows? Which products let a single user move large value quickly, and which are small and slow by design? A written profile tells you where to concentrate attention and, just as important, where standard treatment is enough, which keeps the program proportionate instead of blanket-heavy. Regulators read the risk-based approach as a duty to differentiate, not a license to ignore: the profile is the document that shows you differentiated deliberately. The output is a documented picture of where PEP risk concentrates, which becomes your defense for treating segments differently.
Step 2: Run the screen
Check each customer, beneficial owner, and regular business partner against the PEP scope: the person themselves, their family members, and their close associates. In crypto the surface is wider than the account holder. The person behind a corporate customer, the beneficial owner behind a pooling contract, and the business partner on the other side of a recurring flow each carry their own exposure. The screen is only as good as its data sources, and there is no single official list, so serious programs draw on several and note which source answered which query. The mechanics of checking one person in detail have their own guide on how to run a PEP check. The output is a result, clean or matched, with the query and the sources recorded.
Step 3: Handle the match
A hit is not a verdict. First confirm the person, then identify the PEP type, applicable legal measures, and relationship risk. Assign an internal tier without reducing the statutory floor. Apply required measures and any risk-based additional scrutiny; restrict or exit the relationship if it exceeds your risk appetite. PEP screening requirements and EDD covers the duties. The output is a documented decision with a reason.
Step 4: Re-screen as statuses change
A screen taken at onboarding goes stale. Customers gain office, lose it, or move between tiers, and each change has to reach the file. Ongoing PEP monitoring covers the cadence and the event types worth watching. The output is a refreshed status plus updated handling, dated.
Step 5: Record everything
What you checked, when, against what scope, what you decided, and who approved it. This is the layer regulators actually test, because it is the only one that still exists on inspection day. The analysts who ran the screens have moved teams, the context has faded, and the file speaks alone. A record that says "match reviewed, relationship approved" without the basis for either half is a finding waiting to be written. Tie every decision to the evidence it used, date everything, and keep the trail in a form you can export rather than a form you can only screenshot. The output is the file itself.
Screening Results You Can Explain to a Regulator
A match is the start of the work, not the end of it. The pressure shows up later, when an examiner asks why you tiered a customer the way you did. Results you can defend need three things: the raw screen output, the reasoning layer on top, and an export path that hands both over on request.
That last mile is where tooling earns its place, and the halves split cleanly. The person-side judgments on this page, who to screen, how to tier, what to record, run on your names and your process. On the address side, Phalcon Compliance screens addresses and transactions, and every result comes back on five risk levels, Critical, High, Medium, Low, and No Risk. The Risk Analysis page explains why a result landed at its risk level. Audit Logs hold the timeline of screening events, and the two records sit side by side in the file an examiner reads.
Every piece of this workflow, from the first check to the record keeping, has a dedicated guide in the PEP compliance hub.