PEP and sanctions checks on an individual

Who is regarded as a PEP under FATF

A politically exposed person is an individual who is or has been entrusted with prominent public functions. The international standard set out in the FATF recommendations and explained in a separate guidance paper on PEPs distinguishes three groups: foreign PEPs - individuals with prominent public functions in another state; domestic PEPs - the same functions within the country; and individuals entrusted with senior management functions in international organisations.

The key wording of the standard, most often lost when it is paraphrased: the definition of a PEP is not intended to cover middle-ranking or more junior individuals, and the status itself does not imply criminal activity. It is a category of elevated risk associated with the possibility of misusing position and access to public resources, not a characterisation of a particular person.

The practical significance is that the status changes the procedure, not the answer. For foreign PEPs the standard envisages the strictest set of measures: approval of the relationship at senior management level, establishing the source of funds and source of wealth, and enhanced ongoing monitoring. For domestic PEPs and individuals from international organisations, the extent is determined by the risk assessment in the particular situation.

What confirms the status in practice: official information on appointment and powers, publications of state authorities and international organisations, corporate and regulatory disclosures, industry registers. A commercial database is not in itself confirmation - it indicates where to look for the primary source, and the entry in it is verified against that source.

A separate question is the former PEP. The international standard sets no universal period after which the status ceases to apply: the approach is based on risk assessment and takes into account residual influence, the level of the former position and connections that may have been retained. Automatic removal of the status "after a year" is the internal rule of a particular organisation, not a norm.

Why family and close connections require context

The PEP category extends not only to the individual. The international standard includes within it family members and persons known to be close associates: business partners, co-owners of companies, people through whom transactions may be conducted in the interests of the public figure.

The logic of the extension is clear: if the status creates a risk of misuse, then transactions through the inner circle create the same risk, only less visibly. But it is precisely here that unfairness most often occurs. The adult son of a minister who has run his own business for ten years falls into the same category as a nominee holder of assets - although these are fundamentally different situations.

For that reason a connection is always assessed in context, not on the fact of kinship. What is checked is whether there is an economic overlap with the public function: shared companies, joint assets, contracts with organisations subordinate to that person, transactions coinciding in time with an appointment or with decisions taken. Kinship in itself is grounds for attention, not a conclusion about dependence.

Practical significance: the extension of the category should not turn into a deprivation of rights. Regulators in a number of jurisdictions state directly that the mechanical application of the status to all relatives without a risk assessment is an excessive practice that leads to unjustified refusals. The correct approach is to establish the connection and its nature, not to apply a label.

What could not be established is recorded separately. Family connections are disclosed unevenly in open sources: in some places they are public, in others access is restricted by personal data legislation. Such gaps are marked as the limit of the check rather than filled with assumptions.

How a false name match is eliminated

The most frequent error in screening is not that an entry has been missed, but that another person's entry has been attributed to the individual. Sanctions and PEP lists contain names transliterated from different alphabets, with spelling variants, aliases and incomplete identifiers. A name match in such an environment is a routine occurrence, not a finding.

Resolving a match relies on additional identifiers. The comparison covers date or year of birth, place of birth, citizenship and country of residence, identification numbers to the extent lawfully available, position and organisation, the period in which functions were held, and known connected persons. Official search tools, including the European Union public lists and the OFAC sanctions list search tool, provide precisely these fields - and it is these fields, not the name, that support a conclusion.

The outcome of resolution has three states, and all three must appear in the report as separate categories. Match excluded: date of birth, citizenship or other key attributes differ. Match confirmed: several independent identifiers converge. Match unresolved: the record contains insufficient identifiers and the question remains open - this is neither "clear" nor "risk", but expressly stated uncertainty.

The practical significance for the client is direct: a report presenting a sanctions match without resolving identity is more dangerous than no check at all. It creates false confidence in both directions - either the person is unfairly refused, or an actual restriction goes unnoticed because the record was attributed to a "namesake" without verification.

The reverse problem is a miss caused by spelling. One person may appear in different sources under several transliterations, and a search on a single variant produces false reassurance. The search is therefore run across spelling variants, and a negative result is worded with care: no matches were found across the lists and spellings checked as at a specific date.

Direct sanctions and indirect control

Sanctions exposure may be direct or indirect, and the second is harder to detect. Direct exposure is where the person is themselves included in an official list. Indirect exposure is where the person is not included but is connected to a listed person through ownership or control of a company, or acts in that person's interests.

It is this layer that a superficial surname check most often misses. Restrictions under sanctions regimes extend not only to named persons but also to structures they own or control; official European Commission materials on restrictive measures contain guidance on the application of the regimes, including questions of ownership and control. The practical conclusion: it is not only the person's name that must be checked, but their corporate perimeter as well.

Control, moreover, is not limited to a shareholding. It may be exercised through the right to appoint a director, contractual arrangements, financing, powers of attorney, or the de facto determination of decisions without formal participation. Such arrangements are established from corporate registers, disclosures and court records, and where no records exist they remain a hypothesis, expressly identified as such.

Practical significance: an identified indirect connection rarely means an automatic prohibition. It means that the question of whether the regime applies to a specific transaction must be put to a lawyer before the transaction, not after the payment. The wording in the report remains factual: a shareholding is established, a role is established, a connection by dates is established - without any assessment of whether the transaction falls within a restriction.

Changes over time are recorded separately. Ownership and control shift: a shareholding may have been sold, a role terminated, a structure reorganised. Each element therefore carries a period and a date of confirmation - a conclusion that was correct six months ago may be inaccurate today.

Which jurisdictions and regimes apply

There is no single global sanctions list. Regimes are established by different authorities - the European Union, the United States, the United Kingdom, the United Nations and others - and differ in the persons covered, the scope of restrictions and their territorial reach. A person may be absent from one regime and present in another, and both facts will be correct at the same time.

The first question in a check is therefore not "is there a match" but "which regimes apply at all". The answer depends on the citizenship and location of the parties, the currency and route of payments, the jurisdiction of the banks, the place of performance of obligations, and sometimes on the origin of the goods or technology. Screening against a set of lists unrelated to the situation creates noise; missing an applicable regime creates risk.

A practical approach: first the perimeter is defined - who the parties are, where they are located, which jurisdictions the transaction will pass through. Then official sources are selected for each applicable regime - the consolidated EU resources, the official OFAC list search tool and the relevant national publications. The check is carried out against primary sources, not aggregators: an aggregator speeds up the search, but the official record is what confirms the finding.

What this means for the client: the result is always tied to a perimeter and a date. A statement that a person has been "checked against the applicable EU and US regimes as at a given date" is verifiable and useful. A statement that "there are no sanctions" is meaningless, because it identifies neither the regime, nor the date, nor the scope of what was checked.

A separate difficulty is updates. Lists change, persons are added and removed, restrictions are eased and extended. For continuing relationships this means not a one-off certificate, but an agreed frequency of re-checking.

Source of funds and nature of the relationship

Where PEP status is confirmed, the standard calls not for refusal but for an understanding of the economics of the relationship. The key questions are: where the funds involved in the transaction come from, and how the person's wealth was formed overall. These are two different questions, and confirmation of one does not answer the other.

Source of funds is the origin of the specific money in a specific transaction: sale of an asset, dividends, payment under a contract, a loan, an inheritance. It is confirmed by documents relating to the transaction itself. Source of wealth is the history of capital accumulation over the years: business activity, company sales, investments, family property. It is confirmed by biography, corporate history and the sequence of events over time.

The practical point lies in proportionality. The issue is not large wealth held by a public figure as such, but wealth that is not explained by the known history: assets that do not correspond to declared income and identifiable business activity, in the absence of any other explanation. But even this is a question, not a conclusion: an explanation may exist and simply not have been provided.

The nature of the relationship for which the check is being carried out is assessed separately. A one-off transaction for a small amount and a long-term relationship with access to funds require different depth. The standard of the risk-based approach expressly assumes proportionality: the higher the risk and the deeper the relationship, the more detailed the measures.

What is not permissible here: collecting information about a person's property and income without a lawful basis and without a connection to the purpose of the check. The scope is always limited by the question the work is being carried out to answer and by the legal basis for processing the data.

Documenting the decision and periodic review

Screening is valuable not for what it finds, but for what remains after it. The decision - to accept the relationship, to accept it subject to conditions, or to decline - must rest on recorded grounds: what was checked, against which regimes, as at what date, what was confirmed, what was excluded and what remained open.

The minimum content of the record: the perimeter of the check and the applicable regimes; a list of the sources checked with the dates accessed; a log of name spelling variants; the outcome of resolving each material match, with the identifiers used; the PEP status established, with category and period; the ownership and control connections identified; the measures adopted and the reasons for them; a list of open questions.

The practical value is twofold. First, such a record makes it possible to explain the decision - to a bank, a regulator, the board, or to the person concerned, if they ask why the relationship has been structured in that way. Second, it protects against having to repeat the work from scratch: at the next check it is clear what has already been established and what has changed.

Periodic review follows from the nature of the data. Lists are updated, positions change, structures are reorganised, and status may arise for a person who did not previously have it. For continuing relationships a frequency is set - from event-driven checks upon significant changes to regular checks by calendar, depending on the level of risk.

A separate element is recording what could not be checked. A closed register, the absence of lawful access, insufficient identifiers in a record: all of this is part of the result, not a defect in it. A report in which such points are not named looks more convincing, but is of less use.

What cannot be asserted on the basis of screening results

Screening produces a specific and limited result, and most problems arise from wording that goes beyond it. Below is what must not be written, and what it is replaced with.

It cannot be stated that a person has broken the law. Inclusion in a sanctions list is a fact of designation by an authorised body, not a judicial finding of guilt; a PEP status even less so. The correct wording: inclusion in a particular list has been established, with the date and the body; the legal consequences for the transaction are assessed by a lawyer.

A negative publication cannot be equated with a fact. A publication confirms only the fact of publication itself. If it describes proceedings, the primary source is checked - a judgment or an official announcement. Without a primary source it remains an assertion by an unidentified author, and it is recorded with that status.

The absence of findings cannot be presented as a guarantee. The correct wording is tied to the perimeter and the date: no matches were found in the lists and name spellings checked, as at a particular date. This is more honest and more useful than "the person is clean", because it allows the reader to understand what exactly was checked.

Finally, an overall "reliability level" of a person cannot be expressed as a score. Screening answers several separate questions: whether identity is confirmed, whether there is a direct restriction, whether there is an indirect connection, whether the economics of the relationship can be explained. Reduced to a single figure, this information loses precisely what it was collected for.

What a professional process looks like

The sequence is the same for a one-off transaction and for an ongoing relationship - what changes is the depth of each step.

1. 01

   Perimeter and legal basis

   Who the parties are, where they are located, which jurisdictions the transaction will pass through, and whether there is a lawful basis for processing information about the person.

2. 02

   Collection of identifiers

   What is known about the person besides the name: year of birth, citizenship, position, companies. Whether matches can be resolved depends on how many of these there are.

3. 03

   Identification of the applicable regimes

   Which sanctions regimes and sources fall within this perimeter, and which are pointless to check.

4. 04

   Search across spelling variants

   Transliterations, aliases, abbreviations; a log is kept of the variants used in the search.

5. 05

   Resolving matches

   Every material match is checked against additional identifiers and assigned a status: excluded, confirmed, or unresolved.

6. 06

   PEP layer

   Category, period of public function, close circle with verification of the nature of the connection, not merely the fact of kinship.

7. 07

   Ownership and control

   The person's corporate perimeter: holdings, roles, control mechanisms and overlaps with listed persons.

8. 08

   Recording the decision and review

   Grounds, measures taken, open questions, date of currency and the frequency of re-screening.

Identity is confirmed before a finding is interpreted, not after. The reverse order is precisely the cause of most unjustified refusals.

What the client receives as a result

The material must be fit for a decision, for a conversation with a bank, and for explaining the matter to the person concerned.

1. 01

   Perimeter and applicable regimes

   Which jurisdictions and lists relate to the situation and why those in particular.

2. 02

   Log of sources and spellings

   What has been checked, as at what date, and under which variants of the name.

3. 03

   Resolving matches

   For each material match: excluded, confirmed or unresolved, with the identifiers stated.

4. 04

   PEP profile

   Category, period of public function, seniority of the position and connected persons with the nature of the connection.

5. 05

   Map of ownership and control

   Holdings, roles and control mechanisms with dates and overlaps with listed persons.

6. 06

   Economic layer

   What is known about the source of funds and the source of wealth, and what requires documentary confirmation.

7. 07

   Recommended measures

   What follows from the findings: additional questions, conditions of the relationship, frequency of review.

8. 08

   Open questions and limitations

   What could not be confirmed, for what reason, and which question is referred to a specialist lawyer.

Limitations and the lawfulness of methods

Checking a person involves his or her personal data. In the European Union such processing requires a lawful basis under GDPR, and where legitimate interest is chosen as the basis, a proportionality test is carried out: the client's interest is weighed against the person's rights and reasonable expectations. EDPB guidance describes this test directly, and the technical availability of information does not substitute for it.

This entails a practical limitation on scope: what is checked is what relates to the purpose. Information about private life, health, opinions and family circumstances is not part of the screening unless it bears directly on the question and has an independent lawful basis.

BLACKFILE works from official sanctions lists and publications of competent authorities, corporate registers, court and regulatory materials, information on public functions, and data provided by the client. Access to closed state systems, banking secrecy or private correspondence is not used and is not offered.

• does not establish guilt and does not replace a decision of a competent authority
• does not determine the applicability of a sanctions regime - that is for a lawyer
• does not remove a person from official lists and has no effect on them
• does not issue a certificate that no sanctions apply and does not guarantee a bank's decision
• reflects the state of the sources as at the agreed date
• the absence of matches is not confirmation of good faith

What to prepare for the initial assessment

No documents or personal data are needed at the first step - a description of the situation is enough.

• what decision is being made: a transaction, an investment, a hire, a partnership, the opening of a relationship
• the person's citizenship and country of residence, if known
• which jurisdictions are involved in the operation and through which banks the payments will run
• whether the position, companies or public function are known
• what the automated screening has already shown and what raised doubt
• whether there is a lawful basis for the check and whether the person must be notified
• whether a one-off check or periodic review is required

Passport details, bank documents and scans do not need to be sent at the first step. The set of materials is determined after the perimeter and the legal basis have been agreed.

Frequently asked questions

• 01

  Does PEP status mean that a person cannot be dealt with?

  No. FATF guidance states directly that the status does not imply criminal activity. It calls for additional measures: understanding the source of funds and wealth, enhanced monitoring, and, for foreign PEPs, approval of the relationship at senior management level. Automatic refusal of all PEPs is regarded by regulators in a number of jurisdictions as excessive practice.

• 02

  How does a sanctions match differ from PEP status?

• 03

  What should be done if a name matches?

• 04

  Is a check against a single database enough?

• 05

  Are relatives checked?

• 06

  How often does the check need to be repeated?

• 07

  Can a certificate confirming the absence of sanctions be issued?

• 08

  Who decides whether an operation falls under a restriction?

Screening answers several questions; it does not pass a verdict

A list-based check is useful precisely to the extent that its layers are kept apart. A name match, a public function, a connection through a company and the applicability of a regime are four different questions with different answers and different consequences. Collapsed into a single conclusion, they produce either an unfair refusal or false reassurance.

The value of the work therefore lies not in the speed of the screening but in what remains after it: resolved matches with the identifiers stated, the category and period of the status, a map of connections with dates, open questions named, and a clear date as at which the material is current. With such material a decision can be taken - and explained.

Официальные источники

• FATFPolitically Exposed Persons (Recommendations 12 and 22)проверено 06.08.2026

  Guidance on politically exposed persons: PEP categories, close associates, the scope of additional measures and the express statement that the status does not imply criminal activity.

• European CommissionOverview of sanctions and related resourcesпроверено 06.08.2026

  Official EU resources on restrictive measures: consolidated lists and explanatory guidance on application, including questions of ownership and control.

• OFACSanctions List Searchпроверено 06.08.2026

  The official search tool for US sanctions lists, with additional identifiers by which matches are resolved.

• EUR-LexRegulation (EU) 2016/679 - GDPRпроверено 06.08.2026

  Grounds for processing personal data and the principles of minimisation and purpose limitation, which determine the permissible scope of a check on a person.

• EDPBGuidelines 1/2024 on processing based on Article 6(1)(f) GDPRпроверено 06.08.2026

  An analysis of legitimate interest as a basis for processing and of the proportionality test against the rights and reasonable expectations of the individual.

Связанные материалы

Case

Map of assets and interests of a connected group of persons

Establishing the property and corporate interests of a group through independent sources

• 01 /ServiceIndividual Due Diligence→
• 02 /ArticleRed flags when checking an individual→
• 03 /ArticleWhat a check on an individual shows before entering a partnership→
• 04 /ArticleWhen Enhanced Due Diligence is required→
• 05 /ServiceSanctions and PEP screening→