Understanding PEPs in Banking: Risks, Challenges, and How to Manage Them

While all banks have a variety of customers, a small group is subject to a risk level that is far beyond the usual. Politically Exposed Persons (PEPs) are among the most critical compliance risks that a financial institution needs to address. By definition, they are not criminals, and most PEPs never commit any crime. However, they are on government money, have a strong influence over government decisions, and are close to power; they are an easy target for corruption schemes and money laundering networks.

For compliance teams, now that you know what PEP in banking is and what PEP status entails for a customer relationship, you should understand how to handle the risks at play. The regulators around the world would be looking to place a higher level of scrutiny on these individuals, and the repercussions of making a mistake could be significant: fines, reputational damage, and even loss of a banking license could be on the horizon. This article explains what constitutes a PEP, why banks should consider screening for them, the challenges and issues that come with screening for PEPs, and how they should approach such relationships in a responsible manner, including how modern AML tracking software can help make it more manageable.

What Is a PEP in Banking?

A Politically Exposed Person is normally a person who has, or recently has, held a high public office. This encompasses the delegations of heads of state, heads of government, government ministers (any level), members of Parliament or a legislative body, senior military officials, ambassadors, judges on the High Court, executives (managing directors) of State-owned enterprises, and officials on the governing boards of central banks. The label does not have to be applied to the person who has the condition. The relationships between any family members of a PEP, close business associates, and anyone who has beneficial ownership of assets associated with a PEP may be the same.

PEPs are defined in a handful of categories by the Financial Action Task Force (FATF), which is the international standard-setter on anti-money laundering regulations. Foreign PEPs are those who have a position in a foreign country to the bank; domestic PEPs are those who have a position within the country in which the bank operates; and PEPs are those who have a position associated with an international organization like the United Nations or World Bank. A common mistake that many compliance teams make is that a person can be a foreign PEP in one jurisdiction and a domestic PEP in their own jurisdiction; this could mean that the same person would be treated differently in the screening process, depending on the jurisdiction the transaction is occurring within.

What does it imply for a bank when a customer is deemed to be a PEP? It implies that the customer is unable to go through the typical onboarding procedure. If a person is identified as a PEP due to having access to funds from a government account, sending messages from government official letterhead, or being listed on public records or in the news media as a PEP, the bank is expected to add further levels of due diligence before opening or keeping the account of that PEP. This would be the case regardless of whether the information is not definitive. Where reasonably practicable, there is evidence of a connection to a prominent public role either from public registers or from media reports.

Why PEPs Carry Elevated Risk

PEPs are not necessarily dishonest; it is simply a concern. But their nature means they have unparalleled access to public funds, government contracts, and government decisions that open up the opportunity for them to use it for any purpose they wish, even if they are not themselves responsible for the misuse. A PEP could be tapped by other people seeking to channel gifts through them to sway legislation; or they may be coerced into making deals for private gains that would cost taxpayers.

Some of the risks that banks must be alert to are the laundering of proceeds of bribery, embezzlement, and wire transfers, as well as the use of shell organizations to disguise the source or destination of money and financial systems to hide criminal activity, such as extortion or theft on a large scale. However, in some instances, and this is less common, PEPs have also been associated with networks involved in fund transfers to support funding for terrorist activities, further emphasizing the importance of screening properly.

There's also the good old-fashioned reputation risk that's understated. If a bank is involved with a PEP who is found to be corrupt, even if the bank has not done anything wrong, it can harm public perception and lead to investigation by shareholders, journalists, and the regulators. But the fines for noncompliance in this instance have been hefty. Enhanced Due Diligence is an expectation and not a nice-to-have because banks around the world have paid huge fines for failing to ensure that they enforce sufficient PEP due diligence.

The Regulatory Backdrop

While there is no universal global law that regulates how PEPs need to be treated, expectations based on the FATF recommendations are fairly consistent and are implemented in various ways in different jurisdictions. The Bank Secrecy Act and the Foreign Corrupt Practices Act have introduced increased due diligence and suspicious activity reporting practices, overseen by the Financial Crimes Enforcement Network, in the United States. The European Union directly mentions PEPs in its Anti-Money Laundering Directives, which require constant monitoring and risk-based compliance programs. The definitions of money laundering under the United Kingdom's Money Laundering Regulations are similar to the FATF definitions, while other countries have their own sets of regulations that would also benefit from enhanced scrutiny, including Australia, Canada, and Singapore, which have their own regulations, with some differences, such as the duration of a domestic PEP's classification.

This is one of the reasons compliance with international standards is so complex. There may be variations in the requirements for enhanced due diligence across jurisdictions, and how a transaction is processed in the first jurisdiction may not be covered by enhanced due diligence in the second, which banks serving international clients will need to bridge without gaps in risk coverage.

Why Banks Struggle with PEP Screening

It is obvious that there is a genuine clash of perspectives when it comes to screening for PEPs, even in well-resourced institutions, and it is predictable that it appears in a number of similar places.

• There is always a need for more accurate and more data. Trying to identify a PEP relies on information found in government watch lists, court documents, media reporting, and commercial databases, and none of these sources are kept up to date or formatted in a uniform way. Transliterations tend to differ in various languages, and misspellings are possible, and people may use nicknames. With incomplete and stale data, compliance teams get notified of alerts that are irrelevant, and sometimes they may not be notified of the relevant alerts.
• There's a lot of wasted time on false positives. Automated screening tools often identify customers with a similar name to a customer with a known PEP, but who did not have any of the corresponding relationships. Each of these cases would require manual review to resolve and, particularly in high volumes of false alerts, the onboarding for all customers would be hampered, not only for the high-risk ones. It leads to a frustrating situation where a legitimate client has to wait longer for the accounts to be approved, while at the same time incurring a longer experience for customers.
• Risk profiles don't have to be forever. PEP can be a rapidly changing situation. Individuals could leave office, be reappointed, or get newly caught up in a political hot mess, and none of these changes occur in a predictable fashion. Risk assessments cannot be done at one point at staff induction; their continued monitoring is needed, and many institutions carry out assessments on a periodic basis but not often enough to detect changes as they occur.
• The added difficulty of inconsistencies across jurisdictions only exacerbates the issues. Domestic PEP is mandatory in some countries and optional in others, and, similar to the definition of close associates, definitions of who is a family member differ as well. A multinational bank will need to develop a compliance programme that meets the highest standard in each market in which it works, but is nonetheless effective.
• Fragmentation of operations slows down the whole process. Enhanced due diligence often involves gathering data from various systems, such as case management, customer relationship management (CRM) and external data feeds. Without such integration, compliance officers end up having to manually collate information from disparate sources, adding to time and error rates when making a decision.

Supporting children and young people who have been identified as having a PEP, Beyond Screening

Challenges in Identifying and Managing PEPs, Beyond Screening

However, once a customer has correctly been identified as a PEP, then ongoing management presents additional challenges. Compliance teams must ensure that a person's risk status has changed, establish that the source of their wealth is legitimate, and periodically review if the business relationship with the person should continue based on the information at the time.

A difficult aspect is to decide when a former PEP ceases to be a PEP. Enhanced monitoring may be reduced after fixed time periods (typically 3-5 years from the end of a public office-holding term), or monitoring may be increased indefinitely, particularly for foreign PEPs in some jurisdictions. Either misjudging or under- or over-monitoring is problematic: under-monitoring leaves the bank liable, and over-monitoring is a waste of bank resources and may damage the customer relationship.

One challenge is to keep compliance staff up-to-date. Training needs to be an ongoing process, as regulations change, new PEP categories come to the fore, and screening technology is continually evolving. Those companies that regard compliance training as a tick-the-box type process are often left behind when the regulatory environment changes; this occurs more frequently than many would imagine.

How Banks Can Mitigate the Risks of Working with PEPs

However, this doesn't mean that banks should not deal with PEPs at all. Working with these customers in most cases is quite appropriate with a proper relationship. There are a number of practices that are regular and will make the difference between those institutions that do this well and those that don't.

1. Develop a multi-layered, improved due diligence process. Good programs don't use the same due diligence process for each PEP, but ramp up the rigor based on the degree of risk. A domestic PEP, which comes from a low-corruption jurisdiction with a clear means of income, is not eligible for the same level of scrutiny as a foreign PEP from a high-risk jurisdiction with opaque business transactions. This risk-based approach ensures compliance resources are targeted to where they are needed, and not where they're not.
2. Make higher quality, more integrated data investments. When institutions use the data from a single vendor, or it's not updated often, they tend to miss some things. Having several sources of structured data, such as watchlists, court records and adverse media, provides a more complete picture and minimises the risk of missing the mark and of false positives.
3. Adverse media screening should be seen as an integral part of the process, not an add-on. It is not unusual for political links or new scandals to be in the news before official documents do. Monitoring negative news that is built into the ongoing relationship, instead of just at onboarding, will enable banks to detect changes in risk earlier.
4. Continuously monitor, not periodically. Political exposure is subject to change and can be rapid, so constant monitoring that alerts to emerging political developments in near real time is much more effective than periodic reviews on an annual basis. One of the places where technology has had the most impact over the last few years is with the taking of continuous data at scale, which is simply impractical for institutions with large customer bases.
5. Ensure good investment in staff training and work organization. But no amount of data and technology can be as useful as humans who understand how to interpret the alerts it produces. Compliance officers must be trained to see what constitutes a legitimate "red flag" as well as have operational systems in place to respond to those red flags in a timely fashion without having to suffer from the pain of low-quality alerts that simply waste time.

The Role of AML Tracking Software

This is where AML tracking software has become the need of the hour, not an option. Today's platforms employ machine learning and natural language processing algorithms to filter through thousands of structured data sources, and even match names that might vary in spelling, transliteration, or aliases. This directly solves one of the largest issues when using manual screening: the volume of false positives resulting from simple name matches.

Good AML tracking software also has the ability to create, maintain, and update structured, entity-based profiles that are kept up to date with new information, instead of a compliance officer having to re-evaluate a customer's file on a regular basis. Other platforms have a graph-based relationship mapping that represents a PEP’s relationship with his/her family members, business associates, and associated entities, which can be visually represented, making it very easy to identify indirect exposures that are almost impossible to identify by manual review. The adjustable matching parameters also enable institutions to tailor the sensitivity of their screening process according to their risk appetite, not by using the same screening level for all customers, irrespective of context.

The AI-powered screening, automated risk profiling, and integrated data feeds will not replace the need for human judgment, but they will do much to free up the compliance team's attention to focus on the matches that warrant it and not miss out on while bogged down by a barrage of low-value matches.

Also Read: What is the source of funds (SOF) & source of wealth (SOW): AML guidance

Final Thoughts

The fact that PEPs have access to and influence over banking activities always means they are a much higher risk category for banks. The purpose of the compliance team is not to prevent these relationships but to create a balance of policy, technology, and judgment to facilitate the management of these types of relationships. Knowing what 'PEP' is in banking, knowing what PEP status implies in terms of level of scrutiny, and building processes that take into account the real-world difficulties in determining and managing PEPs are all initial steps.

When banks invest in good data, risk-based due diligence, ongoing monitoring, and accurate AML tracking software, they are in a much better position both for regulatory compliance and to prevent costly and damaging consequences to their institutions when they get it wrong. With regulations becoming stricter and more rigid, the approach of doing PEP management as a "check-the-box" exercise is not a viable option anymore. The ones that will stay ahead are those that continue to make improvements as the risks, technology, and regulations still evolve.

Ixsight provides Deduplication Software that ensures accurate data management. Alongside, Sanctions Screening Software and Data Cleaning Software are critical for compliance and risk management, while KYC Risk Scoring enhances data quality. Additionally, CKYCRR 2.0 Upload Software supports streamlined regulatory reporting and seamless compliance processes, making Ixsight a key player in the financial compliance industry.

FAQs