Politically Exposed Persons present one of the most significant AML risks for UK law firms. The combination of public influence, access to state resources, and — in many jurisdictions — limited financial transparency makes PEPs a high-priority target group for money laundering risk management. Regulatory failures in PEP screening are among the most common findings in SRA AML inspections, and the consequences of getting it wrong — whether by missing a PEP or by applying disproportionate measures to a low-risk domestic official — can be severe.

This guide explains who counts as a PEP under UK law, how to build an effective screening programme, and what enhanced due diligence obligations apply once a PEP is identified.

What Is a Politically Exposed Person?

The term “Politically Exposed Person” is defined in Regulation 35(12) of the Money Laundering Regulations 2017. A PEP is an individual who is, or has been, entrusted with a prominent public function. The Regulation sets out specific categories:

The PEP Categories

Heads of state and government. Monarchs, presidents, prime ministers, and the equivalent highest executive officeholders in any country.

Senior politicians. This covers individuals who are, or have been, members of parliament or of equivalent legislative bodies, members of governing bodies of political parties, and ministers or their equivalents at national level. Note that this is not limited to the UK — a member of the French Assemblée nationale or the German Bundestag is a PEP for these purposes.

Senior judicial officials. Members of supreme courts, constitutional courts, and equivalent high-level judicial bodies whose decisions generally cannot be appealed.

Senior military officials. Senior members of the armed forces at a level equivalent to general or admiral, or their equivalent ranks.

Senior public servants. Ambassadors, chargés d’affaires, and senior civil servants at a level equivalent to permanent secretary or above.

Senior executives of state-owned enterprises. Members of the management boards or supervisory boards of state-owned enterprises — companies in which a government holds a controlling interest.

Senior officials of international organisations. Directors, deputy directors, and members of the board (or equivalent) of international organisations (the UN, IMF, World Bank, EU institutions, etc.).

Family Members and Close Associates

The PEP obligations do not apply only to the PEP themselves. Regulation 35 extends to:

Immediate family members, meaning:

Spouses or civil partners
Partners equivalent to spouses (de facto partners)
Children and their spouses or partners
Parents

Known close associates, meaning:

Individuals known to have joint beneficial ownership of a legal entity or legal arrangement with the PEP
Individuals known to have close business relations with the PEP
Individuals known to be the sole beneficial owner of a legal entity or legal arrangement set up for the benefit of the PEP

The “known” qualifier matters: firms are not required to investigate all personal or business connections of every PEP client. But if a firm knows — from the onboarding process, the matter itself, or open-source information — that a client has a close association with a PEP, that association triggers the EDD requirements.

Domestic PEPs: A Calibrated Approach

The Fifth Anti-Money Laundering Directive introduced a distinction between domestic and foreign PEPs that was transposed into UK law through the 2019 amendments to the Regulations. UK firms must apply enhanced due diligence to all PEPs, but the Regulations require a risk-based calibration for domestic PEPs (those holding prominent public functions in the UK).

For domestic PEPs, firms must assess the level of risk before automatically applying the full EDD package. A serving UK MP presents different risks from a former senior minister in a high-corruption jurisdiction. A local council leader is different from a FTSE state enterprise board member. The principle is proportionality: apply measures commensurate with the actual risk.

The FCA has published guidance (which the SRA broadly endorses) encouraging firms to treat domestic PEPs proportionately rather than reflexively applying the same EDD to a low-risk UK county councillor as to a high-risk foreign head of state.

PEP Risk: Why the Concern Is Real

The rationale for heightened PEP scrutiny is straightforward. Corruption — public officials abusing their positions for personal gain — generates very large sums of money that need to be laundered through legitimate channels. The legal sector, with its client confidentiality protections, involvement in large transactions, and handling of client money, is an attractive vehicle.

The scale is significant. The National Crime Agency estimated that £100 billion in money laundering flows through the UK annually, with a substantial proportion linked to foreign PEPs and their associates investing in UK property and businesses. High-profile enforcement cases have repeatedly involved law firms (sometimes unwittingly) acting on property purchases funded by the proceeds of foreign corruption.

Building an Effective PEP Screening Programme

Initial Screening at Onboarding

PEP screening must be applied at the start of every new business relationship with an individual client (or, for corporate clients, every beneficial owner). This means checking the client’s identity against a PEP database before opening the file and beginning substantive work.

Commercial PEP databases aggregate data on hundreds of thousands of PEPs and their associates globally. Major providers include LexisNexis, Dow Jones Risk & Compliance, World-Check (LSEG), and ComplyAdvantage. Subscription to a reputable commercial PEP database is standard practice for any firm doing significant client-facing work in scope.

Key considerations when evaluating a PEP database:

Coverage — does it cover global PEPs at all the required levels (heads of state down to state enterprise executives)?
Freshness — how frequently is the data updated? A database that is months behind the news cycle will miss recent appointments and departures
Family and associate coverage — does it include family members and close associates, or just the PEP themselves?
Disambiguation — false positives (matching a client to an unrelated person with a similar name) are common; the system must allow firms to document and dismiss non-matches
Auditability — can the firm generate a record showing that a check was conducted, on what date, against what database, and with what result?

Sanctions Screening Alongside PEP Checks

Sanctions screening is a distinct legal obligation from PEP screening but is typically conducted simultaneously. A client who appears on the UK Office of Financial Sanctions Implementation (OFSI) consolidated list of financial sanctions targets, or on the UN or EU sanctions lists, must not receive legal services in most circumstances (subject to limited OFSI licensing exceptions).

The overlaps between PEP and sanctions lists are significant — many sanctioned individuals are or were PEPs. Running both checks together is operationally efficient and reduces the risk of a client slipping through a gap between the two programmes.

Adverse Media Screening

For higher-risk clients — and as part of EDD for confirmed PEPs — adverse media screening adds a further layer. This involves searching open-source information (news databases, regulatory filings, court records) for negative information about the client. Commercial tools that automate adverse media screening are available, but manual searches using Google News, LexisNexis, and relevant local media can supplement automated checks for particularly high-risk clients.

Ongoing Monitoring

Screening is not a one-time exercise. PEP status changes: a client who was a private individual when you onboarded them may subsequently be appointed to a senior public role. A client who was a PEP may cease to hold a public function — but the Regulations require them to continue to be treated as a PEP for at least 12 months after departure.

Firms must therefore maintain ongoing monitoring of client relationships. This means:

Periodic re-screening — re-running PEP and sanctions checks on existing clients at regular intervals (the appropriate frequency depends on risk; annually is a common minimum for active relationships)
Trigger-based re-screening — re-screening whenever a matter changes significantly, when new instructions are received on an existing matter, or when information comes to light that changes the risk profile
Monitoring services — some commercial PEP databases offer monitoring services that notify the firm if a client’s status changes; these are valuable for firms with large client bases

What to Do When a PEP Is Identified

Do Not Proceed Without EDD

When a PEP (or family member or close associate of a PEP) is identified, the firm must not proceed without completing enhanced due diligence. This is a legal obligation, not a matter of policy discretion.

Gather Additional Information

EDD for a PEP must include, as a minimum:

Source of wealth — how did the PEP accumulate their overall wealth? For most senior public officials, a salary is unlikely to explain substantial assets. Firms need to understand whether the wealth is plausibly consistent with the stated career history.

Source of funds — specifically, where did the money for the transaction in question come from? This should be traced back to a verifiable legitimate source.

The PEP’s current position and history — what role does (or did) the PEP hold? How long have they held it? Is the jurisdiction one associated with significant corruption risk?

The purpose of the transaction — does the transaction make sense given the PEP’s profile and the stated purpose of the instruction?

Senior Management Approval

EDD for PEPs requires approval by a member of senior management before proceeding. This is a firm requirement of Regulation 33(5). The approver must have reviewed the EDD file, considered the risk, and reached a documented conclusion that the relationship is acceptable.

Heightened Ongoing Monitoring

Once a PEP relationship is established, it requires more intensive ongoing monitoring than a standard relationship. The frequency and intensity of monitoring should be calibrated to the specific risk level of the PEP.

Documenting PEP Decisions

Every PEP screening decision — whether it results in a match, a dismissed false positive, or a confirmed PEP triggering EDD — should be documented in the client file. The documentation should record:

The date the check was conducted
The database used
The result of the check
The nature of any match (confirmed PEP, family member, close associate, or false positive)
The firm’s assessment of the risk level
The EDD measures applied
Senior management sign-off (where required)
The decision to proceed or decline

This audit trail is essential if the SRA inspects the file or if the matter subsequently comes to the attention of law enforcement.

Common PEP Screening Failures

The SRA’s inspection reports and enforcement decisions highlight recurring failures in PEP screening:

Relying on client self-declaration. Asking the client whether they are a PEP, without independent verification, is not compliance. It gives comfort without assurance.

Checking only at onboarding. Failing to re-screen existing clients allows PEP status changes to go undetected.

False positive dismissal without documentation. Dismissing a name match as a false positive is often correct, but it must be documented — not simply discarded.

Treating all PEPs identically. Applying the same EDD package to a retired local councillor as to a serving foreign minister is disproportionate and creates operational inefficiency without improving compliance quality.

No EDD actually completed. Identifying a PEP but proceeding without completing EDD — often under time pressure — is the most serious failure. The SRA will not accept deadline pressure as a justification.

Obiter automates PEP and sanctions screening at the point of client onboarding, with ongoing background monitoring that alerts your MLRO if a client’s status changes between matters. This means your fee earners are never in the position of having acted for a PEP without the firm knowing — and your compliance records are audit-ready from day one.

PEP Screening for Law Firms: Your Complete Guide