Understanding Politically Exposed Persons (PEPs) & AML Compliance

Every single day, banks onboard customers with, or have had in the past, substantial amounts of public authority or influence. These customers are called Politically Exposed Persons (PEPs). PEP’s influence over public funds and policy position them at a greater risk of engaging in corruption and money laundering. This significant risk is reflected in the global PEP screening market with a projected growth of 13.2% from USD 1.87 billion in 2024 to USD 5.37 billion in 2033.

For banks, fintechs, NBFCs, and any regulated entity in India, the screening of PEPs as well as checking against sanctions lists is required by law as part of the KYC policies outlined in the KYC Master Direction and Prevention of Money Laundering Act (PMLA) 2002 established by the Reserve Bank of India. This guide will provide an explanation of what PEPs and sanctions are, who they apply to, and how to create a fast, accurate, and audit-ready compliance process.

What Are Sanctions and Why Do They Matter?

Sanctions are government or international organization-imposed limits that restrict an entity or individual from conducting any financial transactions with another individual, entity, or country. The intent of these restrictions is to limit access to financial resources for those actively involved in terrorist acts, the non-proliferation of illegal weapons, major human rights abuses, and major financial crime. Engaging in any financial transactions with individuals or entities that appear on a sanctions list is illegal and exposes the individual or business to significant liability.

Who Issues Sanctions?

Sanctions lists are kept and updated periodically by multiple agencies, and all businesses regulated by any of them must screen their business transactions against those lists:

• United Nations Security Council (UNSC) – Most often relied upon globally for sanctions.
• U.S. Department of Treasury Office of Foreign Assets Control (OFAC) – Maintains the Specially Designated National’s (SDN) List.
• European Union (EU) – Provides specific sector sanctions in the areas of energy, military, and banking.
• Government of India (India) – Enforced primarily through the UAPA Act, financial alerts/notifications issued by the Securities and Exchange Bank of India (SEBI), and watch lists issued by the Financial Intelligence Unit of India (FIU-IND)

Consequences of Transacting with an Entity that is Sanctioned?

Consequences of transacting with a sanctioned entity are somewhat severe and will likely occur quickly and include:

• Freezing of your bank or financial institution’s banking account(s) according to the UAPA, 1967
• Fines from the Reserve Bank of India (RBI), SEBI, or FIU-IND
• Loss of correspondent banking relationships
• Severe long – term reputational damage
• Criminal prosecution (in severe cases)

What Are Sanctions Lists and Why Do They Matter in Compliance?

Sanction lists are the authorities that keep track of people, groups and countries regarded as a threat to global security or in violation of International Law. The UN Security Council started these lists in 1966 and they are now considered to be one of the most important tools in global financial compliance for everything from terrorism financing; physical weapons proliferation; financial crime; cyber; and government corruption.

Businesses that are regulated in India are required by law to screen their customers against these lists at the point of onboarding as well as continue to screen throughout the life of the customer relationship.

Key Challenges in Conducting Effective Sanctions Checks

Even if it seems simple to screen names against relevant sanctioning lists, screening names against those lists is one of the most complicated aspects of being compliant with AML legislation. Here’s why:

1. Manual Checks Are Inefficient and Risky

Doing name checks manually is a slow process with inconsistent results and doesn’t scale well. In high-volume onboarding, even one mistake during a manual check could allow for an individual on a sanctions list to be missed completely.

2. Sanction Lists Are Large, Dynamic, and Complex

Sanction lists vary greatly in size and are constantly changing, making it difficult to keep track of all the changes: Sanction lists include many different individuals with multiple aliases; Companies with very complex ownership structures; and Sanction lists are updated frequently by each of the following authorities: United Nations (UN), Office of Foreign Assets Control (OFAC), and European Union (EU) – all at the same time.

3. Missing Standards and Contrasting Laws Across Different Countries

A particular client may have been cleared to conduct business in India, according to the Indian Securities and Exchange Board; however, that same client may still be prohibited from doing business by OFAC or the EU. Different jurisdictions have different sanctions lists, and different thresholds for screening and reporting requirements. Therefore, businesses with operations in more than one jurisdiction will experience considerable complexity related to compliance.

4. Missed Matches: False Positives, False Negatives, and Duplicate Alerts

Common names will produce incorrect matches or name matches will consume inordinate amounts of time for compliance teams to resolve. Whenever a true risk is missed because a compliance team was overwhelmed by false matches, there is real risk to a financial institution. Whenever duplicate alerts are triggered for the same customer, compliance teams are subjected to additional unnecessary escalations related to that customer. Similarly, all three of these items delay effectiveness in overall customer onboarding.

5. Inaccurately Identifying a Sanctioned Person

An individual’s name alone will not provide sufficient opportunity to make a correct determination that the individual is sanctioned. In order to accurately identify a sanctioned individual, you must also cross-reference the individual’s date of birth, nationality, passport numbers, and entities with which the individual does business; otherwise, you take a significant risk when determining whether or not the individual is sanctioned.

Why PEP and Sanctions Screening Must Go Together?

After experiencing the sheer complexity of simply screening for sanctions, a meaningful question is, what is the outcome of conducting a sanctions screening and also having a politically exposed person/Sanctions Risk but missing the associated PEP risk? 

PEPs and sanctions are closely related in ways that many businesses do not realize. PEPs aren’t automatically associated with criminal activity, however their position allows the potential for misuse of public funds. With potential for escalating, potential for Commission of crime through corruption; ties to a sanctioned regime and/or commitment of financial crimes would eventually lead to the individual being on an established sanctions list.

By the time the individual is placed on an established sanctions list; any institution that has only conducted a sanctions screening at the time of onboarding will have missed the opportunity to screen for the individual.

Consider the following:

• Sanctions screening will tell you who is legally prohibited from conducting business.
• PEP screening will tell you who may potentially be considered high-risk based on their title and/or influence.
• One instantaneously has the full view of who someone may be both during onboarding screening as well as ongoing screening by running both sanctions and PEP screenings together.

Who is considered a politically exposed person (PEP) in India?

A PEP defined under India’s Prevention of Money Laundering Act (PMLA), 2002 and the Reserve Bank of India’s (RBI) KYC Master Direction is someone who currently holds or has recently held an important position in a public capacity, giving them the potential to influence public funds, policy and/or government contracts.

Examples of PEPs include 

• Senior government officials, 
• Members of Parliament and state legislators, 
• Judges, 
• Military officers and 
• Directors of state-owned enterprises. 

These individuals’ immediate family members and close associates are also subject to a consideration of being a high-risk customer according to these laws and regulations.

Types of PEPs

All Politically Exposed Persons (PEPs) present varying degrees of risk. Determining which type of PEP you are working with establishes how far to go with due diligence.

1. Government Officials: These individuals make decisions regarding the use of public funds and/or influence public policy and are the highest risk and, therefore must undergo extensive scrutiny.

2. Close Associates: They provide facilitation or some kind of assistance to PEPs for example; facilitating the movement of wealth/assets or leveraging the politicians influence. The risk in this type of relationship is more indirect but does exist and must be screened.

3. Immediate Family Members: They are or will be beneficiaries of their PEP relative’s wealth/assets and possibly hold or transfer/receive wealth/assets that belong to the PEP. There is an inherent potential risk and requires enhanced due diligence.

4. Domestic PEPs vs Foreign PEPs: PEPs in India will be reviewed by an Indian regulatory body, however, PEPs from other jurisdictions are more likely to be exposed to risk due to a lack of access to information about the workings of that jurisdiction; as such it is necessary to conduct an international PEP screening.

Step-by-Step Process for PEPs and Sanctions Screening in AML Compliance

A proper PEP and sanctions screening requires more than simply marking a box, it is an entire process from end-to-end. This is how it should be performed. The flow for PEP/Sanctions screening is the same every time a new customer arrives, until after they have been on-boarded and continuously monitored.

Step 1 – Collect Identity

Gather the potential customer’s full legal name, date-of-birth, address, PAN, and a government issued id i.e. driver’s license. For businesses, you will also collect the type of business that the customer is engaged in and the UBOs for the business.

Step 2 – Digital KYC to Validate Identity

Scan the customer’s identity documents with OCR to verify their identity (and hold the documents for re-verification upon requiring their return). Take a photo of the customer’s face and scan it for a likeness to their identity document and ensure the customer is physically present when providing their ID.

Verify both the PAN and Aadhaar with the Central Government database to validate that both numbers are accurate before continuing with your process.

Step 3 – Collect Business/Ownership Information

For business accounts, find out the names of all the directors and UBOs for the business, as well as shareholders. To be clear, the reason that you will need to document all of the UBOs and share holders for a business relationship is that the exposure to PEP really comes from the ownership structure of the company.

Step 4 – PEP & Sanction Screening

Once you have collected the requested information, conduct PEP and sanction screenings of the collected information against the world-wide PEP lists, and ALL UN, OFAC, EU, SEBI, FATF, FIU-IND watch lists. You should conduct an automated API real-time lookup that includes fuzzy name search capabilities to identify aliases (and common spelling variations).

Step 5 – Assign Risk Rating

Assign a risk rating (low to medium = standard customer due diligence (CDD), high-risk individual or PEP confirmed or known to be connected with sanctions, immediately escalate to enhanced due diligence (EDD)) to each customer based on results of screening.

Step 6 – Perform Enhanced Due Diligence

For customers who are considered high-risk you must perform a greater amount of due diligence before/onboarding them. This includes verifying sources of wealth, reviewing transactional history, screening against negative media, identifying any third parties involved, etc. You must obtain authorization from higher management before you on-board any PEP’s as required by the RBI.

Step 7 – Report Suspicious Activity

If there are unexpected large amounts of unexplained wealth, sanctions connections, or suspicious activity found in either the screening process or EDD process you must submit an STR (Suspicious Transaction Report) to the FIU-IND immediately.

Step 8 – Include Ongoing Monitoring

Risk is not static. A customer may become a PEP after you have onboarded them. New sanctions are being applied every day. You should schedule rescreening of customers every few months, and establish automatic alerts on changing risk ratings for customers.

How Instantpay’s PEP & Sanctions API Can Help?

Global Platforms are a one stop solution, however, they come with high integration costs, long lead times to implement & an enterprise pricing strategy that is not practical for Indian Startups, Non-Banking Financial Companies or FinTech startups. 

Instantpay’s PEP & Sanctions API meets this need:

• Real Time Screening Against Global Databases – OFAC, UN, EU, SEBI & FATF
• Smart Name Matching Using Fuzzy Logic To Minimize False Positives
• Bulk Processing For High Volume Onboarding Workflows
• Continuous Monitoring With Automated Alerts After Onboarding
• Audit-Ready Logs With Timestamps For RBI, SEBI & FIU-IND Audits
• Plug And Play REST API With Developer Documentation And Sandbox Environment

You may use the PEP & Sanctions API for any/all of the following use cases:

• High-Risk Customer Onboarding, 
• Periodic KYC Updates, 
• AML Compliance Audits, 
• Risk Scoring/Lending Or Insurance Onboarding. 

Made For Indian Businesses! Affordable, Easy To Use And Regulatory Compliant From Day One!

PEP & Sanctions Screening Platform Comparison Table

Why PEP and Sanction Screenings are Needed for Indian Regulated Businesses?

Screening for PEPs and sanction lists is now required by law, not just good business practice in India – from a regulatory point of view, any regulated business that fails to carry out these checks or does not perform them properly could be subject to an enforcement procedure.

RBI Policy

According to the Reserve Bank of India KYC Policy Manual (last revised 2023), all banks, NBFCs, payment systems and wallets must:

• Identify PEPs before onboarding clients,  
• Obtain senior management sign-off prior to establishing a PEP relationship,
• Verify and document the source of funds, and,
• Monitor all transactions in relation to PEPs on an ongoing basis. 

Sanction Screening Responsibilities

The RBI further states that all financial entities must carry out a sanction screening against the following lists:

• UN Security Council (UNSC),
• The Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury,  
• The European Union, and,  
• Any lists contained within Indian law (UAPA Act, SEBI, FIU-IND). 

Failure to follow will result in accounts being frozen under the UAPA Act 1967, civil monetary penalties, lower AML audit grades and the loss of correspondent banking relationships set forth therein.

SEBI Mandate

According to regulations set forth by the SEBI (Securities and Exchange Board of India), all entities acting as Capital Market Intermediaries (such as Stockbrokers, Mutual Fund Distributors, Portfolio Management Service Providers, etc.) face the same standards imposed upon them. These entities will be required to perform further monitoring of PEP accounts under the recent regulatory amendments and will have to take prompt action if a client appears on a sanctions list.

On October 2023, the RBI (Reserve Bank of India) imposed a penalty of Rs.5.39 crore against Paytm Payments Bank for failing to comply with KYC and money laundering regulations, which included:

(i) failing to identify beneficial owners of accounts and 

(ii) failing to monitor payout transactions. 

PEP/Sanctions Screening is not simply a compliance requirement; rather, it is a significant element of managing regulatory, operational and reputational risk.

Case Study: How Real-Time PEP Screening and Sanctions Search Helped a Lending Fintech Avoid Regulatory Issues?

The Client

A rapidly expanding online lending platform headquartered in Mumbai with a customer base of over 4 million, primarily located in Tier 2 and Tier 3 cities. The platform provides loans without collateral, buy now pay later (BNPL) products, as well as financing for SMEs; onboarding thousands of users each day via a fully digital KYC process.

The Issue

As the company continued to grow, so too did its volume of manual compliance processes which could not support its current volume. Relying on static watchlists and human review created:

• PEP (politically exposed person) clients going undetected during onboarding
• Compliance team overwhelmed by false positive alerts and slow loan approvals
• Connections to sanctioned entities through business co-directors and beneficiaries (UBOs) being missed
• No system in place to monitor changes in an individual’s risk profile after they were onboarded
• If there was not an immediate resolution, the platform faced the very real possibility of being non-compliant with RBI’s (Reserve Bank of India) KYC Master Direction and FIU-IND requirements for reporting and would expose itself to regulatory penalties & reputational damage.

The Solution

To help with on-boarding its customers, fintech integrated the Instantpay PEP & Sanctions Screening API into its on-boarding engine. This integration allowed the company to achieve the following:

• Conduct screening in real-time against various international databases (i.e., United Nations [UN], Office of Foreign Assets Control [OFAC], European Union [EU] and Securities & Exchange Board of India [SEBI], and the Financial Action Task Force [FATF])
• Use smart name matching, by being able to measure the similarity of two names using fuzzy logic, so that false positives can be eliminated
• Automate the classification of high-risk profiles and identify the need for escalation
• Batch verification of the SME directors, UBO’s and co-applicants
• Ongoing monitoring of customers after on-boarding and providing real-time notifications of potential red-flags.

The Results

Metric	Before	After
Undetected PEPs (2 months)	18 cases	0 incidents
Onboarding time (flagged profiles)	~2 days	Under 2 minutes
False positive rate	27%	4.6%
UBO screening for SMEs	Manual only	Fully automated
Audit trail for regulators	Manual PDF logs	API-based digital logs

The Moment That Made it Count

After integrating the API, the team was running the new functionality for testing purposes. While doing so, it flagged an SME loan application where the co-director of the Applicant was linked to a Russian company with sanctions against it. Due to the name variation of the Applicant and the co-director, manual checks had missed this match. However, once again, the use of fuzzy logic by the Instantpay API flagged the potential discrepancy that prevented disbursement of Rs.10 Lacs to a high-risk individual.

The Takeaways

• The majority of the exposure to PEPs will be through ownership of a business and not directly related to individual applicants
• Hundreds of changes occur on a daily basis to the existing sanctions list; therefore, constant monitoring will be necessary.
• Using automated PEP and sanctions Screening will protect you from the risks associated with this and will also make your on-boarding process more efficient and intelligent.

Frequently Asked Questions (FAQ’s)

1. What is a Politically Exposed Person (PEP)?

A Politically Exposed Person (PEP) is someone who has had a key public role. This includes government officials, top executives of state-owned companies, or senior military officers. PEPs are considered a higher risk for bribery and corruption due to their position and influence.

2. Why is PEP screening important in compliance?

PEP screening is vital for financial institutions. It helps them spot individuals who might be at a higher risk of engaging in financial crimes. Recognising PEPs helps institutions use stronger due diligence measures. This reduces risks from money laundering and corruption.

3. What does sanctions screening involve?

Sanctions screening checks people, organisations, or transactions against official lists from governments or international groups. This helps organisations avoid groups that take part in illegal activities, like terrorism or human rights abuses.

4. Who needs to perform sanctions screening?

Organisations in regulated sectors, such as financial services, insurance, and international trade, must do sanctions screening. This is crucial for following anti-money laundering (AML) and counter-terrorism financing (CTF) rules.

5. How often should PEP and sanctions screening be conducted?

Screening should start when onboarding a customer and happen regularly during the relationship. Ongoing monitoring ensures that any changes in a customer’s status are detected promptly.

6. What are common challenges in sanctions screening?

Challenges include dealing with false positives, managing large amounts of data, and keeping up with updated sanctions lists. Implementing effective screening tools and processes is essential to address these issues.

7. Are there different types of PEPs?

Yes, PEPs can be divided into three types:

• Domestic PEPs, who hold positions in their own country.
• Foreign PEPs, who hold positions in other countries.
• International organization PEPs, who work in international organisations.

8. What is the role of technology in PEP and sanctions screening?

Advanced screening solutions use artificial intelligence and machine learning. They improve how we find PEPs and sanctioned entities. This helps to lower false positives and ensures compliance.

9. What are the consequences of non-compliance with PEP and sanctions regulations?

Non-compliance can result in serious penalties. These include large fines, damage to your reputation, and possible legal action. In October 2024, TD Bank agreed to pay a huge £3.1 billion in penalties. This was for breaking federal AML laws.

10. How can organisations stay updated with changing sanctions lists?

Organizations can subscribe to updates from government and international bodies. They can also use automated screening systems that regularly update with the latest sanctions lists. This helps ensure ongoing compliance.