PEP and sanctions screening: what businesses need to know

When we talk about customer onboarding, identity verification often gets most of the attention. Can we confirm that this person is who they say they are?

That matters, but it is only part of the picture. You may also need to understand whether they hold a prominent public role, have relevant political connections or are subject to sanctions.

This is where PEP and sanctions screening come in. Both support customer due diligence, but they answer different questions. And neither is much use without a process for dealing with the results.

What does being a PEP actually mean?

A Politically Exposed Person, or PEP, is someone entrusted with a prominent public function. This can include government ministers, members of parliament and certain senior judicial, military and state-owned company roles.

Being a PEP does not mean someone has done anything wrong. It means their position may expose them to risks such as bribery or corruption, which need to be considered when assessing the relationship.

The rules also cover defined family members and known close associates. They do not extend to everyone who happens to know a politician.

For businesses covered by the UK Money Laundering Regulations, enhanced due diligence is required where the PEP provisions apply. Those checks should be proportionate. Domestic PEPs, whose prominent public functions are entrusted to them by the UK, should start from a lower risk position than foreign PEPs unless other risk factors are present. That does not remove the need for enhanced checks.

A match comes back. What happens next?

First, check that it is the right person. A matching name is a starting point, so compare other information such as their date of birth, nationality and public role.

Where the PEP requirements apply, businesses must obtain senior management approval to establish or continue the relationship, take adequate measures to establish source of wealth and source of funds, and carry out enhanced ongoing monitoring.

The distinction between wealth and funds is worth explaining:

• Source of wealth: How did the person build their overall wealth?
• Source of funds: Where is the money for this particular transaction coming from?

Someone might have built their wealth through a business but be paying for a property with an inheritance. Understanding one does not automatically explain the other.

For me, the practical question is whether the person reviewing the result knows what to do next. Who can approve the relationship? What evidence is needed? Where is the decision recorded? These are things to agree before an alert arrives.

What happens when businesses get this wrong?

Two enforcement decisions from July 2025 show why this matters. Both relate to earlier failings, rather than the firms’ current controls.

Taylor Vinters: £172,934 fine

The Solicitors Regulation Authority fined Taylor Vinters after the firm failed to identify the beneficial owner of a corporate client as a PEP during a residential property purchase.

The PEP connection was identified in August 2017, two months after completion. As a result, the required enhanced checks had not been carried out when the firm acted. It had also incorrectly told another firm of solicitors that the buyer was not a PEP.

This is a useful example for businesses working with company clients. You need to understand the relevant people behind the company, and you need that information early enough to act on it.

Monzo: £21.1 million fine

The FCA fined Monzo £21,091,300 for weaknesses in its financial crime controls and breaches of restrictions on opening accounts for high-risk customers. The case covered failings between 2018 and 2022.

PEP checks were part of the findings. The FCA identified an unclear internal definition of a PEP, instances where PEPs were missed at onboarding and backlogs in reviewing alerts. Potential PEPs could open accounts and transact while identification and any resulting enhanced checks were still underway.

The fine covered wider financial crime failings, so it would be misleading to describe it as a fine solely for missed PEP checks. But it does show why identifying a potential match must lead to timely review and action.

The FCA also confirmed that Monzo had completed a programme to improve its financial crime controls.

How are sanctions checks different?

PEP screening helps identify relationships that need additional assessment. Sanctions screening helps identify people and organisations subject to legal restrictions.

UK financial sanctions apply beyond businesses regulated for anti-money laundering purposes. They apply to people and businesses within the UK and to UK persons worldwide.

There is also more to consider than whether a company’s name appears on a list. Restrictions can apply because it is owned or controlled by a designated person, even if the company itself is not listed.

If an alert appears, review it and escalate promptly. Depending on the circumstances, you may need to prevent a prohibited transaction, freeze relevant assets or report to the Office of Financial Sanctions Implementation, known as OFSI. Some duties arise from reasonable suspicion, so waiting for absolute certainty is not always appropriate. Any applicable exceptions or licences also need to be considered.

For UK designations, the current source is the UK Sanctions List. It became the sole source on 28 January 2026, when the former OFSI Consolidated List closed.

The relationship continues after onboarding

A customer’s circumstances can change after the initial checks. Screening information changes too.

That is why ongoing monitoring matters. It helps identify changes that your team may need to investigate during the relationship.

There is a practical distinction here: updating a screening database does not, on its own, mean your existing customers have been checked again. Ongoing monitoring needs to re-screen those customers and bring relevant changes to someone’s attention.

That person needs the time, information and authority to respond. Otherwise, you are simply building a queue of unread alerts.

How Goidentity helps

With Goidentity, businesses can bring identity verification, PEP and sanctions screening into the same customer onboarding process.

Our screening includes:

• UK and international sanctions coverage, including US, EU and UN sources.
• Name variation matching, helping identify potential matches across different spellings, aliases and languages.
• PEP screening that includes relevant family members and known close associates.
• Regularly refreshed sanctions and PEP data.
• Ongoing monitoring and alerts, automatically re-screening monitored customers and highlighting new potential matches or relevant changes.

Alongside document and biometric identity checks and custom questionnaires, this helps your team gather information to support its due diligence decisions.

We also have adverse media screening coming soon. This will help teams identify potentially relevant news reports, including those relating to financial crime or regulatory concerns, and consider them as part of their assessment.

The technology supports the work. Your team still needs to review the information, investigate potential matches and decide what action is required. A screening alert or news report is not proof of wrongdoing.

If you’d like to see how this could work for your business, book a Goidentity demo. We can walk through the checks, the results and how ongoing monitoring fits into your process.