FCA PEP guidance 2025 (FG25/3): what UK firms must change

The FCA’s 2025 PEP guidance is FG25/3, “The treatment of politically exposed persons for anti-money laundering purposes”, published on 7 July 2025 and revised on 15 July 2025. It replaces FG17/6, the guidance the FCA had issued in July 2017, and tells firms how to read regulation 35 of the Money Laundering Regulations for UK customers. The main changes: UK PEPs now start from a lower level of risk because the law says so; non-executive board members of government departments are not PEPs; sign-off can sit below the money laundering reporting officer (MLRO) for lower-risk PEPs; and any treatment beyond 12 months after leaving office needs a documented rationale. For a screening team the guidance is also a filter: it says which UK roles count, and which hits should never reach a queue. Botminds’ PEP Screening tests each listed role against regulation 35(14) and FG25/3 and rules out the ones the guidance excludes, citing the paragraph.

The guidance is quoted below from the FCA’s own documents; examples from the solution use its fictional sample bank, Corvane Bank UK.

What changed in the FCA’s 2025 PEP guidance?

The FCA describes the changes as minor, and most are: its review found “that, generally, our guidance remains appropriate”. Four of them, though, change what a UK firm’s PEP policy has to say, and several smaller ones change what its screening should flag. Read side by side with FG17/6, the differences are these.

When did FG25/3 take effect, and what is it based on?

FG25/3 was published on 7 July 2025; a revised version followed on 15 July 2025 to add the line on non-executive board members, “intended to be included in the original document” (FCA FG25/3; FCA, FG25/3 page). The guidance gives no separate start date, and the FCA had already told firms a year earlier that where its review identified improvements, “firms should implement those changes now and not wait for the final updated guidance to be published” (FCA press release, 18 July 2024).

It exists because Parliament required it. Section 78 of the Financial Services and Markets Act 2023 obliged the FCA to review how firms apply its PEP guidance and consider whether it remains appropriate. The FCA published the review and the consultation, GC24/4, on 18 July 2024; the consultation closed on 18 October 2024 with 26 written responses, most from trade bodies, and the FCA also held a roundtable with trade bodies and another with interested parliamentarians (FCA GC24/4; FG25/3, feedback statement).

Its legal standing is that of guidance, not rules. The FCA says it “has not been approved by the Treasury under Regulation 35(4)(b)”, but the Regulations allow firms to take FCA guidance into account, and the Financial Ombudsman Service “will take the guidance into account when deciding what is fair and reasonable” on a complaint from a PEP or a relative. The text marks in italics where the FCA is interpreting the law rather than restating it.

Are UK domestic PEPs lower risk now?

Yes, as a starting point set by law. Since 10 January 2024, regulation 35(3A) has required that where a customer is a domestic PEP, or a domestic PEP’s family member or known close associate, “the starting point for the assessment is that the customer or potential customer presents a lower level of risk than a non-domestic PEP”, and that if no enhanced risk factors are present, the enhanced measures applied are less extensive than for a non-domestic PEP (regulation 35(3A), inserted by SI 2023/1371). FG17/6 had said much the same as the FCA’s view; FG25/3 restates it as the law.

The guidance adds two points a policy has to carry. First, the comparison is a hard one: firms “must apply less intrusive steps to domestic PEPs than they apply to foreign PEPs who are classified as lower risk”. Second, it travels with the group: the FCA says the legislation requires the lower starting point for a UK PEP to be “applied across the group unless that is not permitted by the local law in that jurisdiction”. A UK bank’s branch in another country treats a UK minister as lower risk too.

Firms were already moving. Ten of the 15 firms in the FCA’s 2024 review had acted on the January 2024 amendment, and some had introduced a specific “low-risk” rating for UK PEPs and their relatives with no other enhanced risk factor; others were operating under global policies “not appropriately tailored to reflect the UK requirements” (FCA multi-firm review, 2024).

Are non-executive board members PEPs?

No. FG25/3 says “Non-executive board members of central government boards in the UK should not be treated as PEPs unless they already meet the definition of a PEP in respect of another capacity (e.g. a Member of the House of Lords).” The consultation explained why: non-executives are appointed to departments from the public, private and voluntary sectors “to provide advice and bring an external perspective. As such these NEBMs do not have any executive authority” (GC24/4, paragraph 2.2). All but one respondent agreed.

For screening this is a filter rule with a clear exception. A hit on a departmental non-executive is ruled out, unless the same person also sits in the House of Lords or holds another prominent function, in which case the other role decides.

Are local councillors PEPs in the UK?

No. FG25/3, like FG17/6, says the parliamentary category “does not include local government in the UK”, and it kept the rest of the 2017 list of UK functions unchanged in substance: only Supreme Court judges, only the most senior military officers, public servants at Permanent or Deputy Permanent Secretary level, state-owned enterprises over 50% state-owned or controlled, and international public organisations such as the UN and NATO.

Some consultation responses asked the FCA to go further, to include mayors or procurement officials lower in the civil service, or to publish a definitive list of who counts. It declined. “Our intention with our guidance was to minimise the number of functions that are treated as a PEP in line with the approach now set out in legislation that UK PEPs carry a lower risk compared to foreign PEPs,” it wrote, adding that firms may still go beyond the guidance on their own risk analysis and that “Given this we will not expand the list beyond the functions we originally outlined.” It did add the Northern Ireland Assembly to the devolved bodies, and a link to a government list of international organisations. Beyond the UK, the politically exposed person definition in the US, EU and FATF draws these lines elsewhere.

Who can sign off a PEP relationship under FG25/3?

Anyone the firm has documented as senior management under the Regulations’ definition, with lower-risk relationships signed at a lower level. FG17/6 had set the MLRO as the minimum. GC24/4 recorded why that changed: “Feedback from the industry is that this part of the Guidance causes concerns about the MLRO’s independence.” Under FG25/3 the MLRO may stand apart from individual sign-offs but must be aware of PEPs onboarded or rejected and oversee how the controls work. The detail, and what the approver’s signature should rest on, is in PEP senior management approval.

What did the FCA’s 2024 PEP review find?

That most firms had controls designed around the guidance and every one needed to improve something. The review covered 15 firms in detail, including 40 customer files at five of them, and the counts below are the FCA’s own. The finding behind most of FG25/3’s changes was not hostility to PEPs; every firm said it would not decline a UK PEP because of status. It was drift: definitions wider than the guidance, declassification nobody owned, and management information that could not show either.

Two findings shaped the guidance most directly. Five firms could not show suitable arrangements to review a PEP once the person left office, and two had policies never to declassify anyone who had held a prominent position; FG25/3 answered by restating that keeping someone where the Regulations require declassification is not in line with them, and by pointing firms to elections as trigger events. And firms that asked to declassify relatives at the next due diligence refresh, rather than when the PEP leaves office, were told no: “this is a requirement in the Regulations which we reflect in our guidance.” How long someone remains a PEP works those rules to a date.

What do UK banks need to change?

Most of FG25/3 lands in three places: the written PEP definition, the approval matrix and the declassification process. The list below maps each change to the setting or document it touches; a firm that had already followed FG17/6 closely will find most of it is wording and evidence, not new work.

How Botminds’ PEP Screening applies FG25/3

In the solution, FG25/3 is the rulebook the agents test hits against, and every exclusion carries its paragraph. At the fictional sample bank this month, the agents ruled out 58 hits whose roles the guidance does not treat as prominent public functions, including 27 in local government, 13 public servants below Permanent Secretary, six officers below Lieutenant General, five judges below the Supreme Court and four non-executive board members of departments. An analyst checks a sample of each group, at least three items, before confirming it.

Hits PEP Screening ruled out by the UK definition, each group with its FCA paragraph

The bank’s own choices sit in its PEP Standard as settings, inside what the law fixes. The lowest military rank treated as a PEP is Lieutenant General, with Major General available if the bank wants to go wider; the state’s share for a state-owned enterprise is over 50%, with over 25% as the wider option; the period after leaving office is locked at a minimum of 12 months, with anything longer requiring a written higher-risk rationale and the MLRO’s approval. A lower-risk domestic PEP is approved by a senior manager acting as the MLRO’s delegate; a foreign or higher-risk PEP, and any extension, by the MLRO.

What the MLRO sees: every PEP relationship opened, ended or declined

Questions people ask

Is FG25/3 binding on firms?

It is guidance, not a rule: GC24/4 says the FCA’s PEP guidance clarifies expectations and that “they do not establish rules for firms”. The Regulations let firms take it into account, the FCA supervises against it, and the Financial Ombudsman Service takes it into account when it decides complaints from PEPs and their families.

Which firms does FG25/3 apply to?

Firms whose anti-money laundering systems and controls are overseen by the FCA under regulation 7 of the Money Laundering Regulations, for business relationships in the UK and through group-wide policies. Foreign groups operating in the UK are expected to follow it for their UK relationships.

Can a UK firm decline a customer for being a PEP?

The FCA expects firms not to decline or close a relationship merely because the person meets the definition. A firm may decline where, after collecting information and assessing the customer, the risks are higher than it can effectively mitigate.

Are members of the Northern Ireland Assembly PEPs?

Yes. FG25/3 names the Northern Ireland Assembly and Executive alongside the Scottish Parliament and Government and the Welsh bodies as similar legislative bodies, where they have some form of executive decision-making power; the FCA says it always meant all devolved legislatures to be included.

Does FG25/3 change how long someone stays a PEP?

Not the period: at least 12 months after leaving office remains the legal minimum under regulation 35(9). What changed is the evidence: keeping a higher-risk PEP longer now needs a clearly documented rationale, and the FCA has said keeping someone the Regulations require to be declassified is not in line with them.

Does FG25/3 apply to a UK bank’s overseas branches?

The Regulations require group-wide policies across branches and subsidiaries, including those outside the UK, and the FCA says the lower-risk starting point for a UK PEP applies across the group unless local law does not permit it.