PEP and sanctions screening solutions: a go-live plan in four stages

PEP and sanctions screening solutions both compare customers against lists, and banks often buy the data for both from one provider, but the two answer different legal questions. A valid sanctions match can require the bank to block property or reject a transaction, and the US Treasury’s Office of Foreign Assets Control leaves the bank to decide whether a match is valid. A PEP match requires the bank to assess the risk, obtain senior management approval and apply proportionate measures, and in the UK and the EU it may not refuse the customer on PEP status alone. They can share data, identifiers and a platform; they need separate rules, queues and approvers. Going live in the right order matters more than going live fast: first re-screen and date the PEPs already in the book, then clear the overdue end dates, then switch on new-customer screening, then ongoing monitoring, each stage with an exit test. Botminds’ PEP Screening handles the PEP side; the sanctions side belongs to the bank’s sanctions screening or to Botminds’ Sanctions Alert Review.

Examples use the solution’s fictional sample bank, Corvane Bank UK. The plan is ours, offered as a starting point, not a regulatory requirement.

What is the difference between PEP screening and sanctions screening?

Sanctions screening looks for people and entities the bank may not deal with; PEP screening looks for people the bank may deal with, under enhanced measures. OFAC’s guidance on judging a sanctions hit sets out what follows a valid match: block the property of a listed person, reject a transaction involving a sanctioned jurisdiction or activity, or proceed where there is no true nexus or the activity is licensed; OFAC itself does not confirm matches and expects the bank to decide on the evidence (OFAC FAQ 5).

A PEP match leads somewhere else entirely. UK law requires the firm to assess the PEP’s risk and then apply approval, source of wealth and source of funds, and enhanced monitoring (regulation 35), and FCA guidance expects firms not to decline or close a relationship merely because a person is a PEP (FCA FG25/3). In the US, the federal agencies have said not all PEPs are higher risk and that there is no requirement for PEP-specific steps (joint statement, 2020). The EU regulation lists the two as separate customer due diligence measures: verifying whether customers or beneficial owners are subject to targeted financial sanctions, and determining whether they are PEPs, family members or close associates (Regulation (EU) 2024/1624, Art. 20(1)).

Can we run PEP and sanctions on one platform?

On one platform and one customer file, yes; on one rulebook, no. The two need the same identifiers, the same clean customer data and often the same list update, so sharing them saves work and closes gaps. The Wolfsberg Group asks that PEP screening standards be applied “consistently and on a global basis” wherever possible (Wolfsberg Guidance on PEPs, 2017). What must stay separate are the decisions: a sanctions true match goes to an officer who can block; a PEP true match goes to an approver who weighs risk.

The failure to avoid is one list answering the other’s question. In a 2021 enforcement case, a US bank’s customer screening relied on a vendor PEP list that did not include government employees of sanctioned countries, and nine accounts for North Korean mission staff were opened without the licence US sanctions require; what PEP databases miss tells that story in full. A shared platform helps only if each screening is configured for its own law and each hit is routed to the person who can act on it.

Botminds builds the two as separate solutions over the same customer data. PEP Screening settles PEP hits, dates roles and proposes treatment; Sanctions Alert Review clears sanctions name-screening hits identifier by identifier and escalates true matches; and Adverse Media Screening handles negative news, the third list-like check most banks run beside the other two.

What is the rollout sequence?

Start with the risk the bank already carries, not the risk it might acquire. A bank switching PEP screening on beside existing sanctions screening already has PEPs in its book, some wrongly classified, some past their end dates, and some it has never flagged. Turning on new-customer screening first would leave all of them as they are. The order below fixes the book first, then the front door, then the flow of change.

How do we migrate existing PEP flags?

Re-screen them as if they were new, and date every role. An old flag records that someone once decided a customer was a PEP; it rarely records why, under which definition, or until when. The FCA’s 2024 review found firms whose definitions were wider than its guidance and firms with PEPs kept for years after leaving office, and it expects firms that have given PEP status to people outside the definition to declassify them (FCA multi-firm review, 2024).

Three checks catch most of the errors in an inherited book. Does the role meet the bank’s current definition, or was it flagged under an older or wider one? When did the role end, and has the period that follows it run out? And for UK customers, did the person leave office before June 26, 2017, which takes them outside the 12-month rule altogether under regulation 35(10)? At the sample bank, the book holds 138 relationships, 47 domestic PEPs, 21 foreign PEPs, 52 family members and 18 close associates, each with the date treatment may end and the next review.

PEP Screening’s PEP book after re-screening: every relationship with its end date

Stage 2: clearing the overdue end dates, in plain words

Ending treatment is a decision like any other, and the customer should hear about it plainly. Each overdue PEP or relative gets a proposal with the date and the rule, a recorded decision and an approval; a longer period needs a written higher-risk reason, which FCA guidance now requires to be documented. At the sample bank one former junior minister had run 222 days past his end date and his wife 587; both ended in one decision, approved at 9:24 a.m. on October 22, 2026.

The FCA’s review is blunt about communication. Six of the 15 firms needed to improve the clarity of their customer communications, and the FCA quoted one firm’s account-closure template, “we won’t be able to tell you why your account(s) has been closed.” In the solution, a short plain-words letter tells the customer the bank has updated its records and needs nothing from them, and it is sent only after approval; relationship managers see only whether a customer is a PEP and the next review.

Stages 3 and 4: new customers, then monitoring

New-customer screening comes third because it is the easiest to get right and the least urgent: a bank that has fixed its book can afford to get the front door right too. The Wolfsberg Group sets the minimum points at which PEP screening should happen: “As part of the onboarding process”, “At periodic customer review” and “When there is a trigger event which warrants a customer due diligence review”. Beneficial owners belong in it as much as account holders.

Monitoring comes last because it depends on everything before it. Changes come from the list provider’s updates, from elections and reshuffles, and from customers themselves, whom FCA guidance allows firms to invite to report a change of circumstances. An existing customer who becomes a PEP needs approval to continue the relationship, so monitoring is where most new approvals arise. At the sample bank, a reshuffle on October 19 made a long-standing customer a Minister of State with influence over large procurement, and the case was on the desk the next morning.

When do approvers start signing in the new tool?

In stage 1, on the first changed status, not at the end of the project. Approvers who first meet the new process on day one of live monitoring will meet it under time pressure. Starting them on the existing book, where the cases are known and the decisions can be compared with what the bank did before, gives them a parallel run on real files. FCA guidance asks firms to document who counts as senior management and any delegations, and to train staff on seeking approval; that document and that training belong in stage 1.

The approval matrix should be settled before the first decision: who approves a lower-risk domestic PEP, who approves a foreign or higher-risk one, who approves an extension, and that the person who records a decision never approves it. PEP senior management approval sets out what the signature should rest on.

How long does it take to implement PEP and sanctions screening?

No regulation sets a timetable, and none of the public sources in this series measures one; it depends on the size of the book, the data available, and the systems to connect. What can be planned is the order and the evidence. A sensible first step is a run on a sample of the bank’s own past PEP hits and relationships, so the bank sees what the new process decides before any customer is affected.

For Botminds’ PEP Screening, what the bank brings is its PEP Standard, its approval rules, its queues and a sample of past hits; the solution connects to the PEP data service, the client lifecycle management and core banking systems, case management, document imaging and public records. Cost is a separate question from time, and the total cost per settled decision is the measure that compares options fairly.

How do we prove it to examiners?

With the same evidence the FCA asked for and often did not find: tested controls, management information that separates the categories, and documented decisions. In its 2024 review, four of the 15 firms could not show adequate quality assurance and testing in the previous two years, and 12 had problems with their PEP management information (FCA multi-firm review, 2024). A go-live that produces those things as it goes is easier to defend than one that tries to assemble them for the next visit.

The trail and export pack in PEP Screening that a supervisor would ask for

Questions people ask

What is the difference between PEP, sanctions and adverse media screening?

Sanctions screening finds people and entities a bank may not deal with; PEP screening finds people it may deal with under enhanced measures; adverse media screening looks for negative news that changes a customer’s risk. They share data and identifiers but lead to different decisions by different people.

Should PEP and sanctions alerts share one queue?

They can share a desk but should not share an approver or a rulebook. A sanctions true match may oblige the bank to block or reject, under sanctions rules; a PEP true match needs a risk assessment and senior management approval, and in the UK and the EU cannot be refused on status alone.

Can a PEP also be on a sanctions list?

Yes. A person can hold a prominent public function and be designated; the sanctions rules then govern what the bank may do with that person’s property and transactions, whatever PEP treatment would otherwise apply.

Do we need to re-screen the whole book when we go live?

Every customer already flagged as a PEP, relative or associate should be re-screened and dated first, because those flags carry the most stale status. A full re-screen of the customer base against the PEP data then finds the PEPs the bank has never flagged; the sample bank re-screens nightly against the provider’s list update.

How do we know the new screening is working?

Hold a miss test fixed, known PEPs and relatives run through the screening, and measure agreement on sampled rulings by kind, days treated past end dates, and time to decide. The FCA treats a lack of testing evidence as a finding in itself.