A PEP database is a list, usually bought from a commercial provider, of people who hold or have held prominent public functions, often with their relatives and close associates, against which a bank screens its customers. FATF’s guidance says using one is not required and is not enough on its own, because such databases draw only on public information, may define PEPs differently from the law the bank works under, and cannot keep pace with elections and reshuffles. No US, UK or EU authority publishes a list of PEP names; the EU publishes lists of the functions that qualify. So a database hit is a lead: the bank still has to confirm who the person is, which role makes them a PEP, and whether that role is current. Botminds’ PEP Screening takes each hit from the bank’s PEP data service and checks it against parliament, appointment and company records before anyone relies on it.
Examples from the solution use its fictional sample bank, Corvane Bank UK; the rules and research are linked where they appear.
What a PEP list can and cannot tell you
27
EU Member States’ lists of prominent public functions in one Commission notice: functions, not names
6
identifiers the Wolfsberg Group says a PEP record should hold, the last of them the date the role ended
9
accounts a US bank kept for North Korean mission staff; its vendor’s PEP list did not include government employees of sanctioned countries
1,479
transactions processed for those accounts, $382,685.38 in all
Are PEP databases accurate?
Accurate enough to start from, not to finish on. FATF is direct about it. Commercial databases are “not required by the FATF Recommendations, and is not sufficient for compliance with Recommendation 12”; their use “should never replace traditional CDD processes”; and relying on one risks a bank wrongly assuming “that if a name is (not) in such a database then the client is (not) a PEP” (FATF Guidance on PEPs, paragraphs 61–62).
The guidance then lists four limits a subscriber should understand. The databases “generally draw solely from information that is publicly available”, so the subscriber cannot verify them. The definition a provider uses “may or may not align with the definition used in a particular country”. A subscriber “may not fully understand the parameters used to populate the database”, so it may not catch certain names or may exclude certain categories. And inconsistent transliteration and spelling, combined with thin identifiers, produce “many false positives”, which “increases the risk of missing true matches”. Paragraph 63 sums it up: banks using such a database should ensure it is fit for purpose and that they “are not simply outsourcing their risk assessment”.
“With elections, cabinet changes, and the general turnover of public officials taking place almost daily around the world, these lists cannot be relied upon as being up-to-date.”
FATF, Guidance on Politically Exposed Persons (2013), paragraph 62
The UK regulator takes the same line from the other side. Under FCA guidance a firm “can choose, but is not required, to use commercial databases”, and one that does “would need to understand how such databases are populated and will need to ensure those flagged by the system fall within the definition of a PEP, family member or close associate as set out in the Regulations” (FCA FG25/3). The duty to decide who is a PEP stays with the firm.
Is there an official PEP list?
Not of names, in the US, the UK or the EU; the EU publishes lists of functions. Under the anti-money laundering directive, each Member State issues a list of the exact functions that count as prominent public functions, and the Commission assembled them, with the functions at international organisations and EU institutions, into one notice published in the Official Journal on 10 November 2023 (C/2023/724). It tells a bank that a member of the Austrian Nationalrat is a PEP, or that Austria counts officers above the rank of Lieutenant General. It does not tell the bank who those people are.
From 10 July 2027 the EU regulation makes the list permanent: the Commission must publish a single list of all prominent public functions in the Official Journal, and the new Anti-Money Laundering Authority must make it available on its website (Regulation (EU) 2024/1624, Art. 43). The UK has nothing equivalent. When respondents to its 2024 consultation asked for “a definitive list of who should be treated as a PEP”, the FCA kept its descriptions of functions instead. The Wolfsberg Group, for its part, notes that while some authorities publish PEP lists, “this is the exception rather than the norm as PEP lists are usually compiled internally or sourced from vendors/list providers”, and has asked governments to share which positions count in each country (Wolfsberg Guidance on PEPs, 2017).
What do PEP databases miss?
Whole categories, when a provider’s definition differs from the law, and the end of a role, when nobody updates it. The clearest public case of the first is an enforcement action by the US Treasury’s Office of Foreign Assets Control. Between December 2016 and August 2018, TD Bank, N.A. processed 1,479 transactions totalling $382,685.38 and maintained nine accounts for five employees of the North Korean mission to the United Nations without the licence US sanctions require.
The account holders had shown North Korean passports. They were not flagged “because TDBNA relied heavily on a vendor-supplied Politically Exposed Persons (PEP) list (“PEP list”), which did not include government employees of sanctioned countries”, and because staff “often misidentified North Korea (referring to it as Korea or South Korea or using a country code meant for South Korea), or left the citizenship field blank” (OFAC, TD Bank, N.A., December 23, 2021). The bank settled that matter for $105,238.65, and among its remedial steps “enhanced its controls for identifying government officials of sanctioned countries”. A list built around one definition of a PEP was relied on for a sanctions question it did not cover, and the bank’s own customer data could not catch the gap.
The second gap is quieter. Regulators tie the end of PEP treatment to the day a role ends, but a database records an appointment the day it is announced and a departure only if someone notices. The FCA’s 2024 review found firms still treating customers as PEPs years after they had left their roles (FCA multi-firm review, 2024). How long someone remains a PEP shows what that costs, rule by rule.
How often are PEP lists updated?
No rule sets a frequency for a provider, and no rule sets one for the bank either; what the texts set is an expectation that changes are caught. The Wolfsberg Group says “The accuracy and completeness of the PEP data should be subject to regular review and changes in personal details and political positions should be reflected in a timely manner.” It describes delta screening, in which changes to the PEP data are screened continuously against the whole customer base and changes to customer data against the whole PEP database, and it warns that a “change” must include a material alteration to an existing record, not only new entries.
For UK elections, the FCA expects firms to know the results because they are public, and its 2025 guidance points to trigger events such as planned elections and lets firms ask customers to tell them about a change of circumstances. For a bank, that means the calendar is part of the data: the general election, the reshuffle, the by-election in a customer’s constituency. In the solution’s sample data, the PEP book shows a by-election on November 19 as a coming event, alongside an ambassador whose 12 months end on October 31, and the nightly re-screen runs against the provider’s list update while a separate annual re-screen checks every PEP relationship against fresh public records.
Can I rely on a vendor PEP list?
You can use one, and most banks do; you cannot hand it your judgement. The Wolfsberg Group accepts that, depending on its size and footprint, a bank “may choose to source its PEP data for screening purposes from a third party vendor” or build its own. FCA guidance makes the database optional and puts two duties on the firm that uses one: understand how it is populated, and check that what it flags fits the legal definition. FATF adds the warning about outsourcing the risk assessment.
In practice that means five questions to put to any provider before relying on its data. Which definition does it apply, and can the bank see which category each record falls under? Does it include officials of sanctioned countries, international organisations and state-owned enterprises, or leave them out? Which identifiers does each record carry? How quickly does it record a departure, and does it record the date? And how does it notify a change to an existing record? The answers decide how much checking the bank must do after every hit. The Wolfsberg Group also notes that “in many instances, PEP screening is not the primary control for identifying PEPs”: customer-facing staff who know the client find them too.
What data should a PEP database record hold?
At least the six identifiers the Wolfsberg Group lists, because without them screening “will result in irrelevant alerts, which is not only ineffective and inefficient, but inconsistent with an RBA”. Each one does a job in matching or in dating, and a record missing one pushes that job back onto an analyst.
Six identifiers a PEP record needs, and what each one settles
- 1. Name, with all known names and aliases
The match itself; transliterations and former names are where true matches hide.
- 2. Date of birth, or year of birth where the date is not known
It ruled out more namesakes than any other field at the sample bank; without it a common name matches everyone.
- 3. Country of political exposure
Decides domestic or foreign, and which definition applies. Not the same as nationality.
- 4. Gender, where available
A cheap discriminator on common names.
- 5. Each politically exposed role, with the date or year of appointment
Tells the bank which category of the definition is in play, and whether a customer could have held it.
- 6. The date or year the person left the role
The field that ends PEP treatment; blank means the bank must find it.
The sample bank’s queue shows what a missing field does. On the morning of October 22, 2026, twelve of the 41 cases needing a person were marked “identity unclear”. One was a customer who matched a member of a regional legislature in Austria, where the list gave no year of birth; the agent’s confidence was 0.62, below the bank’s 0.90 floor, so a person decides. Another matched an ambassador, but the customer’s passport carried no middle name to compare. Both are data gaps, not judgement calls, and both land on an analyst.
A morning’s desk in PEP Screening: what the list update produced, and what needs a person
Why do PEP databases create false positives?
Because lists are long, names repeat and identifiers are thin. FATF’s guidance ties the false positives to inconsistent transliteration and to records with too few identifiers; the Wolfsberg Group adds that “the significant numbers of entries on PEP lists (including PEPs, their relatives and associates, close or otherwise)” have diluted the effectiveness of PEP screening. A third cause is definitional: a provider that includes local officials, sporting executives or junior civil servants generates hits on roles the bank’s law does not count.
At the sample bank, 702 of the 760 hits the agents ruled out in a month were different people, settled by an identifier that differed, and 58 were roles that are not prominent public functions in the UK. The split matters for what a bank fixes: identity noise falls when identifiers improve, definitional noise when the screened categories match the definition. Measuring PEP false positives separates the two and shows how to score each.
A database hit is a lead: checking the person, the role and the dates
A bank that treats each hit as a question, not an answer, needs three checks before anyone signs. Is it this customer, judged on identifiers, not a name? Is the role a prominent public function under the bank’s definition, not the provider’s? And is the role current, or when did it end, from a source the approver can open? FATF points to the same sources the FCA lists: parliament and government websites, reliable registers and other public information.
Is this our customer? PEP Screening checks five identifiers against the list and public records
In the solution the role and its dates come from the public record, not from the database entry: the agent that dates roles reads parliament, government appointment and company records, and every date opens its source. The provider’s update tells the bank where to look; the record tells it what is true. A customer’s own declaration helps, but FATF warns that banks “do not rely solely on such self-declarations (which may in fact be false)”, and notes that many customers do not know whether they meet the definition at all. The software that asks when a role ended covers what should happen when the record is silent.
Official lists, commercial data and your own records, compared
No single source is enough, and each does a different job. The table below sets out what each kind of source gives a screening team and where it stops.
Four sources for PEP screening, and what each one can settle
| Source | What it gives | What it cannot give |
|---|---|---|
| Official lists of functions (EU notice, national lists) | Which roles count in each Member State and at EU institutions; free and authoritative | Names, dates of birth, or who holds a role today |
| Commercial PEP database | Names, aliases, roles and relatives at scale, with a daily or continuous update | Certainty: coverage, definitions and end dates vary, and the provider cannot be made responsible for the bank’s risk assessment |
| Public registers and official records | Parliamentary membership and dates, appointment notices, company and significant-control registers | A ready-made list; someone has to read and date them |
| The bank’s own records | Identifiers to match on, relationships, joint accounts, and what the customer has declared | The PEP status of a person the bank has never been told about |
The practical design is a layered one: the commercial list to catch candidates, the bank’s records to rule out namesakes, the public record to confirm and date the role, and the official list of functions to decide what counts. Where any of them is silent, the case goes to a person with the gap named. The PEP definition in each regime decides which roles the screening should look for at all.
Questions people ask
Is there a free PEP database?
Not one published by US, UK or EU authorities as a list of names. The EU’s list of prominent public functions is free to read in the Official Journal, and many of the records that confirm a role, such as parliament membership pages and company registers, are public; turning them into a screening list is the work commercial providers charge for.
Does using a PEP database satisfy the rules?
No. FATF’s guidance says using a commercial database is not required and is not sufficient for compliance, and FCA guidance makes it optional and requires the firm to check that what it flags fits the legal definition. The obligation is to have appropriate risk-management systems to determine PEP status, which the database supports but does not discharge.
Should a bank rely on customers declaring that they are PEPs?
Not solely. FATF calls self-declaration a known aid but says banks should not rely solely on it, because declarations may be false and many customers do not know whether they meet the definition; it suggests asking about the elements of the definition instead.
Do PEP databases include relatives and close associates?
Commercial databases usually carry them, which is part of why lists are long, but relationships change and FATF calls the circle “fluid”. A bank still has to confirm the relationship and test it against its own definition, and in the UK it need only consider information it holds or credible public information.
How do you check what a PEP database covers?
Ask the provider which definition and categories it applies, which identifiers each record carries, and how it records departures, then test it with known cases from the bank’s own book, including officials of sanctioned countries and recently departed ministers. FCA guidance expects a firm using a database to understand how it is populated.