PEP false positive or true PEP? A measurable way to tell

A PEP false positive is a screening hit that, once reviewed, does not call for PEP treatment. No regulator publishes a PEP false-positive rate, and any single rate hides what matters, because three different questions sit behind every hit. Identity: is this our customer, or someone with a similar name? Status: is the listed role a prominent public function under the bank’s definition, and is it still current? Relationship: for a relative or associate, is the link real and within the definition? Each question fails for a different reason, is settled by different evidence and is fixed by a different change, so each needs its own measure. Botminds’ PEP Screening rules a hit out only with the identifier that differs or the rule that excludes the role, records which it was, and has people check a sample of every group before it closes.

The figures below come from the solution’s fictional sample bank, Corvane Bank UK, over one month of nightly screening; the research is linked where it appears.

Why do PEP screenings produce so many false positives?

Because the lists are long, common names repeat, identifiers are thin and definitions are wider than the law. FATF’s guidance ties the problem to name matching: inconsistent transliterations and spellings mean that screening customer records against a commercial database “may result in many false positives if such databases contain insufficient or inadequate identifier information” (FATF Guidance on PEPs, paragraph 62). The Wolfsberg Group adds that screening on an “exact match” basis “will likely be too restrictive”, so banks match on close variants, which widens the net further (Wolfsberg Guidance on PEPs, 2017).

The fourth cause is the definition. A provider that lists local officials, sporting executives or junior civil servants produces hits the bank’s law does not count, and a bank that screens for them chooses those hits. Seven of the 15 firms the FCA reviewed in 2024 used PEP or relative definitions wider than its guidance, and the FCA’s concern was that this makes controls “less risk-based and more inefficient” (FCA multi-firm review, 2024). That is a status error built into the configuration, and no amount of name-matching tuning will remove it.

What is a PEP namesake?

A namesake is a customer whose name matches or resembles a listed PEP but who is a different person. It is the commonest PEP false positive, and the cheapest to settle when the data is good, because one differing identifier is enough. At the sample bank, 702 of the month’s hits were namesakes, and the agents ruled each out with the identifier that differed.

The order is not an accident. Date of birth settles the most namesakes here, and the Wolfsberg Group lists it second among the identifiers a PEP record should hold, with year of birth where the date is unknown. The last bar is the least obvious: a customer who was a child, or not yet born, when the listed person took office cannot be that person, whatever the name.

Three kinds of PEP error, and how to measure each

A bank that counts “false positives” as one number cannot tell whether its problem is data, configuration or out-of-date status. The scorecard below splits the work into the three questions and gives each its own evidence, its own failure and its own measure. It is our framework, built from what the regulators and standard-setters expect each decision to rest on.

How do I measure PEP screening accuracy?

Measure agreement on samples for each kind of ruling, test for misses deliberately, and count the time status runs past its end. No regulation sets a PEP accuracy target, but the FCA expects firms to test their controls and report on them: in its 2024 review, four of the 15 firms could not show adequate quality assurance and testing in the previous two years, and 12 had problems with the management information on PEPs given to senior management, six of them lacking the detail to separate UK PEPs, foreign PEPs and relatives (FCA multi-firm review, 2024).

Five measures cover the ground. First, the share of sampled rulings a reviewer agrees with, by kind, because a 98% overall figure can hide a 90% figure on role rulings. Second, a missed-PEP test: known PEPs, including variant spellings and relatives, run through the screening to see whether they come out as hits. Third, days treated past the end date, which counts the status error no hit-level measure sees. Fourth, overrides by reason, which show where people disagree with the rules. Fifth, time to decide by queue, because a namesake that waits as long as a new minister is a cost of its own.

Research on name screening shows why the miss test matters. A 2024 peer-reviewed study of sanctions name screening in Frontiers in Artificial Intelligence notes that a low similarity threshold such as 70% can produce numerous false positives, while a high one such as 99% reduced them but raised the risk of false negatives (Kim and Yang, 2024). The study is about sanctions lists, but the trade-off applies to any list matched on names: a bank that only counts false positives will tune its way into misses.

Can PEP hits be auto-discounted?

Yes, on reliable evidence, never on a name. The Wolfsberg Group accepts rules that discount irrelevant alerts automatically “based on pre-defined criteria, such as a material difference in the year of birth”, and adds the condition that matters: “Care should be taken to ensure that auto-discounting criteria are based only on reliable information indicating a clear difference between the PEP and the customer or related party being screened.”

In the solution the conditions are explicit. A hit is ruled out only when an identifier differs, a date of birth, nationality and residence together, a full name, or dates of office the customer could not have held, or when the role is outside the UK definition; never on a name, a photo or an address alone. Below a confidence of 0.90, the bank’s setting, the agent rules nothing out and a person decides. And nothing closes until an analyst has checked a sample of the group: 5% of identity rulings and 10% of role rulings, at least three per group.

A month of hits PEP Screening ruled out, grouped by what settled them, each checked by sample

How do I reduce PEP false positives safely?

Fix the cause of each kind, rather than raising the matching threshold. For status noise, screen only the categories the definition covers; the Wolfsberg Group confirms there is no requirement to screen for positions outside a bank’s own PEP definition. For identity noise, improve the identifiers on both sides, the list and the bank’s own records. The sample bank’s four disagreements in 90 days were all dates of birth recorded wrongly at onboarding, each corrected in the core banking system; the fix was in the customer data, not the matching.

For repeat noise, remember the pair, not the person. The Wolfsberg Group describes a “no-match” list that stops the same false match regenerating at every screening run, and says “it should be the match between the PEP and the customer that is listed, rather than the customer themselves, as the customer may still be matched to another PEP record”, with any material change to either record reopening the assessment. A bank that suppresses a customer rather than a pair will one day suppress a true match to a different PEP.

What should a PEP disposition record?

Enough for someone else to reach the same answer: what settled it, from which source, who decided and who checked. FCA guidance requires a firm’s assessment and its decision on enhanced measures to be clearly documented; for a hit ruled out, the equivalent is the identifier or rule that decided it. In practice a disposition should hold the hit and the list record it came from; the ruling; the evidence, an identifier from each side or the paragraph of the definition; the person or rule that made it; the sample check that confirmed it; and a reason code a manager can count.

The solution’s reason codes make the categories countable. A hit ruled out as a different person carries one code, a role outside the UK definition another, and a person who left office before June 26, 2017, outside the Regulations’ 12-month rule under regulation 35(10), a third. Confirmed PEPs, relatives and PEP-controlled companies have codes of their own, as do ends of treatment and extensions. Each disposition, its sources and its sample check go to an append-only trail an auditor can filter and export.

The trail behind every disposition in PEP Screening: who decided what, on which evidence

How often should PEP hits be QA’d?

Continuously, by sample, rather than in an annual review of a few files. No rule sets a PEP quality-assurance frequency; the FCA points to the Regulations’ expectation that firms regularly examine and evaluate the adequacy and effectiveness of their policies, controls and procedures, and treats a lack of testing evidence as a finding. Sampling every group of rulings before it closes turns quality assurance from a retrospective exercise into a condition of closing.

At the sample bank, the 90-day result was 342 agreements in 346 sampled rulings, 98.7%, with role rulings and end dates at 100% on the oversight screen. The four disagreements reopened their hits and went to a person. The bank can raise the sample rate to 10% or lower it to 3% for identity rulings as a setting, approved by the MLRO and kept on the record.

The status error nobody counts: a PEP past the end date

A hit-level false-positive rate misses the most expensive status error, because it never produces a new hit. A former minister whose 12 months have run out matches the list correctly every night; what is wrong is the bank’s continued treatment of him. At the sample bank on the morning of October 22, 2026, four PEPs were still treated past the date their treatment could end. One former junior minister had run 222 days past his date, and his wife 587 days past hers. The solution’s design target is zero days of PEP treatment past the date the rules allow.

The FCA treats it as a customer-treatment problem: PEPs and relatives who are not declassified keep meeting PEP requirements for longer than is proportionate, and the Consumer Duty asks firms to avoid foreseeable harm. Software that dates each role and asks when one ended is how the measure can be kept at zero; the PEP list alone will not do it.

The costlier error: the PEP you miss

A false positive costs analyst time; a false negative leaves a PEP without the approval, source-of-wealth checks and monitoring the law requires, and can do worse when a PEP list is used for questions it was not built for. The public PEP miss described in the PEP database guide, at TD Bank, was about data, not matching: a vendor list that left out a whole category, and citizenship fields left blank. That is why a bank tuning for fewer false positives should hold its miss test fixed and prove each change against it. What each option costs per settled decision puts the analyst time on both sides of that trade into money.

Questions people ask

What is a PEP hit?

A PEP hit is a screening alert: a customer, beneficial owner or related party whose details resemble an entry in the PEP data the bank screens against. It is a candidate for review, not a finding, until someone confirms the identity, the role and its dates.

What percentage of PEP hits are false positives?

No regulator or standard-setter publishes a PEP-specific figure, and any figure depends on the list, the definition and the matching settings. At the solution’s fictional sample bank, 760 of 842 hits in a month were ruled out with evidence: 702 as different people and 58 as roles outside the UK definition.

Is ruling out a hit on date of birth safe?

When the dates are reliable and clearly different, yes; the Wolfsberg Group gives a material difference in year of birth as an example of a valid auto-discount criterion. The sample bank’s four errors in 90 days were dates recorded wrongly at onboarding, which is why ruled-out groups are checked by sample.

Should a cleared PEP hit be suppressed for future runs?

Only as a pair. The Wolfsberg Group says a no-match list should record the match between that PEP and that customer, not the customer, and that a material change to either record should reopen the assessment.

Who should check the agents’ or rules’ rulings?

A KYC analyst, on a sample of every group of rulings before it closes, with disagreements reopened and reported by reason. The sample bank checks 5% of identity rulings and 10% of role rulings, at least three per group.