PEP senior management approval: who signs, and on what evidence

PEP senior management approval is the rule that someone senior enough to take decisions about a firm’s money laundering risk must approve establishing or continuing a business relationship with a politically exposed person, a PEP’s family member or a known close associate. It is law in the UK under regulation 35(5)(a) of the Money Laundering Regulations, law in the EU under Article 20 of the current directive and Article 42 of the regulation that applies from July 2027, and part of FATF’s Recommendation 12 for foreign PEPs. US regulations contain no such requirement. UK guidance lets lower-risk PEPs be approved at a lower level of seniority, provided the approver has enough authority and the decision is documented. What makes the signature worth having is the file under it: the identity, the role and its dates, the risk factors and the proposed measures. Botminds’ PEP Screening assembles that file with sources, has a KYC analyst record the decision with a reason code, and has a second person approve it before anything changes.

Examples from the solution use its fictional sample bank, Corvane Bank UK, a private bank with a US parent; the rules are quoted from their texts.

Who has to approve a PEP relationship?

Senior management, under every regime except the US, though each defines the term and its reach differently. UK law requires a firm that proposes to have, or to continue, a business relationship with a PEP, a family member or a known close associate to “have approval from senior management for establishing or continuing the business relationship with that person” (regulation 35(5)(a)). The EU directive requires the same for business relationships with PEPs (Directive (EU) 2015/849, Art. 20), and the regulation that replaces it adds occasional transactions: firms must “obtain senior management approval for carrying out occasional transactions or for establishing or continuing business relationships with politically exposed persons” (Regulation (EU) 2024/1624, Art. 42(1)(a)).

FATF requires approval “for establishing (or continuing, for existing customers)” relationships with foreign PEPs, and for domestic and international-organisation PEPs only where the relationship is higher risk (FATF Recommendation 12). Its guidance explains the purpose: the decision on a foreign PEP “should not be taken at the ordinary level of the hierarchy, but at the level of the senior management” (FATF Guidance on PEPs, paragraph 23).

Is senior management approval required in the US?

No. US anti-money-laundering regulations do not define PEPs, and none requires a named level of management to approve a relationship with one. The one PEP-like rule, for senior foreign political figures who own private banking accounts, requires the bank to ascertain their status, establish the source of funds, review account activity and watch the account closely enough to spot and report proceeds of foreign corruption (31 CFR 1010.620; the US definition is set beside the EU, UK and FATF ones in politically exposed person definition). It says nothing about who signs.

The federal agencies have said there is no supervisory expectation of PEP-specific steps either, and that diligence should match the customer’s risk (joint statement on PEPs, 2020). A US bank that requires senior approval for higher-risk foreign officials is making a policy choice, often because a parent or a foreign branch is subject to one of the regimes above. What a US file should contain is the subject of PEP enhanced due diligence under US rules.

What counts as senior management?

Not necessarily the board. The UK Regulations define senior management as “an officer or employee of the relevant person with sufficient knowledge of the relevant person's money laundering, terrorist financing and proliferation financing risk exposure, and of sufficient authority, to take decisions affecting its risk exposure” (regulation 3). The EU directive in force today uses almost the same words and adds that senior management “need not, in all cases, be a member of the board of directors”. From 2027 the EU regulation defines it as “the members of the management body in its management function, as well as officers and employees with sufficient knowledge of the obliged entity’s money laundering and terrorist financing risk exposure and sufficient seniority to take decisions affecting its risk exposure”.

FATF deliberately sets no level, “because such a definition would not be meaningful in all countries and in all relevant contexts”. It sets an objective instead: “to ensure that more senior levels of management are aware of relationships with PEPs and that financial institutions and DNFBPs do not in any circumstance undertake business relationships with them in the absence of adequate controls”, and it expects the approver to have “a deep knowledge of the institution’s AML/CFT programmes” and “a strong understanding of the potential or existing customer’s ML/TF risk profile” (FATF guidance, paragraphs 81–82).

Two tests come out of all three definitions: knowledge of the firm’s risk exposure, and authority to act on it. A relationship manager who brought the customer in has the second and often not the first. A compliance analyst has the first and not the second. That is why most firms name roles, not grades, and why the FCA asks firms to write the names down.

Does the MLRO have to approve every PEP?

Not in the UK since July 2025. The FCA’s 2017 guidance set the money laundering reporting officer as the floor: senior management “is to be, as a minimum, the person holding the CF11/SMF17 Money Laundering Reporting Officer role” (FCA FG17/6). The 2025 guidance links back to the Regulations’ definition instead, and describes the MLRO’s role as awareness and oversight: “The SMF17 Money Laundering Reporting Officer (MLRO) may be independent of decisions to sign off PEPs relationships but the FCA expects them to be aware of any PEPs onboarded or rejected as part of their role of overseeing the operation of a firm’s AML policies and procedures. Awareness in this context does not require oversight of all decisions” (FCA FG25/3).

The change answered a practical worry about an officer who was meant to oversee the controls also approving the cases they controlled. It also shifts work. The MLRO no longer signs every lower-risk domestic PEP, but needs management information good enough to know which were onboarded and rejected, and to check that the approach fits the Regulations, the guidance and the Consumer Duty. In the FCA’s 2024 review, 12 of the 15 firms had issues with their PEP management information, and two had no PEP-specific metrics at all (FCA multi-firm review, 2024). The FCA’s 2025 PEP guidance sets out the other changes made at the same time.

Can approval be delegated for low-risk PEPs?

Yes, in the UK, provided the firm says who may approve and the delegate has real authority. FG25/3 asks firms to “clearly document within its policies and procedures and internal controls those who are considered to meet this definition and any delegations of authority by those persons”, to train onboarding staff to seek approval, and adds: “We expect that in lower risk situations sign-off may be at a lower level of seniority in a firm but should still have sufficient authority to sign off these decisions and those decisions should be documented.” In higher-risk situations it suggests the opposite: oversight and approval “at a more senior level of management”.

The FCA’s review shows both sides of the line. It recorded as good practice a “Proportionate level of sign-off based on PEP risk rating, with individuals of less seniority approving lower risk PEPs and more senior management approving higher risk PEPs”, escalation to committees for higher-risk PEPs, and approval processes involving the first and second lines of defence with “clearly documented rationale for decision making, and audit trails”. It also found files where sign-off was missing or wrong: three files across two firms with no evidence of senior management sign-off, and at another firm one file “not approved by a person with sufficient seniority” and another not signed off by all the stakeholders its own policy required.

FATF’s guidance points the same way for higher-risk PEPs, suggesting “monitoring committees in place – or comparable decision making structures - that review high risk PEP customer and business relationships”, normally including the head of anti-money laundering, compliance officers and customer service representatives.

Does an existing customer who becomes a PEP need approval?

Yes. UK and EU law require approval for “establishing or continuing” the relationship, and FATF spells it out: “establishing (or continuing, for existing customers)”. A customer who is appointed a minister, elected to parliament or named an ambassador has to be approved as a PEP, even if the bank has known them for twenty years. The same applies when a customer becomes the spouse of a PEP, or a business partner in a PEP’s company.

That makes approval as much an ongoing-monitoring control as an onboarding one. At the sample bank, a long-standing private banking customer, Dominic Harcastle-Reid, became Minister of State for Defence Procurement in a reshuffle on October 19, with influence over equipment programmes worth about £14 billion a year. Influence over large public procurement is one of the FCA’s higher-risk indicators, so his case goes to the MLRO rather than to a delegate, with a hand-off to enhanced due diligence listing what must be established before she decides.

A new minister’s case in PEP Screening, with what the approver needs established first

What does the approver attest to?

That the bank knows who this is, why they count, how risky the relationship is and what it will do about it, and that it can manage that risk. None of the texts lists the contents of an approval, but each implies them: the Regulations tie approval to the firm’s assessment of risk and to the extent of enhanced measures, FATF expects the approver to understand the customer’s risk profile, and the FCA expects the decision to be documented. FATF adds that “In all cases, it is best to document the approval or refusal by those involved in writing.”

The approval chain at one bank, seat by seat

A useful approval chain separates the person who prepares the decision from the person who takes it, and sends harder cases higher. At the sample bank there are five roles around every PEP case, and two of them sign. The agents assemble and propose; the analyst records; the approver signs; the specialist and the auditor see what they need.

Take the sample bank’s former junior minister. On October 22, 2026 the analyst, Priya Hallworth, recorded the decision to end PEP treatment for him and family-member treatment for his wife at 9:20 a.m., with the reason code for a role that ended more than 12 months ago and shows no higher-risk factor. Owen Treharne, the senior manager acting as the MLRO’s delegate, approved it at 9:24. Only then did the client lifecycle and core banking systems take the change. The MLRO, Catriona Blackwood, sees it in her monthly report.

In PEP Screening the analyst records, a second person approves, and nothing changes before both

Approving the end as well as the start

Ending PEP treatment is a decision of the same weight as starting it, and deserves the same evidence and a second person. The Regulations do not say who must approve a declassification, but they make the decision consequential: in the UK, keeping a lower-risk former PEP under enhanced measures beyond 12 months needs a documented higher-risk rationale, and family members’ measures may stop the day the PEP leaves office. The Wolfsberg Group recommends senior management review and approval of any declassification, documented, with the prior status kept on record.

In the solution the end goes through the same chain as the start. The agent that dates each role proposes the end with the date and the rule; it cannot end treatment itself. The approver of an extension past 12 months is always the MLRO, and the written reason travels with the case. How long someone remains a PEP sets out the dates that approval rests on.

Questions people ask

Who is senior management for PEP approval in the UK?

Any officer or employee with sufficient knowledge of the firm’s money laundering, terrorist financing and proliferation financing risk exposure and sufficient authority to take decisions affecting it, under regulation 3. FCA guidance asks firms to name those people and any delegations in their policies, and to train staff on seeking approval.

Does a PEP’s family member need senior management approval?

Yes, in the UK: regulation 35(5) applies to a PEP, a family member or a known close associate alike. In lower-risk cases, such as the relatives of a UK PEP with no other risk factor, FCA guidance allows the approval to sit at a lower level of seniority.

Can the person who prepared a PEP case also approve it?

The Regulations do not say so in terms, but approval by the preparer adds little, and FATF’s guidance describes decision-making structures that bring several functions together for higher-risk PEPs. At the sample bank the rule is absolute: the person who records a decision can never approve it.

Does approval have to be in writing?

FATF’s guidance says it is best to document the approval or refusal in writing, and FCA guidance says sign-off decisions should be documented. The FCA’s 2024 review counted files without evidence of sign-off as a failing, which in practice means a written, dated record of who approved and on what.

Is approval needed for a one-off transaction with a PEP?

In the EU, from 10 July 2027: Article 42(1)(a) of the regulation covers carrying out occasional transactions as well as relationships. UK regulation 35(5)(a) is written for business relationships, and the current EU directive likewise.