PEP — the three extra measures a firm owes
A PEP classification does not prohibit anything — it adds exactly three measures, and each is testable. Article 42 of Regulation (EU) 2024/1624 sets them out on top of the ordinary customer due diligence in Article 20, and they apply to occasional transactions as well as to business relationships. The mistake supervisors find is not firms banking PEPs; it is firms flagging PEPs and then not evidencing the three measures.
1. The three measures
| # | Measure | What “done” looks like |
|---|---|---|
| 1 | Senior management approval for carrying out the occasional transaction, or for establishing or continuing the relationship | A dated decision by a named person with the authority to take it — not a system flag cleared by an analyst |
| 2 | Adequate measures to establish the source of wealth and source of funds involved | Two separate answers, evidenced — see the distinction below |
| 3 | Enhanced, ongoing monitoring of the relationship | A monitoring regime demonstrably different from the standard one, not merely a label |
Note the wording of the first: approval is required for continuing a relationship, not only for opening one. A customer who becomes a PEP during the relationship triggers the approval requirement at that point, which means the trigger has to be a re-screening event rather than an onboarding gate.
2. Who counts
The regime reaches beyond the individual. Article 46 extends it to family members and persons known to be close associates, and Article 44 addresses PEPs who are beneficiaries of insurance policies. Article 43 requires each member state to issue and keep up to date a list of prominent public functions — which is the authoritative national source for what counts as a function in that state, and a better input than a commercial list alone.
3. The 12-month tail after leaving office
Article 45 handles the person who ceases to hold a prominent public function, and it does not switch the regime off. The firm must take into account the continuing risk arising from the former function in its Article 20 risk assessment, and must apply one or more of the enhanced measures referred to in Article 34(4) until that risk no longer exists — and in any case for not less than 12 months after the person ceased to hold the function.
Article 45(3) then applies the same logic to new business: taking on a customer who previously held a prominent public function engages the duty in the same way. So a “former PEP” flag cannot simply expire on a timer without a recorded risk judgement behind it.
FAQ
Can we refuse to bank PEPs?
The AMLR does not require refusal and does not authorise a blanket ban — it requires three additional measures. A categorical exit policy raises de-risking questions rather than answering them.
How long does PEP status last after leaving office?
Enhanced measures continue until the residual risk no longer exists, and in any case for not less than 12 months from the date the person ceased to hold the function. The end of that period is a risk decision to be recorded, not an automatic reset.
Who has to approve a PEP relationship?
Senior management, for carrying out the transaction or for establishing or continuing the relationship. Because “continuing” is included, the approval has to be reachable from a periodic re-screening event, not only from onboarding.
Related: Enhanced due diligence · Source of funds vs source of wealth · The EU AML package timeline
