PEP and sanctions screening
How to screen customers against politically exposed person and sanctions lists, and what to do with a hit.
A politically exposed person (PEP) is an individual who holds, or has held, a prominent public position — and their immediate family and close associates. The AML/CTF Rules 2025 recognise three categories:
- Foreign PEPs — heads of state, ministers, senior politicians, senior judiciary, senior military, senior executives of state-owned enterprises, and senior officials of major political parties in foreign countries. Foreign PEPs are always treated as high-risk.
- Domestic PEPs — the same roles in Australia. Risk-rated based on the role and the customer's specific circumstances.
- International organisation PEPs — senior officials of bodies like the UN, World Bank, or IMF.
Family and close associates include spouses, parents, children, siblings, and known business partners. The categorisation persists for at least 12 months after the person leaves the prominent position.
Sanctions screening is separate from PEP screening. The relevant lists are:
- Australian sanctions — DFAT's Consolidated List, maintained under the Charter of the United Nations Act 1945 (Cth) and the Autonomous Sanctions Act 2011 (Cth). This is the legally binding list for Australian reporting entities.
- United Nations Security Council sanctions — incorporated into the DFAT list.
- Foreign sanctions (OFAC, HM Treasury, EU) — not legally binding on Australian agencies, but commonly screened for reputational and counterparty risk reasons.
Dealing with a sanctioned person — even unknowingly — is a strict-liability offence under Australian sanctions law, separate from AML/CTF obligations. The penalties are severe.
When to screen. Screening must be done at customer onboarding (before or at the time of providing the designated service) and on an ongoing basis. Lists are updated frequently — DFAT publishes consolidated updates on its website — so a one-off check at onboarding is not sufficient. Periodic re-screening is required.
What counts as a match. A "true match" is a confirmed identification of your customer with a listed person. A "potential match" — same name, different DOB or country — requires investigation before being cleared. Document your screening decisions, including potential matches that were ruled out, with the reasoning.
What to do with a hit. A confirmed sanctions hit means you cannot provide the designated service and must report it. A confirmed PEP match triggers ECDD and senior management approval, but does not automatically prevent the relationship.
The DFAT consolidated list runs to roughly 11,000 entries and is updated frequently, against which every party to every transaction will need to be screened on an ongoing basis.
What to do next: Subscribe to DFAT sanctions list update notifications and decide how your agency will operationalise screening — manual checks, a screening service, or an integrated platform.