The screening of politically exposed persons is the control that most often separates an anti-money laundering programme that survives an external audit from one that does not. Operators are expected to identify PEPs, their family members and their close associates before money moves, then to justify the depth of the checks they applied. Under GICNT-AML, that justification is examined annually by a third-party auditor alongside the rest of the customer due diligence file.
Who Counts as a Politically Exposed Person
No single global list settles the question. FATF Recommendation 12 divides the population into three groups, and Recommendation 22 extends the same treatment to casinos and other designated non-financial businesses, which is how gambling operators are captured. Foreign PEPs are high risk in every case. Domestic PEPs and heads of international organisations are assessed on a risk-sensitive basis, and a domestic PEP who also holds a prominent function abroad falls into the foreign category.
- Foreign PEPs: heads of state and government, ministers and deputy ministers, senior judges of a court of last resort, military officers of general rank, ambassadors, heads of government agencies, presidents of state-owned companies and banks, and leaders of parties represented in a legislature.
- Domestic PEPs: the same functions entrusted by the operator’s own state. In the EU, each member state notifies a national list of prominent public functions under Article 43 of the AML Regulation, so the perimeter is fixed nationally rather than by the operator.
- PEPs of international organisations: directors, deputy directors and board members of bodies established by governments, from development banks to international sports organisations.
- Family members: closed lists in some regimes, open in others. Canada names spouse or common-law partner, child, parent, parent-in-law and sibling, and treats an ex-spouse as a family member on the reasoning that access to funds outlives the relationship.
- Close associates: business partners, joint beneficial owners, romantic partners, board colleagues and prominent members of the same party.
The definition of close associates of PEPs is the softest edge of the perimeter. FATF guidance from 2013 declines to fix the boundary because it depends on the social and economic structure of the country concerned. Under the EU regime, AMLA must publish criteria for identifying close associates by 10 July 2027. Until then operators write their own criteria and defend them, which makes the written rationale part of the AML requirements for operators rather than an optional annex to them.
When an Operator Must Run a PEP Check
PEP screening obligations for gambling operators attach to events rather than to a calendar. The trigger points differ by licence, and an operator holding several licences inherits the earliest of them.
- Account opening. Canadian casinos must take reasonable measures to determine whether the person for whom they open an account is a foreign or domestic PEP, a head of an international organisation, a family member or a close associate.
- Threshold breach. The FIAU and MGA Implementing Procedures Part II for the remote gaming sector, issued on 19 July 2018 and revised on 2 July 2020, set customer due diligence and a customer risk assessment at EUR 2,000. A PEP determination then pushes the relationship into enhanced due diligence irrespective of the risk score the model produced.
- Large transactions. Canadian casinos must repeat the determination on receipt of cash or virtual currency of CAD 100,000 or more, and on the initiation or final receipt of an international electronic funds transfer of the same amount.
- Detection of a fact. FINTRAC expects operators to act on political exposure discovered outside a periodic review, whether through monitoring, world events or an open-source search.
- Periodic review. Elections, appointments and cabinet reshuffles change status without any transaction taking place, which is why ongoing PEP screening after onboarding is a scheduled process rather than a reaction.
Screening belongs inside the KYC onboarding verification standards rather than beside them. A PEP identified at the first withdrawal, after months of deposits, is itself an audit finding: the determination was available at registration and was not made.
Domestic and Foreign PEPs Are Weighted Differently by Regime
Domestic PEPs and foreign PEPs are not weighted the same, and the gap widened in 2024. British licensees answer to two overlapping frameworks, the Money Laundering Regulations and the LCCP licensing objectives, while operators serving EU markets are preparing for a single regulation that removes the national variation entirely.
| Regime | Foreign PEP | Domestic PEP | Instrument |
|---|---|---|---|
| FATF standard | High risk in all cases | Risk-sensitive assessment | Recommendations 12 and 22 |
| EU, from 10 July 2027 | Enhanced due diligence in all cases | Enhanced due diligence in all cases, no domestic discount | Regulation (EU) 2024/1624, Article 42 |
| United Kingdom, from 10 January 2024 | Enhanced due diligence at full intensity | Starting point is lower risk than a non-domestic PEP, EDD still required | MLR 2017 reg. 35(3A), inserted by SI 2023/1371 |
| Canada | Must be treated as high risk, as must family members and close associates | High risk only where the risk assessment supports it | PCMLTFA s. 9.3, PCMLTFR |
The British change is narrower than it is often read to be. Regulation 35(3A) came into force on 10 January 2024 and sets the starting point for a domestic PEP at a lower level of risk than a non-domestic PEP, with a correspondingly lighter set of measures where no enhanced risk factors are present. It does not remove enhanced due diligence, and it does not apply once other risk factors appear.
Senior Management Approval Is a Decision, Not a Signature
Senior management approval for a PEP relationship is common to every regime in the table above. Article 42 of the EU AML Regulation requires it for establishing a relationship, for continuing one, and for occasional transactions. Canadian rules require a member of senior management to review the transaction or approve keeping the account open. FATF sets the same expectation in Recommendation 12.
FINTRAC defines the approver by three attributes rather than by job title: authority to make management decisions about accounts and transactions and accountability for them, awareness of the money laundering and terrorist financing risks the business faces, and understanding of the PEP obligations themselves. That definition rules out two arrangements auditors see regularly. The analyst who ran the screen cannot approve their own determination. An automated workflow that closes the alert on a rules threshold is not a person and cannot hold accountability.
What the file needs is narrow and consistent: the named approver and their role, the date of approval, the risk rating relied on, the reasoning that connects the two, and the date the relationship is next reviewed. Approval authority belongs in the governance section of a FATF-aligned AML programme, with the escalation route to the MLRO written down before it is needed rather than reconstructed afterwards.
Establishing Source of Wealth for a PEP Relationship
Verification of a PEP’s source of wealth answers a different question from a check on a single deposit. Article 42 requires adequate measures for both. Canadian rules ask for reasonable measures, which FINTRAC describes as asking the client or consulting open sources, and require follow-up where account activity does not match what the operator was told. Where the explanation stays inconsistent and there are reasonable grounds to suspect, a suspicious transaction report follows.
- Public office income: published salary schedules, declarations of interest and asset declarations, tax records where the jurisdiction makes them available.
- Asset disposal: the sale contract or notarial deed, plus a bank credit that matches the amount and the date.
- Inheritance or gift: grant of probate or deed of gift, and a profile of the donor where the donor is the politically exposed party.
- Business ownership: a registry extract showing the holding, audited accounts, dividend records.
- Prior winnings: not a source of wealth. A balance built from earlier play is a closed loop, and an auditor discounts it unless the original stake is traced.
Operators that treat the source of funds versus source of wealth distinction as interchangeable produce files that read as complete and fail on inspection, because the document on file explains a transfer while the standard asked for the origin of the fortune behind it.
How Long PEP Status Lasts After a Person Leaves Office
Nothing switches off automatically on the day an office is vacated, and the minimum periods diverge sharply between regimes.
| Regime | After a foreign PEP leaves office | After a domestic PEP leaves office | Instrument |
|---|---|---|---|
| FATF standard | No fixed cut-off, risk-based | No fixed cut-off, risk-based | Recommendation 12 |
| EU, current law | At least 12 months, then risk-sensitive measures until the risk ends | At least 12 months, then risk-sensitive measures until the risk ends | Directive (EU) 2015/849, Article 22 |
| EU, from 10 July 2027 | Not less than 12 months, and for as long as the residual risk remains | Same, and the duty also applies when a former PEP opens a new relationship | Regulation (EU) 2024/1624, Article 45 |
| United Kingdom | Enhanced due diligence for at least 12 months after leaving office | Same minimum period | Gambling Commission AML guidance for casino operators |
| Canada | Status is permanent, and family members remain family members permanently | Status ends five years after leaving office or after death | PCMLTFR |
The residual risk is carried by enhanced ongoing monitoring rather than by the screening tool. A rule that flags a former minister’s account for deposit velocity or third-party funding belongs in the transaction monitoring escalation path, with the twelve-month clock recorded as a review date rather than as an expiry.
Where PEP Programmes Fail on Inspection
On 25 January 2023 the Gambling Commission announced a £6.1 million penalty against In Touch Games Limited following a compliance assessment. Among the anti-money laundering findings, the operator’s risk assessment did not adequately account for the risk of a customer being a politically exposed person, a family member or a known close associate; it had no policies, procedures and controls addressing those factors; and it did not follow its own policy of requesting source of funds information from customers who had deposited and lost £10,000 within a twelve-month period. It was the third regulatory action against the same licensee.
The pattern in recent enforcement actions is that the screening subscription is rarely the problem. The failures sit around it.
- Screening the registered name only, without aliases, transliterations or date of birth, so a match that exists is never surfaced.
- Treating a name match as a determination, or as a dismissal. FINTRAC is explicit that a name match is a fact but not necessarily reasonable grounds to suspect, and that address, date of birth and transaction activity are what close the gap.
- Screening once at registration and never again, which leaves a newly elected customer permanently mis-rated.
- Enhanced due diligence on a PEP relationship recorded as a completed checklist rather than as an analysis, so the file shows what was collected and not what was concluded.
- A risk assessment that omits political exposure as a factor entirely, which was the first finding against In Touch Games and remains the most common one.
Questions Operators Ask About PEP Screening
Does an online operator have to screen every player for political exposure?
Not as a fixed rule. Gambling Commission guidance ties the decision to the nature and scope of the business and to how likely PEPs are in the customer base. In practice most remote operators screen at registration, because the deposit and withdrawal thresholds that force a determination are reached quickly and a retrospective check is harder to evidence than a routine one.
Are domestic PEPs still subject to enhanced due diligence in the United Kingdom?
Yes. The amendment in force from 10 January 2024 sets the starting point of the assessment at a lower level of risk than for a non-domestic PEP, and reduces the extent of the measures where no enhanced risk factors are present. Enhanced due diligence itself is not removed, and the lighter treatment falls away as soon as other risk factors appear.
How long must enhanced measures continue after a PEP leaves office?
In the EU, for not less than 12 months and for as long as the residual risk lasts. In Canada, domestic status ends five years after leaving office, while foreign status never ends. Where an operator serves both markets, the longer period governs the customer record.
Who qualifies as senior management for approving a PEP relationship?
Someone with authority over accounts and transactions who is accountable for the decision, aware of the operator’s money laundering risks, and familiar with the PEP obligations. Seniority of title is not the test, and independence from the screening work is: the person who produced the determination cannot also approve it.
What changes for EU-facing operators on 10 July 2027?
The AML Regulation applies directly in all member states, replacing national transpositions of the directive. Article 42 codifies the three measures already familiar from FATF: senior management approval, source of wealth and source of funds, and enhanced ongoing monitoring. The practical work before that date is aligning the definition of close associates and the national lists of prominent public functions, since AMLA guidance on both is due by the same day.