A screening hit is a starting point—not a risk conclusion.

In financial crime compliance, few concepts are more frequently misunderstood than the relationship between Politically Exposed Person (PEP) screening and PEP risk assessment.

A customer is screened.

A potential PEP match appears.

The system generates an alert.

The customer is classified as a PEP.

Enhanced Due Diligence is triggered.

From an operational perspective, the process may appear complete.

But it is not.

A PEP screening result tells an institution that an individual may be connected to a prominent public function.

It does not, by itself, tell the institution:

Whether the match is genuine
What level of influence the individual actually holds
Whether the individual still exercises influence after leaving office
Whether the customer’s wealth is consistent with their known profile
Whether the relationship presents a heightened money laundering risk
Whether the customer has access to public funds or procurement processes
Whether their family members or close associates are relevant to the risk
Whether the account is being used to conceal or move illicit proceeds

Screening identifies a potential risk factor.

Risk assessment determines what that risk actually means.

This distinction is particularly important in Africa, where PEP risk can be shaped by political structures, state-owned enterprises, public procurement, natural resources, informal influence networks and significant differences in the availability of reliable public information.

What PEP screening actually does

PEP screening is fundamentally an identification process.

It attempts to determine whether a customer, beneficial owner, family member or close associate may be connected to a prominent public function.

This can involve screening against:

Commercial PEP databases
Government websites
Parliamentary records
Official gazettes
Corporate registries
Public asset declarations
Reputable media sources
Open-source intelligence

Commercial databases can be valuable tools.

However, FATF explicitly states that external databases are not sufficient by themselves to meet PEP obligations, nor does FATF require institutions to use commercial PEP databases.

This is an important point.

A database is not a risk assessment.

It is an information source.

A screening result should therefore be viewed as the beginning of an investigation rather than the end of one.

A PEP is not automatically a suspicious customer

The term Politically Exposed Person is sometimes incorrectly treated as a synonym for corruption, money laundering or criminality.

That is not the purpose of the PEP framework.

PEP controls are preventive measures.

They exist because individuals entrusted with prominent public functions may have greater opportunities to abuse public power, access public funds or influence decisions.

But being a PEP does not mean that an individual has committed a crime.

FATF is clear that PEP measures should not be interpreted as meaning that all PEPs are involved in criminal activity.

This distinction matters greatly.

A senior government official may be a PEP because of their public function.

That classification creates an obligation to understand and manage the relationship appropriately.

It does not automatically create evidence of suspicious activity.

The correct approach is therefore neither:

“PEP = criminal.”

Nor:

“PEP = automatically acceptable.”

The correct approach is:

“PEP status is a risk factor requiring proportionate, risk-based assessment.”

The African context: why a screening match may tell you very little

PEP screening can be particularly challenging across African markets.

The issue is not simply that information may be difficult to find.

The bigger challenge is that formal information may not always reflect the full reality of influence.

A person may no longer hold a formal government position but may continue to exercise significant political or economic influence.

An individual may not be listed as a director of a state-owned company but may have substantial influence over decisions affecting public contracts.

A former minister may have left office but continue to maintain strong relationships with senior officials, political parties or state-owned enterprises.

This is why the question:

“Is this individual a PEP?”

is often only the first question.

The more important question may be:

“What influence does this individual have, or continue to have, and how does that influence affect the financial crime risk?”

Formal office and informal influence

One of the most important challenges in PEP risk assessment is the difference between formal authority and informal influence.

A person may no longer hold an official position but still maintain:

Political influence
Access to senior government officials
Influence over public procurement
Relationships with state-owned enterprises
Influence over public appointments
Control over business networks
Access to government contracts

This is particularly relevant when assessing former PEPs.

FATF guidance states that there should not necessarily be a fixed time limit after which an individual automatically stops being treated as a PEP. The decision should be based on risk, including factors such as the level of informal influence the individual may continue to exercise and the seniority of the former position.

A five-year rule may therefore be operationally convenient.

But convenience is not the same as risk-based compliance.

The right question is not simply:

“How long ago did this person leave office?”

It is:

“Does this person still present a heightened risk because of their former position, influence or relationships?”

Not all PEPs present the same level of risk

Another common weakness in PEP programmes is treating every PEP as having the same risk profile.

A head of state, a senior minister responsible for public procurement, a local government official and a senior executive at a state-owned enterprise may all fall within the broad concept of political exposure.

But the risk factors may be very different.

The assessment should consider factors such as:

The nature of the public function

What powers did the individual have?

Did they control or influence:

Public funds?
Government contracts?
Licences?
Natural resources?
State-owned enterprises?
Tax decisions?
Public appointments?

The seniority of the position

A person’s formal title matters.

But so does their actual influence.

The jurisdiction

The institution should understand the corruption and financial crime risks associated with the relevant jurisdiction.

This does not mean that an entire country or population should be treated as inherently high-risk.

It means that country risk should be assessed in context.

The sector

Certain sectors may create greater exposure to corruption risks, including:

Extractive industries
Construction
Defence
Infrastructure
Public procurement
Telecommunications
Energy
Natural resources

The source of wealth

Does the customer’s wealth appear consistent with:

Their known career history?
Their official salary?
Their business interests?
Their declared assets?
Their family background?

An apparent mismatch does not automatically prove criminality.

But it may require further investigation.

The source of funds

The institution should understand where the specific funds involved in the relationship or transaction originated.

A customer may have legitimate wealth but receive a particular payment from a suspicious or unexplained source.

Source of wealth and source of funds are related—but they are not the same question.

The PEP risk assessment should go beyond the individual

A common mistake is to focus exclusively on the person identified as the PEP.

However, the financial crime risk may exist in the wider network.

The relevant relationships may include:

Family members
Close associates
Business partners
Companies
Trusts
Foundations
Nominees
Intermediaries

The customer may not be the PEP.

The customer may be a company owned by a close associate.

The funds may not be held in the PEP’s name.

They may move through a relative, a business partner or a complex corporate structure.

This is why PEP risk assessment must connect with:

Beneficial ownership
Source of wealth
Source of funds
Adverse media
Transaction monitoring
Corporate structure analysis

A screening engine can identify names.

It cannot, by itself, understand the entire network.

The limitations of commercial PEP databases

Commercial PEP databases have become an important part of the AML technology ecosystem.

They can help institutions:

Identify potential PEPs
Search large volumes of customers
Monitor changes in public positions
Support ongoing screening

But they also have limitations.

Incomplete information

Not every public official will appear in every database.

This may be particularly relevant for less prominent domestic officials or individuals from jurisdictions where public information is limited.

Data quality

Information may be:

Outdated
Incomplete
Inaccurate
Duplicated
Missing dates of birth
Missing reliable identifiers

False positives

Common names can generate multiple unrelated matches.

A name match is not an identity match.

Inconsistent classification

Different vendors may classify the same individual differently.

One database may classify an individual as a PEP.

Another may not.

This does not necessarily mean that one vendor is wrong.

It may reflect differences in methodology, source interpretation or regulatory definitions.

Limited contextual information

A database may tell you that an individual is a PEP.

It may not tell you:

How influential the person is
What public resources they controlled
Whether they continue to exercise influence
Whether their wealth is consistent with their profile
Whether their financial activity is suspicious

This is the difference between screening and investigation.

The African information challenge

PEP risk assessment in Africa can be particularly difficult because the quality and availability of public information vary significantly between countries.

Institutions may face challenges such as:

Limited corporate registry information
Inconsistent public asset declarations
Multiple official languages
Different naming conventions
Limited digitalisation of government records
Political transitions
Incomplete historical records
Reliance on local-language media
Limited information on beneficial ownership

These challenges create an important operational reality.

The absence of information is not necessarily evidence of low risk.

But neither is the absence of information evidence of criminal conduct.

This is where professional judgement becomes essential.

A compliance analyst may need to combine:

Customer-provided information
Official government sources
Corporate registry records
Local media
International media
Court records
Asset declarations
Open-source intelligence

The quality of the assessment will depend heavily on the ability to understand the reliability and context of each source.

A PEP hit is not an adverse media hit

Another important distinction is the difference between:

PEP status

and

evidence of adverse conduct

A person may be a PEP with no known allegations of corruption.

Another person may not be a PEP but may have significant adverse media relating to fraud, bribery or money laundering.

These are different risk factors.

They should not be automatically combined.

For example:

PEP status + credible corruption allegations + unexplained wealth + suspicious transactions

may create a significantly different risk profile from:

PEP status + transparent wealth + consistent income + no adverse information + normal account activity

The PEP classification is only one component of the broader risk assessment.

This is why risk scoring systems that automatically assign the same risk level to every PEP may fail to reflect the real risk.

Enhanced Due Diligence should be proportionate

The purpose of Enhanced Due Diligence is not simply to collect more documents.

It is to understand the risk more effectively.

Depending on the circumstances, EDD may include:

Senior management approval
Establishing source of wealth
Establishing source of funds
Enhanced ongoing monitoring
More frequent customer reviews
Reviewing ownership structures
Understanding business relationships
Reviewing relevant adverse information

However, the measures should be proportionate to the risk.

FATF guidance emphasises that PEP risk should be assessed using a risk-based approach. The controls applied should therefore reflect the actual risks presented by the relationship rather than simply the label attached to the customer.

A risk-based approach does not mean ignoring PEP status.

It means understanding what PEP status means in the specific context of the relationship.

A practical framework for African PEP risk assessment

A useful PEP risk assessment can be structured around five questions.

1. Who is the individual?

Confirm the identity.

Do not rely on the name alone.

Use identifiers such as:

Date of birth
Nationality
Country of residence
Previous positions
Employer
Known affiliations

The first objective is to establish whether the screening result is a genuine match.

2. What public function did the individual hold?

Understand:

The position
The seniority
The duration
The authority
The access to public resources

Not every public position creates the same exposure.

3. What influence does the individual have today?

This is particularly important for former PEPs.

Consider:

Political connections
Business relationships
Continued access to government
Influence over public contracts
Ownership of companies
Relationships with other PEPs

Formal departure from office does not necessarily mean the end of influence.

4. Is the wealth explainable?

Assess whether the customer’s wealth appears consistent with their known background.

This may involve reviewing:

Business ownership
Employment history
Investments
Inheritance
Property
Family wealth
Corporate interests

The goal is not to prove the customer’s entire financial history.

The goal is to develop a reasonable understanding of the source of wealth.

5. Does the financial activity make sense?

Finally, the institution must consider the actual relationship.

Are the transactions:

Consistent with the customer’s profile?
Connected to known business activity?
Supported by documentation?
Involving high-risk sectors?
Connected to unexplained third parties?
Moving through complex structures?

This is where PEP screening connects with transaction monitoring.

The future of PEP screening in African fintech

As African fintech continues to expand, PEP risk assessment will become increasingly important.

Digital financial services can create faster and more accessible channels for moving money.

A politically connected individual may use:

Digital banks
Mobile wallets
Payment platforms
Cross-border services
Cryptocurrency exchanges

The technology may change.

The underlying risk assessment principles do not.

Fintechs should therefore avoid treating PEP screening as a simple technical checkbox.

The most effective programmes will combine:

Automated screening.

Reliable customer data.

Beneficial ownership analysis.

Local knowledge.

Open-source intelligence.

Source-of-wealth analysis.

Transaction monitoring.

Human judgement.

The future of PEP compliance will not be determined by who has the largest database.

It will increasingly be determined by who can interpret information most effectively.

Conclusion

PEP screening is important.

But screening is not risk assessment.

A database hit is not a finding of corruption.

A PEP classification is not evidence of money laundering.

And the absence of a database hit does not necessarily mean that political exposure or influence does not exist.

For financial institutions and fintechs operating across Africa, the challenge is particularly complex.

The relevant risk may be found not only in the individual’s formal position but also in:

Informal influence
Business networks
State-owned enterprises
Public procurement
Natural resources
Family relationships
Close associates
Corporate structures

This is why the most important question after a PEP screening alert should not be:

“How do we close this alert?”

It should be:

“What does this person’s political exposure actually mean for the financial crime risk of this relationship?”

That is the difference between PEP screening and PEP risk assessment.

And in the African context, that difference matters.

#AML #FinancialCrime #PEP #PEPScreening #KYC #Compliance #Africa

PEP Screening Is Not PEP Risk Assessment: The African Context