How Long Is Someone a PEP? Declassification, Family Members, and Where to Draw the Line

A minister leaves office. Their spouse, their adult child, their long-time business partner all remain in your customer base. How long do you keep treating each of them as a PEP? 

Major standard-setters genuinely disagree with each other. FATF's Interpretive Note to Recommendation 12 sets no maximum period at all: once someone is a PEP, they remain one for as long as they hold the function, and after leaving, firms are expected to apply a risk-based approach rather than a calendar rule. 

The EU took a different path.

Two Standard-Setters, Two Different Answers

FATF's position, laid out in its June 2013 guidance on Recommendations 12 and 22, is explicitly open-ended. A person "who is or has been" entrusted with a prominent public function falls within the PEP definition, and FATF does not specify a ceiling on how long that status should be considered relevant after the function ends. 

The floor most jurisdictions have converged on in applying FATF's risk-based approach is at least 12 months post-departure, but that's a minimum firms apply under the standard, not a maximum FATF has set. For a sufficiently high-risk former official, FATF's own framework contemplates that classification could reasonably continue indefinitely, because the question FATF actually asks is about residual influence and not just the amount of time that has passed. 

The EU took the opposite approach. Article 22 of the EU Anti-Money Laundering Directive requires firms to continue assessing the risk posed by a person for a minimum of 12 months after they stop performing a prominent public function, a codified floor rather than FATF's open-ended standard. This means EU-regulated firms have a concrete, auditable minimum they can point to, while FATF's own standard offers no equivalent number to cite, only a directive to keep assessing.

The Jurisdictional Comparison

FATF sets no fixed period and no automatic expiry. The Interpretive Note to Recommendation 12 frames the entire question as a risk-based determination, with a widely applied practical floor of 12 months after leaving office but no ceiling, meaning a high-risk former PEP can reasonably retain the classification indefinitely under FATF's own logic.

The EU codifies a 12-month minimum directly into Article 22 of its Anti-Money Laundering Directive, giving member states and regulated firms a concrete number rather than an open-ended standard, while leaving firms free to extend beyond that floor based on their own risk assessment of the individual.

The UK, operating under the Money Laundering Regulations 2017, applies a risk-based approach broadly consistent with FATF's framing, but draws an explicit distinction between domestic and foreign PEPs that FATF's core text doesn't require: domestic PEPs are not automatically subject to the same intensity of enhanced due diligence as foreign PEPs under the UK's implementation, with firms expected to calibrate scrutiny to the actual political climate, position, and risk indicators involved rather than applying uniform treatment.

The US has no fixed period in federal regulation or FATF-aligned guidance either, consistent with FATF's open-ended standard, but carries one specific, mandatory carve-out worth naming directly: 31 CFR 1010.620 requires enhanced due diligence specifically for private banking accounts held by, or on behalf of, senior foreign political figures, a narrower and more specific obligation than a general PEP-declassification rule, but a hard, citable requirement rather than guidance.

{{snippets-case}}

Relatives and Close Associates, Where Scope Really Bites

The declassification timeline question is hard enough when it's just about the officeholder. It gets even more difficult once relatives and close associates enter the picture, because this is where the definitions get loose by design rather than by oversight.

Who counts as a family member varies by jurisdiction in ways that aren't trivial: some regimes draw the line at spouses and children, others extend to parents, siblings, and in-laws, and FATF itself notes that the appropriate scope depends on a country's own socioeconomic and cultural structure rather than a single universal definition. 

Close associates are looser still, FATF's own guidance offers non-exhaustive examples, business partners, co-owners, members of the same political party or organization, rather than a bounded list, because a "close associate" relationship is inherently a judgment call about the nature of a connection, not a status that shows up on any registry.

This scope question is directly responsible for a large share of why PEP datasets turn up more false positives than sanctions lists. A sanctions list names specific designated individuals and entities. A PEP dataset, once relatives and close associates are folded in, expands well beyond the officeholder into a much larger and much more loosely defined population, and every one of those relative and associate records inherits whatever ambiguity the underlying "family member" or "close associate" definition carries. 

A reader who understands this scope problem will understand why their PEP alert volume looks the way it does, and why tightening a PEP threshold in isolation, without addressing the RCA scope decision underneath it, only solves part of the noise problem.

Domestic vs. Foreign, and Why the Treatment Differs

FATF's core Recommendation 12 text mandates automatic enhanced due diligence specifically for foreign PEPs, individuals entrusted with prominent public functions by a foreign country. Domestic PEPs and those in prominent roles at international organizations are treated under a more calibrated standard: firms should take reasonable measures to determine whether a higher-risk business relationship exists, and apply additional measures where it does, rather than applying blanket automatic EDD as a starting position.

There’s a practical reason for this. A compliance officer screening a domestic official has direct visibility into local political and media context that helps calibrate genuine risk, while a foreign PEP's source of wealth, political standing, and any adverse history are all harder to independently verify from another jurisdiction, which is exactly the asymmetry that justifies treating cross-border corruption risk as categorically higher by default. 

This distinction, present in the UK's implementation and echoed across most FATF-aligned jurisdictions, means a former domestic city councillor and a sitting foreign head of state should never have landed in the same due diligence tier in the first place.

Is a PEP Automatically High Risk?

No, and treating PEP status as an automatic high-risk flag is itself a common misapplication of the standard. FATF's framework requires enhanced due diligence for foreign PEPs as a starting position, but the actual risk tier a given PEP relationship warrants depends on seniority, jurisdiction, the specific function held, and any adverse indicators, not the bare fact of PEP status alone. The practical middle ground most mature programs land on is tiering PEPs by seniority and jurisdiction rather than applying a single undifferentiated PEP category: a sitting head of state from a high-corruption-risk jurisdiction warrants materially more scrutiny, and a materially longer post-departure monitoring period, than a former local councillor from a low-risk jurisdiction with no adverse history, even though both technically meet a PEP definition.

{{snippets-guide}}

A Written Policy, Not a Case-by-Case Call

Whatever line a firm draws, on declassification timing, on RCA scope, on domestic-versus-foreign treatment, it needs to be a documented policy applied consistently across the customer base, not a judgment call left to individual analysts on a case-by-case basis. A PEP declassification decision with no written, risk-based rationale is exactly the kind of gap an examiner will press on, and "the analyst decided it seemed fine" is not a defensible answer to why a former senior official was moved off enhanced monitoring eight months after leaving office when your own documented policy says twelve.

sanctions.io is a highly reliable and cost-effective solution for real-time screening. AI-powered and with an enterprise-grade API with 99.99% uptime are reasons why customers globally trust us with their compliance efforts and sanctions screening needs.

To learn more about how our sanctions, PEP, and criminal watchlist screening service can support your organisation's compliance program: Book a free Discovery Call.

We also encourage you to take advantage of our free 7-day trial to get started with your sanctions and AML screening (no credit card is required).

‍