Since 1 July 2026, Australian law has required real estate agents, accountants, lawyers, conveyancers, and trust and company service providers to screen their customers for PEP status and against sanctions lists. Around 80,000 newly regulated businesses entered the AML/CTF regime on that date, most of them with no prior compliance program.
PEP screening means checking whether a customer holds a prominent public function, or is close to someone who does, and applying enhanced due diligence when they do. Sanction screening is the separate check against lists of persons designated under Australian sanctions law. A PEP match changes how you handle the relationship. A sanctions match stops it.
The PEP and sanctions screening cycle. The loop back from ongoing monitoring is the step most newly regulated entities leave out.
What is a politically exposed person under AML rules?
The Financial Action Task Force (FATF) defines a politically exposed person as an individual who currently holds or has been entrusted with a prominent public function. The category covers individuals entrusted with authority over public money or public decisions:
- Heads of state or government
- Senior politicians and senior government officials
- Judicial or military officials
- Senior executives of state-owned corporations
- Important political party officials
Senior officials inside Australian government agencies fall within scope as readily as their overseas counterparts. PEP status also extends beyond the office holder to close family members and known close associates, often called RCAs. Spouses, parents, siblings and adult children inherit an amplified risk profile, as do business associates known to be closely connected. Screening the named customer alone leaves the most obvious route around the control wide open.
Family members and close associates inherit the risk profile without holding any public position themselves.
A PEP is not presumed to be involved in financial crime. The elevated scrutiny rests on three measurable factors: access to public funds, potential influence over government contracts and decisions, and a higher statistical correlation with bribery or corruption. That combination creates both regulatory exposure and reputational risk, which is why the response is enhanced due diligence rather than refusal.
PEP screening and sanction screening: what is the difference?
They answer different questions and carry different consequences. A PEP match is a risk signal that changes how you handle the relationship. A sanctions match is a legal prohibition.
| PEP screening | Sanction screening | |
|---|---|---|
| Question asked | Does this person hold a prominent public position, or are they close to someone who does? | Is this person or entity designated under Australian sanctions law? |
| What a match means | Elevated risk. Apply enhanced due diligence. | Prohibition. Freeze assets and do not deal. |
| Data recorded | Office, jurisdiction, tenure, close associate relationships | Designation, aliases, dates of birth, citizenships, addresses |
| Discretion available | Risk-based, calibrated to seniority and jurisdiction | None. The obligation is absolute |
Most firms run the two together as PEP and sanctions screening, because a single search across both data sets is faster and leaves fewer gaps than two disconnected checks. Platforms such as WatchEye draw PEP and sanction screening lists from all major sanctioning bodies, law enforcement agencies and financial regulators globally, with 100% coverage of PEP, sanction and enhanced due diligence lists worldwide.
What a reviewer does when a result lands. The sanctions branch terminates. The PEP branch continues under enhanced due diligence.
Which sanctions lists must Australian organisations screen against?
The starting point is the DFAT Consolidated List, maintained by the Australian Sanctions Office within the Department of Foreign Affairs and Trade. It covers every person, entity and vessel subject to targeted financial sanctions, travel bans, arms embargoes and maritime measures under Australian law, drawn from both United Nations Security Council designations and Australia’s autonomous regime under the Autonomous Sanctions Act 2011.
The list records more than names. Entries carry aliases, dates of birth, places of birth, citizenships and addresses, which is precisely the supporting data that makes reliable matching possible. AUSTRAC’s own guidance notes that spellings vary, particularly for non-English names rendered into English, and recommends fuzzy searching and checks against alternative spellings.
Illustrative record structure. The alias and date of birth fields are what make matching reliable enough to use.
The consequences of getting this wrong are not administrative. Dealing with an asset owned or controlled by a designated person exposes a body corporate to a fine of up to 10,000 penalty units, which stood at $3.3 million as of 7 November 2024, or three times the value of the transaction, whichever is greater. Global watchlists matter for customers with international exposure, but the Consolidated List is the one with direct Australian legal force behind it.
Domestic PEP, foreign PEP or international organisation PEP?
The category determines how much discretion you have. A domestic PEP is entrusted with a prominent public function within the reporting country itself. Australia’s AML/CTF framework recognises domestic PEPs explicitly. Some jurisdictions once applied lighter scrutiny to domestic figures, but FATF has removed that distinction. You must assess each domestic PEP on a risk basis, and where the assessment lands at higher risk, the same enhanced measures apply.
A foreign PEP is entrusted with a prominent public function by a foreign country, and carries a higher risk profile by default because their activities are less visible to an Australian reporting entity. FATF Recommendation 12 leaves little discretion. In every case you must:
- Apply enhanced customer due diligence
- Obtain senior management approval before establishing or continuing a business relationship
- Take reasonable measures to establish source of wealth and source of funds
- Run enhanced ongoing monitoring for the life of the relationship
The third category is the international organisation PEP: people who hold positions such as director, deputy director, board member or equivalent senior management inside an international organisation. Their influence and their access to significant funds put them in the same high risk bracket. A complete framework captures political exposure wherever it originates, whether domestically, in a foreign country, or within an international body.
Three categories, one framework. Foreign PEPs trigger enhanced measures automatically. The other two require a documented risk assessment.
How do you screen for PEPs during KYC onboarding?
Screening belongs at or before the start of the business relationship, alongside the rest of your know your customer checks. Customer due diligence (CDD) requires you to screen natural persons and, for corporate customers, every ultimate beneficial owner behind the structure. A company that passes its own check can still be controlled by someone who does not.
Related parties matter as much as the customer record. Close associates and family members should be identified where the data allows, because PEP relationships are the mechanism through which exposure moves off the named account. Comprehensive PEP screening looks for the connection, not just the individual.
Screening the named customer alone misses the beneficial owner two layers down. That gap is where the obligation is usually failed.
Matching quality determines whether the control is usable at all. Name-only matching generates false positives at a volume that will bury a small compliance team, so screening should draw on additional identifiers such as date of birth, country and any recorded alias to narrow results. The goal is a short list a reviewer can work through, with a documented reason recorded for every dismissal.
What does a PEP check involve when an individual is a PEP?
Once you confirm an individual is a PEP, enhanced due diligence applies: source of wealth and source of funds enquiries, senior management sign-off on the relationship, and more frequent transaction monitoring. The depth should track the assessed risk rather than one blanket response for every match.
Good PEP data lets you calibrate. A tool that differentiates between PEP tiers by seniority, function and jurisdiction gives you a defensible basis for treating a serving head of state differently from a local official who left office a decade ago. WatchEye covers domestic and foreign PEPs across 268+ countries and territories along with close associate relationships. Each search returns a classification tier, the basis for the match, associated data points such as position, country and dates, and related adverse media where it exists.
What a PEP check returns. The classification tier and match basis are what make the resulting decision defensible.
That output is what makes the decision auditable. A reviewer who reopens the file two years later can see which PEP database entry triggered the alert, what the person’s role was, and what the business did about it.
Which data sources should your PEP data come from?
Screening is only as good as the lists behind it. Global Data sources its PEP and sanction data from all major sanctioning bodies, law enforcement agencies and financial regulators, which produces the most complete collection of anti-money laundering and counter-terrorism financing compliance data available, with 100% coverage of PEP, sanction and enhanced due diligence lists worldwide.
Data sovereignty is a separate question from coverage, and it matters to Australian reporting entities. All data is hosted locally within Australia with no flow of customer data offshore. For firms handling identity documents and customer records under AML compliance obligations, that removes an entire category of vendor risk from the assessment.
Coverage across 268+ countries and territories, with all data hosted locally in Australia and no customer data sent offshore.
Configuration is the third factor. Global Screening searches worldwide PEP, sanction and enhanced due diligence lists, and enhanced Global Screening lets you select your own screening lists and define the matching rules. A global PEP search casts the widest net, while narrower list selection and tuned matching suit a concentrated customer base and a small review team.
Does adverse media belong in PEP and sanctions screening?
Yes, because official lists lag reality. Adverse media captures reporting on allegations of bribery, corruption or money laundering before formal charges are laid, and sometimes before the individual appears on any PEP database at all. Someone may hold a prominent public function that no list has yet recorded.
Treat it as context rather than a verdict. Adverse media informs how much enhanced due diligence a relationship warrants and gives reviewers a fuller picture of a customer’s integrity than a list entry alone provides. Robust screening tools return related adverse media alongside the match itself, which keeps the evidence in one place.
The corruption risk that adverse media surfaces is often the earliest signal available. Ignoring it means your first indication of a problem arrives with a regulator’s enquiry.
How does ongoing PEP monitoring keep records current?
PEP status is not a fixed attribute, so a single check at onboarding decays from the day it is run. Someone may be appointed to a prominent public position months after you took them on, or leave one and see their risk profile decline. PEP lists are constantly evolving as elections, appointments and resignations flow through, and the Consolidated List changes frequently as designations are added and removed.
A customer screened once at onboarding. Their appointment to public office in month seven never reaches the compliance team.
Ongoing PEP monitoring solves this through risk-based periodic re-screening, with the interval set by the customer’s assessed risk rather than a uniform annual sweep. FATF Recommendation 12 mandates enhanced ongoing monitoring for foreign PEPs specifically, so those relationships need the tightest cycle.
This is where the first year of Tranche 2 compliance tends to come apart. Customers taken on in the opening weeks of the regime were screened once, and unless re-screening was automated at the same time, those files are already ageing. PEP screening software that re-runs checks and flags status changes is the only realistic way to hold the standard at volume.
What audit trail does AML compliance require?
Every screening result must be stored, not only the alerts you acted on. AUSTRAC’s AML/CTF Rules impose record-keeping obligations that depend on a full audit trail, retained for seven years, showing what was screened, when, against which lists, and what happened next. Clear searches are part of the evidence, because they demonstrate the control was running when it should have been.
Manual processes fail this test. They cannot deliver the frequency, consistency and completeness the AML/CTF Act requires, and reconstructing a spreadsheet-based history under examination is close to impossible. Automated systems document each step from the initial screening through to any enhanced measures that followed.
The practical test is simple. Pick a customer file at random and try to answer four questions from the record alone: what was screened, against which lists, on what date, and who reviewed the result. If any answer sits in someone’s memory or an email thread, the audit trail is incomplete.
Where does transaction monitoring fit in detecting money laundering?
Screening tells you who to watch. Transaction monitoring tells you what they are doing, and it is the control that turns a PEP flag into something operationally useful.
Identified PEPs and other high-risk individuals warrant more frequent and more detailed review of their financial activity, with attention to unusual patterns or deviations from the expected profile established during onboarding. That baseline is why source of wealth enquiries matter beyond the file note: without an expected pattern, deviation is invisible.
Illustrative profile. Without a baseline established at onboarding, there is nothing for a deviation to deviate from.
Findings feed back into the risk rating and, where the activity warrants it, into a suspicious matter report. Monitoring that never changes a customer’s risk classification is not monitoring, it is logging.
What newly regulated organisations still need to fix
The Tranche 2 reforms brought PEP screening in as a formal obligation for the first time for firms that had never run a compliance program. Obligations commenced on 1 July 2026 and the AUSTRAC enrolment window closed on 29 July 2026, so the preparation phase is over. What remains is evidencing that the control runs on every relevant engagement rather than only the obvious ones.
Three gaps show up repeatedly in programs assembled at speed:
- Screening covers the named customer but not the beneficial owner behind a corporate client
- Checks run at onboarding and never again, so PEP status changes go unnoticed
- Results live in a mailbox or a spreadsheet, leaving nothing an examiner can follow
Each of those is a documentation problem before it is a technology problem. Start with the customer risk assessment and the escalation procedure, then check the tool against them rather than the other way round.
Cost structure is the last obstacle for smaller firms, and it has a straightforward answer. A pay-as-you-go model lets real estate agents, accountants and other Tranche 2 entities run PEP checks on demand without a subscription, and scale usage in line with onboarding volumes rather than paying for capacity they have not yet needed.
Key points to remember
- A PEP is anyone entrusted with a prominent public function, and the definition extends to close family members and known close associates.
- PEP status signals elevated risk, not guilt. The required response is enhanced due diligence, not automatic refusal.
- Sanction screening and PEP screening answer different questions. A PEP match is calibrated; a sanctions match is absolute.
- Screen against the DFAT Consolidated List maintained by the Australian Sanctions Office. Penalties for dealing with a designated person reach $3.3 million for a body corporate, or three times the transaction value.
- Foreign PEPs trigger enhanced measures automatically under FATF Recommendation 12, including senior management approval and source of wealth enquiries.
- Domestic PEPs and international organisation PEPs require the same risk-based assessment. FATF has removed the old domestic exemption.
- Screen beneficial owners and related parties, not just the named customer.
- Use date of birth, country, alias data and fuzzy matching to control false positives.
- Re-screen on a risk-based cycle. Lists change constantly, and a one-off check goes stale within months.
- Keep every screening result, including clear searches, for seven years.
- Tranche 2 entities have been regulated since 1 July 2026. The task now is proving the control runs consistently, not preparing to start it.