PEP and Sanctions Screening for Australian Businesses

Politically exposed person checks and sanctions screening support different compliance decisions. A PEP connection informs the assessment of money laundering, corruption and bribery risk. Australian sanctions can prohibit or restrict dealings with designated people, entities, assets, activities and countries. A sound process treats these functions separately, applies the relevant legal test and keeps enough evidence to explain each outcome.

PEP categories and connected people

A PEP is a person entrusted with a prominent public position or function. Australian AML/CTF requirements distinguish between foreign PEPs, domestic PEPs and PEPs of international organisations. The category matters because the prescribed response can differ. A current cabinet minister in another country, a senior Australian public official and a senior office holder in an international organisation can therefore require different treatment after the surrounding risk is assessed.

PEP procedures must also address prescribed family members and close associates. Family connections can include a spouse or partner, children and their spouses or partners, and parents. Close associates can include people with specified joint ownership, business or beneficial ownership connections. Reporting entities should use the definitions in the AML/CTF Act and Rules rather than informal assumptions about whether a relationship appears close.

Former office holders may retain influence, access or relationships after leaving a role. A review should consider the position held, the time since departure and whether the associated risk remains. A fixed automatic end date may overlook continuing influence.

PEP status is a risk factor

Treat PEP status as a factor in assessing money laundering, corruption and bribery exposure, without inferring criminal conduct or automatically refusing service. The assessment should consider the PEP category, seniority and function, jurisdiction, known exposure to public funds, purpose of the relationship, requested service, ownership structure, delivery channel, transaction pattern, adverse information and any unexplained use of intermediaries.

Foreign PEP relationships generally attract prescribed enhanced measures. Domestic PEPs and PEPs of international organisations require a response that reflects the assessed risk, including enhanced measures where the risk is high. A business should set these distinctions out in its AML/CTF program so that staff do not apply one identical checklist to every PEP alert.

Enhanced measures can involve collecting more information about the customer and beneficial owners, testing the purpose of a structure or transaction, corroborating financial information, obtaining appropriate senior management approval and applying closer ongoing review. The depth of work should correspond to the identified risk and the requirements that apply to the PEP category.

Source of funds, source of wealth and approval

Source of funds and source of wealth answer different questions. Source of funds concerns the origin of money or assets used for a particular transaction or relationship. Relevant evidence may include bank records, a sale agreement, probate documents, loan records, business accounts or investment statements. Source of wealth concerns how the person accumulated their overall assets, such as employment, business ownership, inheritance or investments.

Reasonable measures should test whether the explanation is consistent with the customer's profile and other reliable information. The same documents will not suit every customer. Higher risk, unusual complexity or material inconsistencies support deeper corroboration.

For foreign PEPs, and for other PEP relationships assessed as high risk, the enhanced process should include senior management approval where required by the AML/CTF Rules and the entity's program. The approver should receive enough information to understand the risk, proposed controls and unresolved concerns. Approval should be recorded and revisited when a material change occurs.

Ongoing PEP review

Ongoing review can combine scheduled refreshes with event-driven checks. Relevant events include a change in public office, beneficial ownership, service use, transaction behaviour, geography or adverse information. Review frequency should be higher where the risk is higher. Records should show when the status and risk were reviewed, what changed and why the relationship continued, changed controls or ended.

Australian sanctions screening starts with DFAT

For Australian sanctions law, the legal starting point is the DFAT Consolidated List. It brings together people and entities subject to targeted financial sanctions under Australian law. Businesses must also consider the terms of the applicable sanctions regime because restrictions can extend beyond a listed name and can involve assets, ownership, control, services, trade or dealings with specified countries and sectors.

Lists maintained by the United States, United Kingdom, European Union or other authorities do not automatically define Australian legal obligations. They may be relevant where a business has a legal, operational, payment, counterparty, contractual or policy connection to that jurisdiction. The screening scope and reasons for including additional lists should be documented.

When screening should occur

Screening is commonly performed before onboarding or before making funds, assets or services available. Further checks may be appropriate when a transaction introduces a new counterparty, payment route, vessel, asset or country connection. Event-driven rescreening can follow changes to a customer's name, ownership, controllers or instructions. List-driven rescreening can follow a material DFAT update. Existing customers should be reviewed at a frequency supported by the business risk assessment and screening design.

Matching names and identifiers

Effective matching compares exact names with aliases, former names, transliterations, spelling variations and different word orders. Available identifiers such as date and place of birth, nationality, address, passport details, company registration data, beneficial ownership, vessel identifiers and aircraft details can help distinguish people and entities with similar names.

Fuzzy matching can detect useful variations, although broad settings can produce many false positives. Thresholds should be tested against the customer population and documented. A possible match does not prove designation. The reviewer should compare all reliable identifiers, assess ownership and control where relevant, and record the basis for clearing or escalating the alert.

Records and evasion indicators

The audit record should capture the data screened, lists and versions used, date and time, matching settings, alert result, information reviewed, reviewer, decision, approval and follow-up. This evidence supports internal quality checks and demonstrates how the business handled uncertainty.

Indicators of possible sanctions evasion include unexplained ownership layers, nominee shareholders, recent changes in control, altered spellings, inconsistent identity data, intermediaries without a clear role, unusual routing through third countries and transaction splitting. Each indicator requires context. Several consistent indicators may justify enhanced investigation or a suspicious matter assessment.

A measured potential-match workflow

1. The business should pause the affected onboarding, transaction or dealing where appropriate while preserving records and confidentiality.
2. A trained reviewer should compare names, identifiers, ownership, control and the exact Australian sanctions measure.
3. Unresolved alerts should be escalated to the compliance officer or sanctions specialist, with legal advice sought where the restriction or ownership position is uncertain.
4. If the match is confirmed, the business should prevent or freeze the dealing where Australian sanctions law requires it and use the relevant DFAT notification, permit or enquiry channel.
5. The business should separately assess whether the facts create reasonable grounds for suspicion under the AML/CTF Act. An SMR is made to AUSTRAC when that test is met. It does not replace any sanctions action or DFAT communication.
6. The outcome, reasoning, reports, communications and any decision to resume or refuse the activity should be retained in the audit record.

This separation avoids treating every alert as a confirmed designation or every sanctions issue as an automatic AUSTRAC report. It also gives staff a clear route from an uncertain screening alert to a documented legal and AML/CTF decision.