PEP screening in cross-border payments: how a political connection changes the release decision

PEP screening in cross-border payments is the control that identifies whether a party to a transfer is a politically exposed person, a family member or a close associate, and then routes that transfer into an enhanced due diligence path before funds move. It does not block PEPs. It raises the evidence required, adds a senior management decision and shortens the monitoring cycle. On a stablecoin settlement the sequence matters more than on a wire, because the release decision is irreversible once the transaction is confirmed. This article explains domestic versus foreign PEP treatment, the enhanced due diligence steps, approval and monitoring, false-positive handling and how PEP status changes the release decision.

What is a politically exposed person, and why does cross-border exposure matter?

A politically exposed person is an individual who holds, or has held, a prominent public function: a head of state, a minister, a senior judge, a senior military officer, a senior executive of a state-owned enterprise, a central bank board member or a senior political party official. Family members and close associates are captured too, because the risk being managed is that public office is used to extract or launder funds through relatives and intermediaries. The FATF Recommendations set the international baseline, and national rules such as Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations, and the US Bank Secrecy Act framework, define the local obligations.

Cross-border flows raise the stakes for a practical reason. A payment from a Canadian MSB to a beneficiary in a third country may involve a PEP whose role is prominent locally but obscure to the sending institution. The screening list is doing the work that local knowledge would otherwise do. The operational detail is the trigger: in Canada, an MSB must take reasonable measures to determine PEP status when it receives or sends an electronic funds transfer or virtual currency transfer of CAD 100,000 or more, and at account opening for financial entities. Many institutions screen every cross-border counterparty regardless of amount, because the cost of a screen is trivial and the cost of a missed foreign PEP is not.

How do domestic and foreign PEPs differ in treatment?

The distinction is not cosmetic. Under Canadian rules a foreign PEP, and the family members and close associates of a foreign PEP, are deemed high risk automatically. There is no discretion. A domestic PEP or a head of an international organisation is subject to a risk assessment, and only if that assessment concludes high risk do the enhanced measures apply. A further difference is duration. A foreign PEP remains a foreign PEP for life. A domestic PEP ceases to be one five years after leaving office, according to FINTRAC guidance, though the institution may choose to keep treating the person as higher risk.

In the United States the approach is risk-based rather than categorical. The August 2020 joint statement from the federal banking agencies and FinCEN confirmed that there is no regulatory requirement to apply enhanced due diligence to every PEP; the institution must assess the risk and calibrate. In practice most US institutions treat a foreign PEP in a high-risk jurisdiction as requiring the full enhanced package, and treat a domestic PEP such as a municipal official as standard risk unless other factors are present. The decision rule that survives an examination is a written matrix: PEP type, jurisdiction, role seniority, product and channel, producing a tier with defined measures.

What does enhanced due diligence actually require?

Enhanced due diligence for a PEP is a set of specific measures, not an intensified feeling of caution. The measures below are drawn from FATF Recommendation 12 and the Canadian and US implementations, and they are what an examiner will look for in the file.

• Establish the source of funds for the specific transaction and, separately, the source of wealth of the person, with documents such as employment records, sale agreements, tax returns or audited accounts rather than a customer declaration alone.
• Obtain senior management approval to establish or continue the relationship, and in Canada obtain that approval within 30 days of determining that the person is a high-risk PEP.
• Record the PEP determination, the office held, the date it was made, the reasonable measures taken and the name of the approver, so that the file stands on its own.
• Apply enhanced ongoing monitoring with tighter thresholds and a shorter review cycle, and document the review dates rather than relying on a system flag.
• For a virtual currency transfer, take reasonable measures to establish the source of the virtual currency, which in practice means a wallet screening result and an explanation of how the funds reached that wallet.
• Re-screen at defined intervals and on trigger events, such as a change of beneficial owner or a jurisdiction change, because a customer can become a PEP after onboarding.

Who approves the payment, and what must the approval record contain?

Senior management approval is the control that separates PEP handling from ordinary screening. The approver must be someone with authority over the relationship, typically the chief compliance officer or a designated executive, and the approval must be specific to the risk identified. A blanket delegation to the alerts team is not senior management approval. The approval record should state who the PEP is, the office held, the jurisdiction, the transaction or relationship being approved, the source of funds evidence reviewed, any adverse media found and dismissed, and the conditions attached, such as a transaction cap or a review date.

For a one-off cross-border payment rather than an account relationship, the same logic applies to the transaction. In Canada, when the beneficiary of an outgoing transfer of CAD 100,000 or more is determined to be a foreign PEP, the institution must take reasonable measures to establish the source of funds and ensure that senior management reviews the transaction. The practical implication is that the compliance workbench needs a hold state with a named approver field, and that the payment engine must not release a pacs.008 or an on-chain transfer while that field is empty.

A PEP alert is not a verdict. It is a request for a decision by someone senior enough to be accountable for it, on evidence good enough to survive an examiner reading it two years later.

How should false positives be handled without weakening the control?

The large majority of PEP alerts are false positives. Common names, transliteration variants and partial matches on a first and last name generate hits that have nothing to do with the customer. The risk is not that the team clears them, but that it clears them without a rule, so that a true match is dismissed with the same keystroke as a false one. A defensible clearing rule compares at least four attributes: full name including middle names, date of birth or year of birth, nationality or country of residence, and the role or position on the list entry. Where the customer file lacks a date of birth, the analyst obtains it before clearing rather than clearing on name alone.

Each dismissal should be recorded with the attributes compared and the reason, so that the same alert on the same customer can be auto-suppressed on the next screen without a fresh manual review. That suppression must be attached to the list entry identifier, not the name string, so that a new list entry for a different person with the same name still alerts. The examiner test is simple: pick ten cleared alerts at random and check that the file shows why each was not the person on the list. If the answer is a single word such as cleared, the control has failed.

How does PEP status change the release decision on a stablecoin settlement?

On a correspondent wire there is a practical gap between the decision to pay and the beneficiary receiving funds, and in some cases a recall request can succeed. On a public blockchain the transfer is final within minutes and there is no recall. That changes where the PEP control sits. The screening, the enhanced due diligence and the senior approval must all complete before the transaction is signed, and the system must enforce that ordering rather than rely on the analyst remembering it. The operating rule is that a payment instruction carrying a PEP flag cannot reach the signing step until the approval record exists.

The ISO 20022 message helps here. A pacs.008 carries structured debtor and creditor names, addresses and identifiers, which screen far more accurately than a free-text MT103 field 59. A hit on the creditor generates a pacs.002 status report with a pending status while the case is open, and a reject with a reason code if senior management declines. The Travel Rule payload in IVMS101 form carries the same structured party data to the counterparty VASP, which allows the receiving institution to run its own PEP screen before crediting the beneficiary. Wallet screening adds a second dimension: a beneficiary address linked to a sanctioned entity or a known illicit service is a stronger signal than a name match and should escalate rather than merely flag.

Ongoing monitoring closes the loop. A stablecoin relationship approved for a PEP should carry tighter KYT thresholds, a defined review date and a re-screen on every list update. When a list update turns an existing customer into a PEP, the case must reopen and the approval must be refreshed, because the original approval was given on facts that no longer hold.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs, with sanctions and PEP screening, wallet screening and KYT built into the flow rather than bolted onto it. Because it is ISO 20022 native, the structured debtor and creditor fields in pacs.008 are what the screen runs against, and a hit holds the instruction in the compliance workbench until a named approver clears it, with a pacs.002 status report tracked by UETR reporting the pending state to the sending institution. Travel Rule data travels in IVMS101 form, so the receiving VASP can screen the same parties. Settlement in regulated stablecoins such as USDC and USDT completes in minutes with on chain auditability, and the tamper evident audit trail preserves the approval record for an examiner. SpendTheBits is a Bank of Canada registered payment service provider and a named finalist in the Swift Hackathon 2026 Technical Challenge.