PEP and sanctions screening, what UK brokers are legally required to check
Politically exposed person screening and sanctions screening get talked about as though they are one check. They are not. They come from two separate pieces of legislation, they carry different consequences for getting them wrong, and one of them has just been substantially reformed in the opposite direction most people assume. Treating them as a single combined tick is exactly the kind of shortcut that recent regulatory reviews have found firms taking, and it leaves gaps in both directions.
PEP screening, what actually changed and why it matters now
Under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, a firm must identify whether a customer, or the beneficial owner of a customer, is a politically exposed person, meaning someone entrusted with a prominent public function, or a family member or known close associate of one. Where that applies, the firm must carry out enhanced due diligence rather than standard checks.
What has changed is how domestic PEPs specifically are meant to be treated. An amendment to Regulation 35, in force since January 2024, set a new legal starting point that UK based PEPs should be treated as lower risk than foreign PEPs by default, reflecting concern that some firms had been applying the same level of scrutiny to a backbench MP as they would to a foreign official with no comparable oversight. The FCA followed this with a multi firm review published in July 2024, which contacted more than a thousand UK PEPs, received 65 responses, and examined fifteen firms in detail. Every one of those fifteen firms needed improvement. One of the most common issues was firms using definitions of PEP and their family members or close associates that were wider than what the regulation actually sets out, catching more people in enhanced scrutiny than the law requires, not fewer.
The FCA finalised its updated guidance, FG25/3, on 7 July 2025, with minor revisions a week later. It confirms a case by case, risk sensitive approach is required rather than a blanket one, and it draws a clearer line around who genuinely counts. Only those in the UK holding truly prominent positions should be treated as PEPs, not local government officials, more junior members of the senior civil service, or anyone below the most senior military ranks, and non executive board members of civil service departments should not be treated as PEPs solely for holding that role. The guidance also makes clear that a firm's Money Laundering Reporting Officer is expected to actively oversee how PEP controls operate in practice, tied explicitly to Consumer Duty as well as to the anti money laundering rules, not signed off once and left alone.
There is a real consequence attached to getting this wrong in either direction. PEPs, their family members, and known close associates have been able to complain to the Financial Ombudsman Service about their treatment since 2018. Over cautious, disproportionate handling is now as live a compliance risk as under checking, not a safer default to fall back on.
Sanctions screening, a separate legal regime with its own teeth
Financial sanctions obligations sit under the Sanctions and Anti Money Laundering Act 2018, and they apply independently of the anti money laundering regime, not as a subset of it. A firm's sanctions obligation exists whether or not that firm falls within the money laundering regulated sector.
The practical process changed on 28 January 2026, when a single consolidated UK sanctions list went live, covering more than 3,600 individuals and 990 entities across 35 separate sanctions regimes. Before this, firms had to check across multiple separate lists to be confident of full coverage. The consolidation makes the check administratively simpler, but it does not reduce the underlying obligation, checks still have to happen at the right point in a transaction, records still have to be kept, and any match or suspicion still has to be reported.
The consequences here are sharper than most brokers expect. A knowing or reckless breach of the financial sanctions regime is a criminal offence. Separately, since 2022, OFSI has had the power to issue civil monetary penalties on a strict liability basis, meaning a firm can be fined even where it had no knowledge or suspicion that a party involved was designated. Fines can reach £1 million or 50 per cent of the value of the funds or economic resources involved, whichever is greater. In practice this means the quality of a firm's screening process is what limits its exposure, not whether it can show good intentions after the fact. The scale of enforcement has grown to match. OFSI's action against GVA Capital in 2025 resulted in a £216 million fine over breaches connected to Russia and Ukraine sanctions, and more than 30 monetary penalties were issued between 2022 and 2025, with numerous further breaches published even where no fine was attached, because publication alone damages a firm's standing with clients, banks, and insurers.
Why property linked transactions specifically are under closer watch
OFSI's own threat assessment of the property sector flagged a specific set of red flags worth knowing, opaque ownership structures, payments disproportionate to the transaction, and the unexplained use of intermediary countries for holding companies. Letting agents were brought fully into scope of mandatory sanctions reporting from May 2025, regardless of the rent involved, part of a broader tightening across every service connected to property transactions. A mortgage case sits squarely inside that same transaction type, arranging finance for a residential purchase, which is exactly the kind of activity the regulator has said the wider sector needs to be more alert to, not less.
What this actually requires a broker to check, in practice
Pulled together, the practical requirement comes down to a few distinct steps rather than one combined flag. Establish, for every client and any relevant beneficial owner, whether they meet the PEP definition as the regulation actually sets it out, not a broader version, and where they do, apply proportionate enhanced due diligence rather than an automatic refusal or maximum scrutiny by default. Screen every client against the current single consolidated sanctions list and keep a record that the check was made. Treat the PEP question and the sanctions question as separate, because a client can be neither, one, or both, and the required response is different in each case. Monitor status through the life of a case rather than only at the outset, since a PEP determination or a sanctions designation can change while a case is still open. And be able to show, if asked, why a PEP determination was made, what risk factors were weighed, and who signed it off, given that the FCA now expects active oversight of how these controls work, not a one time approval.
Mortgage Magic™'s e-ID and AML screening tools run PEP and sanctions checks against the current consolidated list at the point a case opens and again through ongoing monitoring, keeping a record of the check and the reasoning behind it inside the case file itself, rather than as a separate document that has to be reconstructed later.
Two regimes, two failure modes
The instinct to fold PEP and sanctions screening into one generic check made sense when both were treated as blunt gatekeeping steps. Neither one works that way now. PEP treatment has to be proportionate enough to withstand a Financial Ombudsman complaint from someone treated too cautiously, and sanctions screening has to be accurate enough to withstand a strict liability fine that does not care whether the firm meant to get it wrong. Getting both right means keeping them as two separate, evidenced steps, not one box ticked at the start of a case and forgotten.
Comments
Post a Comment