A Politically Exposed Person (PEP) is someone who holds or has held prominent public positions or functions. Because of the influence and access those functions may involve, regulation treats them as a category that deserves heightened attention, a precaution based on risk, not a judgment about the person's conduct. That is why regulated institutions apply specific controls, such as enhanced due diligence, when dealing with PEPs.
Definition and legal basis
The obligation to identify and monitor PEPs comes from international standards, in particular FATF Recommendation 12, and from local regulation. In Brazil, Central Bank Circular 3,978/2020 defines the concept of PEP and the procedures required of institutions. Integrity programs linked to the Anti-Corruption Law (Law 12,846/2013) also consider exposure to PEPs when assessing third parties, partners and suppliers.
Who is considered a PEP and for how long
The positions and functions that qualify someone as a PEP are defined by each jurisdiction's regulation. In Brazil, Central Bank Circular 3,978/2020 considers a person a PEP during the exercise of the relevant public function and for the five years following the end of that exercise.
Why a PEP requires enhanced due diligence (EDD)
PEP status is treated preventively, not punitively. As a category of heightened attention in the risk-based approach, it requires enhanced due diligence (EDD): senior management approval to start or maintain the relationship, attention to the source of funds and ongoing monitoring.
Who must check for PEPs
Financial institutions, payment service providers and other regulated entities need risk-based due diligence (CDD) policies. Outside the financial sector, companies with integrity programs also map exposure to PEPs when assessing business partners, suppliers and other third parties.
How to check in practice
In practice, verification is done through name screening: the person's data is cross-checked against reference lists, both at registration and throughout the relationship. The challenge is twofold: keeping the lists up to date, without lag between official publication and the consulted database, and calibrating the matching to tell a real match apart from a false positive, dealing with spelling variations, abbreviations, namesakes and nicknames.
How Orvyan supports
Orvyan is the infrastructure for this step: it cross-checks the queried data against the lists and returns, in a single query, a risk classification (HIGH, MEDIUM, LOW or CLEAR) with the detail of each match. Its role is supporting: the platform recommends and flags the risk, but does not decide. The decision to approve, review or reject is always the institution's, according to its policy. Orvyan follows the FATF guidelines and the Wolfsberg Group best practices, without issuing any seal or certification from these bodies, and its scope is the direct screening of the person queried.