PEP and Sanctions Screening, Explained

If you run KYC for a regulated business, "PEP and sanctions screening" shows up in almost every onboarding flow and audit checklist. But the term hides a lot of detail — different list types, different match logic, and very different risk implications. This post breaks down what each piece actually means and how to wire it into a verification workflow.

What the terms actually mean

These three checks often get bundled together, but they answer different questions.

Sanctions screening

Sanctions lists are published by governments and international bodies to restrict dealings with specific individuals, entities, or jurisdictions. Examples include lists maintained by OFAC, the UN, the EU, and the UK.

A sanctions hit is binary in spirit: if your customer is a designated party, you generally cannot do business with them, and there may be a freezing or reporting obligation. There is little room for "risk appetite" here — it is a legal restriction.

PEP screening

A Politically Exposed Person (PEP) is someone who holds, or has held, a prominent public function — heads of state, senior politicians, senior judiciary, military officers, executives of state-owned enterprises — along with their close associates and family members.

Being a PEP is not illegal. The presence of a PEP simply signals elevated bribery and corruption risk, which triggers enhanced due diligence (EDD) rather than an automatic block.

Adverse media and criminal records

Many screening programs also check adverse media (negative news) and criminal records. These add context: a name might not be on a sanctions list yet still be linked to fraud, money laundering, or ongoing investigations.

Why screening produces so many false positives

The hard part of screening is not finding matches — it is finding the right matches. Most pain comes from name matching.

• Common names. "Maria Garcia" or "Mohammed Ali" will hit many list entries.
• Transliteration. Names move between alphabets in inconsistent ways (e.g. Mohammed / Muhammad / Mohamed).
• Incomplete list data. Some entries have only a name and partial date of birth.
• Fuzzy logic tuning. Loose matching catches everything but floods analysts; strict matching risks missing real hits.

This is why screening should not run on a name alone. The more verified attributes you can feed in — full name, date of birth, nationality, country — the more precisely you can confirm or dismiss a candidate match.

Combining identity verification with screening

Screening is only as good as the identity data behind it. If you screen a name a user typed into a form, you have screened a claim, not a person.

A stronger flow looks like this:

Step 1 — Verify the document

Read the ID document with OCR and MRZ/barcode parsing to extract the name, date of birth, document number, and nationality. Run document authentication to detect tampering, forgery, or template mismatches so the data you are about to screen is genuine.

Step 2 — Confirm the person

Use biometric face match and liveness to confirm the document belongs to the live person presenting it. This stops someone from screening their clean identity while operating under a borrowed document.

Step 3 — Screen verified data

Now run PEP, sanctions, and criminal records screening against the verified identity fields. Because the name and date of birth are extracted from an authenticated document, you can apply tighter matching thresholds and cut false positives.

Step 4 — Resolve and document

Every potential match needs a disposition: confirmed true match, confirmed false positive, or escalated for review. Keep an audit trail of who decided what and why — regulators expect this.

Building it into your workflow

A few practical decisions shape how screening behaves in production.

One-time vs ongoing screening

Onboarding screening is a snapshot. Lists change constantly — a customer who was clean at signup can be designated later. Many programs run ongoing monitoring, re-screening the existing customer base on a schedule and alerting on new matches.

Match thresholds

Set thresholds per list type. Sanctions screening usually warrants looser matching (you want to catch everything, then review), while a high-volume onboarding flow may need tighter logic to keep analyst load manageable. Tune with real traffic, not assumptions.

Risk-based escalation

Map outcomes to actions in advance:

• No match → proceed.
• PEP match → enhanced due diligence, source-of-funds checks, senior sign-off.
• Sanctions match → block, freeze if required, file the appropriate report.
• Adverse media → manual review weighted by severity and recency.

Coverage and data residency

Screening should cover the jurisdictions you operate in. Verification that spans 3,000+ document formats and 190+ countries pairs well with broad list coverage so you are not strong on identity but blind on geography. For organizations with strict data-residency or privacy requirements, on-premise deployment via ID Fort keeps sensitive screening data inside your own environment, and ISO 27001 controls back the platform.

Key takeaways

• Sanctions, PEP, and criminal/adverse-media checks answer different questions and demand different responses.
• False positives come mostly from weak input data — verify the identity first, then screen.
• Combine OCR, document authentication, and biometrics so you are screening a real person, not an unverified claim.
• Treat screening as ongoing, not one-time, and document every disposition for audit.

Done well, PEP and sanctions screening is less about chasing alerts and more about feeding clean, verified identity data into well-tuned matching logic — so your team spends time on genuine risk, not noise.