Author: Khushboo Imrit – Team Lead
In today’s financial crime landscape, few client categories require as much judgement, discipline and ongoing scrutiny as Politically Exposed Persons, commonly known as PEPs.
The issue is not simply whether a client falls within the statutory definition of a PEP. The more important question is whether the firm has developed a risk-based framework capable of understanding, documenting and managing the risks that may arise from relationships involving public influence, access to state resources, procurement exposure or political connections.
PEP compliance should therefore not be treated as a one-off onboarding exercise. It is a continuing governance obligation.
The Statutory Definition Is Only the Starting Point
Under the Seychelles AML/CFT framework, a PEP includes a person who holds, or has held, a prominent public position in Seychelles or in a foreign country. This includes senior political, governmental, judicial, military or party officials, as well as senior executives of state-owned enterprises of national importance.
Importantly, the concept does not stop with the office-holder. It also extends to immediate family members and close associates. This is a critical point for firms because PEP risk often materialises indirectly. Influence may be exercised through family relationships, business partners, companies, intermediaries or other connected persons.
Enhanced Due Diligence Is Not Just More Documentation
Once a PEP is identified, firms are required to apply enhanced customer due diligence and enhanced ongoing monitoring. In practice, this means going beyond standard identification and verification.
The firm should take reasonable measures to establish the client’s source of wealth and source of funds, obtain senior management approval before establishing the relationship, gather additional information to understand the client’s full profile, and apply enhanced monitoring throughout the relationship.
However, enhanced due diligence should not be reduced to a document collection exercise. Its purpose is to build a coherent risk picture.
Senior Management Approval: A Governance Control, Not a Formality
One of the most important safeguards in PEP relationships is senior management approval.
This requirement ensures that higher-risk relationships are not accepted or continued solely at the operational level. It brings accountability into the decision-making process and requires senior leadership to consciously assess whether the firm is prepared to manage the risk.
The Seychelles Second National Risk Assessment for Money Laundering and Terrorist Financing (NRA 2022), published in February 2025, has identified a gap concerning enforceable measures for obtaining senior management approval for continuing PEP relationships, not only new ones. This is an important point for firms. Approval should not be treated as a one-time onboarding step. Existing PEP relationships should be periodically reviewed and re-approved, particularly where risk factors change over time.
A practical approach would be for firms to implement a periodic senior management review process covering:
- the current risk rating of the PEP relationship;
- changes in the client’s public role or political exposure;
- changes in business activity, geography or ownership structure;
- screening results, adverse media or regulatory concerns; and
- whether the rationale for continuing the relationship remains sound.
This turns senior management approval into a living governance control rather than a signature on an onboarding checklist.
The 3-Year Period: A Floor, Not a Ceiling
A common misunderstanding in PEP compliance is that once a former PEP falls outside the statutory look-back period, enhanced measures can automatically stop.
That approach is risky.
The Seychelles AML/CFT Act includes a three-year look-back period for former holders of prominent public functions. This operates as a definitional threshold for determining when a former office-holder is formally classified as a PEP. But it should not be seen as an automatic compliance exit point.
Instead, the three-year period sets a minimum statutory baseline. Once that period expires, firms should conduct a documented risk-based assessment to determine whether enhanced measures should continue.
This approach is also consistent with FATF’s position, which does not prescribe a fixed cut-off period for former PEPs. Instead, the focus is on whether the risk remains.
In some cases, the risk may reduce significantly after the individual leaves office. In other cases, residual risk may remain for many years, especially where the person previously held a very senior role, operated in a high-corruption-risk jurisdiction, retained influence over public decisions, or moved into sectors historically exposed to corruption risks such as infrastructure, extractive industries or public procurement.
What Firms Should Assess When a Former PEP Reaches the 3-Year Mark
At the end of the statutory three-year period, firms should avoid automatic declassification. Instead, they should document a risk-based assessment covering the nature of the former public role, the level of seniority, the jurisdiction involved, the client’s current business activities, the continuing proximity to public funds or public decision-making, and whether the client’s source of wealth remains consistent with their current profile.
This assessment should be retained as part of the client file. It should clearly explain why the firm has decided either to maintain enhanced monitoring, reduce the level of controls, or reclassify the relationship.
The key principle is simple: de-escalation should be evidence-based.
From Compliance Obligation to Risk-Based Governance
PEP compliance is often viewed as a technical AML/CFT requirement. In reality, it is a governance issue.
It requires reporting entities to identify sensitive relationships, ask the right questions, escalate decisions appropriately and evidence their judgement. It also tests whether the reporting entity understands that risk is not static. A client’s political exposure, business interests, networks and public influence may change over time.
The objective should not be to avoid all PEP relationships. Rather, it should be to ensure that such relationships are accepted and managed with appropriate scrutiny, transparency and accountability. The firms that do this well will move beyond box-ticking compliance. They will demonstrate a culture of judgement-led, risk-based governance — the very foundation of an effective AML/CFT framework.