PEP Compliance in Germany: Risks and Enhanced Due Diligence

The term “politically exposed person” (PEP) is defined in statute under Section 1(12) of the GwG. It covers natural persons who hold or have held a prominent public position at international, European, or national level, or a public position below the national level of comparable political significance.

The statutory list is expressly non-exhaustive and includes, among others:

• Heads of state and government,
• Ministers and state secretaries (including those of the European Commission) and members of parliament,
• Senior officials of political parties,
• Judges of supreme and constitutional courts,
• Members of the governing bodies of courts of auditors and central banks,
• Ambassadors,
• Chargés d’affaires and defence attachés,
• Members of the administrative, management, or supervisory bodies of state-owned enterprises,
• Persons holding senior positions in intergovernmental or European organizations.

PEP screening obligations apply to a defined range of obligated entities under the GwG. These include credit and financial institutions, insurance companies, lawyers, notaries, tax advisors and auditors, real estate agents, dealers in high-value goods, and providers of crypto-asset services. Companies uncertain about whether their sector falls within the scope of the GwG should seek legal advice before entering into business relationships that may involve politically exposed persons.

The PEP screening obligation does not apply solely to the person in question. Under Section 1(13) GwG, family members must also be included: spouses and civil partners, children and their partners, and parents. Beyond this, Section 1(14) GwG extends the screening obligation to known close associates, including business partners with close ties to the PEP, persons who share beneficial ownership of legal entities or arrangements, and structures that have, in practice, been established for the benefit of the PEP.

An important practical note: there is no obligation to conduct covert investigations. What matters is whether a connection is publicly known or whether a plausible indication exists.

Establishing PEP status forms part of the general due diligence obligations under Section 10 GwG and must be completed no later than at the point of entering into a business relationship, before the counterparty is granted any powers of disposal. Beyond this, screening must be carried out on an ongoing, risk-based basis. The intervals are guided by the relevant term of office, internal update obligations, and the individual risk profile of the client.

Several sources are available for conducting the screening: the customer’s own declaration, which is subject to a statutory duty to cooperate under Section 11(6) GwG; comparison with PEP databases or monitoring systems; and publicly accessible sources such as official function lists or press reports. Self-disclosure should routinely be supplemented by further risk-based verification measures, particularly where elevated risk indicators are present.

At EU level, there are requirements for the publication of relevant public functions and offices. The publication of national PEP lists previously required under Article 20a of the Fifth Anti-Money Laundering Directive is being supplemented and progressively harmonised under the new EU AML package and Regulation (EU) 2024/1624. Companies should factor these sources into their risk-based PEP screening processes.

PEP screening and enhanced due diligence are conceptually distinct: the more demanding requirements of Section 15 GwG apply only once a PEP connection has actually been established. Failure to meet these requirements can result in significant regulatory sanctions, including substantial fines and adverse findings in supervisory audits. Where a PEP connection is identified, companies must act without delay.

In practice, the required steps are as follows:

1. Obtain senior management approval before entering into or continuing the business relationship, as required by Section 15 GwG.
2. Establish the origin of the assets involved, assessing plausibility and securing appropriate supporting documentation.
3. Implement enhanced ongoing monitoring, covering transaction and behavioral patterns as well as current developments relating to the person concerned, on a systematic basis.

A PEP classification does not automatically render a business relationship impermissible. The assessment is risk-based and takes into account the full picture of relevant factors, including the position held, the country of origin, and the specific transaction structure.

Even after a person leaves a prominent public position, the money laundering risk remains relevant. Section 15(4) GwG provides that the PEP-specific risk factor must continue to be taken into account for at least twelve months after the end of the term of office, and beyond that for as long as the risk cannot plausibly be said to have ceased. PEP status does not, therefore, expire automatically after twelve months. A risk-based assessment must follow to determine whether an elevated money laundering risk persists. The earlier PEP classification must be recorded in the client file as a material risk indicator.

Section 11a GwG limits the permissible processing of personal data to what is necessary for the prevention of money laundering and terrorist financing. The general due diligence obligations under Section 10 GwG cover only the determination of PEP status, family member status, or status as a known close associate. Companies handling personal data in the course of PEP screening should ensure that their processes align with both GwG requirements and their broader data protection obligations.

The entire screening process must be documented in a way that is audit-proof and traceable. At a minimum, records must capture the date of screening, the sources consulted, the specific result of the screening, the resulting risk assessment, and any follow-up measures taken. Companies should embed the PEP screening process within a broader KYC and monitoring framework and give it concrete form in internal operating procedures. Screening systems must be tested and validated regularly, and the lists used must be kept current. Staff responsible for PEP screening require targeted training.

The European Union’s new anti-money laundering package lays the groundwork for far-reaching harmonisation of money laundering prevention across the single market. Alongside Regulation (EU) 2024/1624, which will apply directly and uniformly across all member states from 10 July 2027, the package establishes the European Anti-Money Laundering Authority (AMLA) as a central supervisory body at EU level. The reform is designed to align the previously divergent national standards and strengthen the effectiveness of anti-money laundering efforts across the European Union.

For companies, this means that PEP compliance is increasingly embedded within a uniform European regulatory framework. The identification of politically exposed persons, the conduct of enhanced due diligence, and the documentation of the measures taken remain central elements of effective compliance management. At the same time, the auditability of risk-based decisions and the quality of internal control systems are becoming increasingly important.

Companies should review their existing KYC, screening, and monitoring processes regularly and adapt them to the new EU-level requirements. This applies in particular to the use of automated screening systems, the design of internal approval processes, and the audit-proof documentation of risk decisions. Early adaptation of existing compliance structures can help reduce regulatory risk and avoid findings in the course of supervisory reviews.