PEP Screening in the UAE: A 2026 AML Compliance Guide - ADZ | Corporate Consulting Services

Last updated: June 2026.

PEP screening in the UAE is one of the controls regulators test first, because politically exposed persons carry a higher risk of corruption and illicit funds. Getting it right means more than running a name against a list. It means classifying the customer correctly, applying enhanced due diligence, and keeping the relationship under review. This guide explains who counts as a PEP under UAE AML law, what Federal Decree-Law No. 10 of 2025 requires, and how to build screening that works.

Quick Answer: What is PEP screening in the UAE?

PEP screening is the process of identifying whether a customer or beneficial owner is a politically exposed person, someone entrusted with a prominent public function, and applying enhanced controls if they are. Under Federal Decree-Law No. 10 of 2025, UAE entities must screen for PEPs, apply enhanced due diligence, obtain senior management approval, establish source of wealth and funds, and monitor the relationship on an ongoing basis.

Key Takeaways

A PEP is not a criminal: PEP status is a risk category, not an accusation. It signals higher corruption exposure that calls for stronger controls.
Three groups to screen: Foreign PEPs, domestic PEPs, and heads or senior officials of international organisations, plus their family members and close associates.
Enhanced due diligence is mandatory for foreign PEPs: EDD applies, including source of wealth, source of funds, and senior management sign-off.
Domestic PEPs are risk-based: Apply EDD where the relationship is higher risk.
Status can persist: A person does not stop being a PEP the moment they leave office. Apply a risk-based view for a period afterward.
Screening is continuous: Re-screen as listings and roles change, not only at onboarding.

Who is a politically exposed person under UAE law?

A politically exposed person is an individual who holds, or has held, a prominent public function. UAE AML rules, in line with the Financial Action Task Force standards, split PEPs into categories, and the category affects the level of scrutiny you apply.

Category	Examples	Baseline treatment
Foreign PEP	Heads of state, senior politicians, senior government, judicial or military officials of another country	Enhanced due diligence in all cases
Domestic PEP	Individuals holding prominent public functions within the UAE	Risk-based; EDD where higher risk
International organisation PEP	Directors, deputy directors, and board members of international organisations	Risk-based; EDD where higher risk
Family and close associates (RCAs)	Spouses, children, parents, and known close business or personal associates	Same treatment as the linked PEP

What UAE AML law requires for PEPs

The PEP obligations sit within Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, applied through a risk-based approach. For a foreign PEP, the requirements are firm and cumulative.

Identify the PEP at onboarding and through ongoing screening, including beneficial owners.
Apply enhanced due diligence, the deeper investigation described in our EDD guide.
Obtain senior management approval before starting or continuing the relationship.
Establish source of wealth and source of funds, with evidence proportionate to the risk. Our note on source of funds versus source of wealth sets out the difference.
Apply ongoing monitoring, with closer review of transactions and periodic refreshes of the file.

Screening against the right data? First Compliance screens customers and beneficial owners against 5.5M+ PEP records and 1,800+ sanction lists, with ongoing monitoring built in. See how First Compliance works.

How PEP screening works in practice

Screening is a process, not a single lookup. A working programme runs the steps below and records the outcome of each.

Collect clean data. Accurate names, dates of birth, and nationality reduce both missed matches and false positives.
Screen the customer and beneficial owners. The PEP may sit behind a company, so screen the people who own or control it.
Resolve matches. Confirm whether a hit is a true match, using identifiers rather than name alone. Document the decision.
Classify the PEP. Foreign, domestic, or international organisation, and identify family members and close associates.
Apply the right level of due diligence. EDD for foreign PEPs, risk-based for others.
Obtain senior sign-off. Record the approval before the relationship proceeds.
Re-screen on a schedule. Roles and listings change, so periodic re-screening keeps the file current.

False positives and match resolution

The biggest practical problem in PEP screening is noise. Common names generate hits that are not real matches, and a team that clears them carelessly is as much a risk as one that misses a real PEP. Resolve matches with secondary identifiers such as date of birth and nationality, write down why a hit was cleared or confirmed, and keep that record. Good match resolution is what an inspector looks for, not a zero-alert system.

When does someone stop being a PEP?

A person does not lose PEP status the instant they leave office. The influence and the networks can persist, so UAE rules expect a risk-based view for a period after the person steps down. Decide the timeframe in your policy, base it on the risk the individual still presents, and document the reasoning rather than removing the flag automatically.

Common PEP screening mistakes

Screening the customer but not the beneficial owners behind a company.
Treating a domestic PEP as automatically low risk, without a risk assessment.
Clearing matches on name alone, with no secondary identifier or record.
Skipping senior management approval for a foreign PEP.
Screening only at onboarding and never re-screening.
Forgetting family members and close associates, who carry the same risk as the PEP.

Train your team to handle PEP risk correctly. Compliance 360 runs KHDA-approved AML/CFT courses covering PEPs, EDD, and screening. Explore Compliance 360 training.

Why PEPs carry higher risk

PEP rules exist because a prominent public function can be misused. A person who controls public money, awards contracts, or directs regulation has the opportunity to take bribes or divert funds, and to move the proceeds through the financial system. The risk is not that every PEP is corrupt, it is that the role gives access and influence that launderers value. That is why the controls focus on understanding where a PEP’s wealth came from and watching how it moves.

The risk also reaches the people around a PEP. Funds are often held or moved through family members and trusted associates to keep the PEP’s name off the paperwork. Screening only the named customer, and ignoring the people connected to them, misses one of the most common ways PEP risk shows up in practice.

Foreign versus domestic PEPs: how to risk-rate

UAE rules treat foreign PEPs as high risk in all cases, so enhanced due diligence is automatic. Domestic PEPs and international organisation PEPs are handled on a risk-based footing, which means you assess each relationship rather than applying a blanket rating. The assessment should weigh the seniority of the role, the customer’s access to public funds, the products they use, and any adverse information.

A risk-based approach does not mean a lighter touch by default. It means a documented decision. If you rate a domestic PEP as standard risk, the file should show why, drawing on the role and the wider profile. An undocumented assumption that domestic PEPs are low risk is one of the findings inspectors raise most often.

Relatives and close associates in depth

Family members and close associates, sometimes shortened to RCAs, sit inside the PEP regime. Family members typically include spouses, partners, children and their spouses, and parents. Close associates are people known to have close business or personal ties to the PEP, including someone who holds assets on the PEP’s behalf.

The practical challenge is identification, because the link is not always obvious from the customer’s own data. Adverse-media and relationship checks help surface connections that a name screen alone will miss. Once identified, an RCA receives the same treatment as the PEP they are linked to, including enhanced due diligence where the linked PEP is a foreign PEP.

Adverse media in PEP screening

A name match against a PEP list tells you the role. Adverse-media screening tells you whether there is negative information attached to the person, such as corruption allegations, investigations, or sanctions exposure. Used together, they give a fuller risk picture than either on its own.

Adverse media needs judgement. Not every negative article is credible or relevant, so the task is to assess the source, the seriousness, and the recency, and to record the conclusion. A single old and unverified report is treated differently from a recent investigation by a credible authority. As with match resolution, the value is in a documented decision, not a raw alert count.

Building a PEP policy: thresholds and approvals

A working programme writes its PEP decisions into policy so they are applied consistently. The table below outlines the kind of approval and review structure a policy should set out. Adapt the detail to your own risk assessment.

Customer type	Due diligence	Approval	Review cadence
Foreign PEP	Enhanced due diligence, source of wealth and funds	Senior management sign-off before onboarding	Closer ongoing monitoring, frequent review
Domestic or international organisation PEP (higher risk)	Enhanced due diligence	Senior sign-off where policy requires	Periodic review based on risk
Domestic PEP (assessed lower risk)	Standard due diligence with documented rationale	Per policy	Periodic review
Family member or close associate	Same as the linked PEP	Same as the linked PEP	Same as the linked PEP

Ongoing monitoring cadence

PEP risk does not sit still, so monitoring continues after onboarding. Transactions are reviewed against the expected profile, and the file is refreshed on a schedule and on trigger events such as a change in role or new adverse media. Re-screening against updated PEP and sanctions data keeps the classification current, because a customer can become a PEP after you onboard them, not only before. The cadence should be tighter for foreign PEPs than for lower-risk relationships, and the policy should state what that cadence is.

How ADZ helps

ADZ is a UAE-based practitioner firm. We set the PEP policy and risk thresholds your team applies, support match resolution and EDD files, and bring the data and tools to do the screening. First Compliance provides the screening engine and ongoing monitoring, Compliance 360 trains your staff, and our advisory team maps your obligations to your business.

PEP screening versus sanctions screening

PEP screening and sanctions screening are often run together, but they answer different questions and carry different consequences. Sanctions screening checks whether a person or entity is on a list that legally restricts dealing with them. A true sanctions match is a hard stop: you freeze without delay and report, as set out in our guide to targeted financial sanctions.

PEP screening is a risk signal, not a prohibition. Identifying a customer as a PEP does not bar the relationship, it raises the level of due diligence you apply. Confusing the two is a common error. Treating a PEP match as an automatic exit loses legitimate business, while treating a sanctions match as merely higher risk is a serious breach. The policy should keep the two responses clearly separate.

Data quality and screening configuration

Screening is only as good as the data and the settings behind it. Poor input data, such as inconsistent name formats or missing dates of birth, produces both missed matches and a flood of false positives. Clean, structured customer data is the first fix for a noisy screening system.

Configuration matters just as much. Matching thresholds set too tight will miss genuine matches through small spelling differences, while thresholds set too loose bury the team in noise. The aim is a calibrated setup that catches real matches and keeps false positives at a level the team can resolve properly. Review the configuration periodically, and after any change in customer base or risk appetite, so the screening keeps pace with the business. Good screening data and sensible thresholds do more for PEP detection than simply running more checks.

Recording PEP decisions

The PEP file is the evidence that your controls worked. For every PEP relationship, the record should show how the person was identified, how any screening match was resolved, the classification you applied, the source-of-wealth and source-of-funds evidence you gathered, the senior approval, and the monitoring you put in place. A decision without a record is, to a regulator, a decision that did not happen.

Keep these records for at least five years, in line with the wider UAE record-keeping rule, and make them retrievable on request. When an inspector samples your PEP files, a clear trail from identification through approval to ongoing review is what separates a programme that passes from one that draws findings. Build the documentation into the workflow so it is captured as you go, rather than reconstructed under pressure later.

Frequently Asked Questions

What is a politically exposed person?

A politically exposed person is an individual entrusted with a prominent public function, such as a senior politician, government official, judicial or military officer, or senior figure in an international organisation. Their family members and close associates are treated the same way.

Are all PEPs high risk in the UAE?

Foreign PEPs always require enhanced due diligence. Domestic PEPs and international organisation PEPs are treated on a risk-based basis, with EDD applied where the relationship is higher risk.

Does a PEP have to provide source of wealth?

Yes. For PEPs, UAE rules require both source of wealth and source of funds, supported by evidence, along with senior management approval and ongoing monitoring.

Do I need to screen family members of a PEP?

Yes. Family members and close associates of a PEP carry the same risk and receive the same treatment, so they should be identified and screened.

How often should I re-screen for PEPs?

On a schedule and on trigger events, not only at onboarding. Roles and listings change, so periodic re-screening keeps the customer file current.

When does PEP status end?

It does not end automatically when a person leaves office. UAE rules expect a risk-based view for a period afterward, with the timeframe and reasoning documented in your policy.