PEP & Watchlist Screening for Crypto Firms (2026 Guide)

Last updated: 4 October 2026

PEP and watchlist screening means checking customers, and the people behind business customers, against lists of politically exposed persons (PEPs), sanctions designations, law-enforcement and regulatory watchlists, and adverse media. A sanctions hit means you must not transact. A PEP hit does not stop the relationship. It triggers enhanced due diligence (EDD): you check source of wealth and source of funds, get senior sign-off and review the customer more often. Crypto firms have to run these name checks alongside wallet-address screening, and both feed into one customer risk score.

Most teams say "screening" and mean sanctions. Sanctions is the hard legal prohibition, so it gets the attention. But regulators assess a compliance programme on several separate screening obligations. Each one has its own list, its own risk treatment and its own way of failing.

Teams often confuse them, and the usual cost is a false-positive rate nobody can work through. This guide covers what a PEP watchlist is, who counts as a PEP, where the lists come from, how screening works step by step, which data providers exist, and what changes for crypto firms in 2026 and 2027.

This guide is educational and is not legal or compliance advice. Confirm your obligations with qualified counsel in your jurisdiction.

What is a PEP watchlist?

A PEP watchlist is a database of people who hold, or recently held, a prominent public function, plus their family members and known close associates. Firms screen against it so they know when a customer needs enhanced due diligence. The term is a little misleading. No single official "PEP list" exists that everyone screens against. In practice, a PEP watchlist is a dataset built by a data provider from government sources, parliamentary records, official gazettes and media. It is usually sold together with sanctions and other watchlists.

The obligation itself comes from FATF Recommendations 12 and 22. Under them, financial institutions and other obliged businesses have to identify PEPs and apply additional measures. The FATF's June 2013 guidance on those Recommendations is still the reference text. It stresses that the measures are preventive, not criminal, and that being a PEP should not be read as a sign of wrongdoing.

Who counts as a PEP?

The FATF framework sorts PEPs into three groups:

• Foreign PEPs: people entrusted with prominent public functions by another country. Examples are heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises and important political party officials.
• Domestic PEPs: people entrusted with those same functions in your own country.
• International organisation PEPs: members of senior management of international organisations, such as directors, deputy directors and board members.

Under the FATF Recommendations, family members and close associates (often called RCAs, for relatives and close associates) are treated as PEPs too, because the relationship could be abused. This is where most of the screening difficulty sits. A minister is easy to find. Their business partner's spouse is not.

Middle-ranking and junior officials are generally outside the definition. That is one reason a tool that flags every local councillor at the same level as a head of state creates noise without reducing risk.

Is there an official PEP list?

Not a global one. Sanctions lists are official documents published by OFAC, the EU, the UN and others. There is no equivalent official list of the people who are PEPs. The closest thing in Europe is the EU list of prominent public functions, published by the European Commission in the Official Journal in 2023 under Article 20a of the Fourth AML Directive. It sets out which positions count as prominent public functions in each Member State, in international organisations accredited in the EU, and in the EU institutions. It does not name the people who hold them. Turning those positions into names is the job of your data provider.

The four types

1. Sanctions screening

Binary and absolute. If a party is designated, you may not transact. There is no risk-based override and no commercial judgement to exercise. Lists come from OFAC, the EU, the UN and national regimes.

Failure here is a legal breach, not a control weakness. Covered in depth in best sanctions screening software.

2. PEP screening

Politically exposed persons: senior public officials, their close associates and family members. Being a PEP is not a prohibition. It triggers enhanced due diligence: source of wealth, source of funds, senior sign-off, more frequent review.

This is where teams most often go wrong in both directions. Some block PEPs outright, which is over-compliance that loses legitimate customers. Others flag and ignore, which is under-compliance. The correct answer is a documented EDD process with a named approver.

PEP status is also tiered (a head of state and a municipal official carry different risk), and it persists for a period after leaving office. Any tool that returns a flat yes/no is too blunt.

3. Adverse media

Negative news screening for financial crime, fraud, corruption or organised crime. It is the fuzziest category and generates the worst noise: common names, stale articles, and stories where your customer is the victim rather than the perpetrator.

Look for structured classification by allegation type and recency, not a keyword search over a news index.

4. Entity and UBO screening

When onboarding a business you screen the company, its directors, and its ultimate beneficial owners. The chain matters: a clean company owned through two holding structures by a sanctioned individual is a sanctioned exposure.

This is the hardest to automate because ownership data quality varies enormously by jurisdiction. Covered in KYB compliance requirements and best KYB software for crypto.

Other watchlists you will meet

Commercial "watchlist" bundles usually include more than the four categories above: law-enforcement wanted lists, regulatory enforcement actions, debarment and exclusion lists, and state-owned enterprise data. Whether you screen against them is a risk-based decision. Write down which ones are in scope and why, because the examiner's first question will be "which lists?"

How PEP screening works, step by step

1. Collect identifiers at onboarding. At minimum: full name, date of birth and nationality. Business customers also need directors and UBOs. Without secondary identifiers, a PEP screen is a name lookup and produces noise.
2. Screen against your chosen lists. Run sanctions, PEP and RCA, and adverse media checks, at a fuzzy-match threshold you have written down.
3. Triage the matches. An analyst confirms or discounts each potential match using the secondary identifiers. Record the rationale for every decision, including the "not a match" ones.
4. Apply EDD to confirmed PEPs. Establish source of wealth and source of funds, get senior management approval to open or continue the relationship, and set a higher review frequency.
5. Monitor continuously. Re-screen when lists change and on a periodic cycle. A customer who was clean at onboarding can be appointed to office next year.
6. Reconcile with on-chain risk. Combine the name-screening result with wallet screening and transaction monitoring into one customer risk rating.

Why crypto makes this harder

Traditional finance screens names against lists. Crypto has to screen names and addresses, and the two rarely reconcile.

• Address screening tells you about on-chain exposure: whether funds passed through a mixer or a designated wallet
• Name screening tells you about the customer's identity and status

A customer can clear name screening perfectly and still deposit from an address with direct sanctioned exposure. Both checks are mandatory, and they need to feed the same risk score. Otherwise you get two systems with two answers and no reconciliation.

The scale of the on-chain side grew sharply in 2025. The Chainalysis 2026 Crypto Crime Report (published 8 January 2026) found that illicit addresses received at least $154 billion in 2025, up 162% year on year. It attributed much of the increase to a 694% rise in value received by sanctioned entities, and found that stablecoins made up 84% of illicit transaction volume. Self-hosted, or non-custodial, wallets add another gap: the counterparty address may belong to someone you have never identified at all.

The false-positive problem

The commercial risk in PEP and adverse media screening is not missing a match. It is generating so many that the queue stops being worked.

Practical mitigations:

• Tune thresholds by customer risk. A retail user depositing EUR 200 does not need the same match sensitivity as a corporate onboarding EUR 2m.
• Use secondary identifiers. Date of birth and nationality collapse most name collisions instantly.
• Whitelist resolved matches. Once a false positive is cleared with a written rationale, it should not resurface every cycle.
• Measure the rate. If more than roughly 95% of alerts are false, the configuration is wrong, not the analysts.

PEP watchlist data providers

Most firms buy their PEP data rather than build it. Providers differ in how deeply they cover RCAs, how they tier PEPs by seniority, how quickly they refresh, and whether they sell raw data feeds, screening software or both. In alphabetical order:

• ComplyAdvantage: a financial-crime data and screening platform covering sanctions, PEPs and RCAs, and adverse media, with ongoing monitoring.
• Dow Jones Risk & Compliance: watchlist data feeds that cover PEPs, sanctions and other high-risk categories, built to plug into a firm's own screening engine.
• iDenfy: identity verification (KYC), business verification (KYB) and AML screening. According to its documentation (checked 4 October 2026), it screens individuals and companies against sanctions, PEP and adverse media sources, with optional ongoing monitoring that re-checks each subject every 24 hours.
• LSEG World-Check: a structured risk-intelligence database of PEPs, relatives and close associates, sanctions and adverse media. It is available as a data feed or through the World-Check One screening software.
• Moody's: a global PEP database with screening and continuous monitoring as part of its KYC suite.
• OpenSanctions: an open database of sanctions, PEPs and other watchlists. It is free for non-commercial use, and businesses need a data licence or its paid API. It models PEP data around the position held rather than only the person.

Free name checks exist, from tools such as dilisense and NameScan, and they are useful for spot checks. They do not replace a documented, continuously monitored screening process. For crypto, these name-screening providers sit alongside wallet-screening and transaction-monitoring vendors. You need both layers. Compare full suites in best crypto KYC providers and KYB software for crypto.

What auditors ask for

• Which lists you screen, from which provider, refreshed how often
• Your match threshold and the rationale for it
• Evidence of periodic re-screening, not just at onboarding
• Written disposition for every alert, including cleared ones
• Your EDD process for confirmed PEPs, with the approver named
• How address screening and name screening reconcile into one customer risk score

That last point is the one most often missing.

Writing a screening policy that survives an audit

The tooling question is downstream of a policy question most teams never write down. An examiner will ask to see the document that says which lists you screen against, at what match threshold, how often, who reviews a hit, and who may clear one. If that document does not exist, the quality of your vendor is irrelevant: you cannot evidence a control you never defined.

A workable policy fixes five things in writing:

• Scope. Which lists, and for which customer types. Sanctions for everyone. PEP and adverse media usually risk-tiered.
• Thresholds. The fuzzy-match score above which a hit is generated, stated as a number, with the reasoning for that number.
• Frequency. At onboarding, on every list update, and on a periodic cycle for the standing book.
• Roles. Who triages, who approves a clear, and the rule that the approver cannot be the person who raised it.
• Retention. How long you keep the screening record, including the negative results.

The last one catches people out. Firms retain their true positives carefully and discard the noise. But the evidence that you screened a customer and got nothing is exactly what proves the control ran. Keep the clean results too.

Tuning false positives without quietly under-screening

Every screening programme sits on one dial: loosen the match threshold and you drown in noise, tighten it and you miss real hits. Both failure modes are serious, and only one of them is visible day to day, which is why unmanaged programmes drift toward tightening until they catch nothing.

Three techniques move the trade-off rather than just sliding along it:

• Secondary identifiers. A name match alone is weak. Date of birth, nationality and identity document number turn a 200-hit name into one or zero. Any tool that screens on name only will generate volume you cannot clear.
• Name-culture awareness. Transliteration from Arabic, Cyrillic and Chinese produces multiple valid spellings, and patronymic conventions mean the same person appears several ways. Matching logic that assumes Western given-name/surname order fails on a large share of the world.
• Documented whitelisting. When you clear a hit, record the decision so the same customer does not regenerate the same alert every cycle. Whitelists must be reviewed and must expire. An unreviewed permanent whitelist is how a genuine later designation gets suppressed.

Track your false-positive rate as a managed metric with a target, not as a complaint. A programme where 99% of alerts are noise is not a strict programme; it is one where the real hit will be cleared by a tired analyst at the end of a queue.

Point-in-time versus ongoing obligations

Sanctions screening is continuous by nature: designations change, and the obligation attaches the moment they do. PEP status is different: it changes with appointments and elections, persists for a period after a person leaves office, and extends to close associates and family who are far harder to detect. Adverse media is continuous in principle and impossible to run continuously in practice at full sensitivity, which is why most programmes run it at onboarding, at periodic review, and on trigger events such as a large transaction or a jurisdiction change.

Set those cadences deliberately and write them down. A programme that screens everything at onboarding and never again is the single most common finding in crypto compliance reviews, and it is the easiest to fix.

What changes in 2026 and 2027

• EU single rulebook from July 2027. The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies directly in every Member State from 10 July 2027. Crypto-asset service providers are among the obliged entities. Article 45 requires firms to keep applying risk-based measures to a former PEP for at least 12 months after they leave office, and the same measures cover family members and close associates. Firms authorised under MiCA should plan their PEP policy around the Regulation now, not around national transpositions of the old directives.
• Supervisors are moving from laws to enforcement. The FATF's seventh targeted update on virtual assets, published on 15 July 2026, drew on survey responses from 147 jurisdictions. It found that 83% of surveyed jurisdictions now have Travel Rule legislation in force, up from 73% the year before. It also found that many of them have not yet taken any supervisory or enforcement action (Notabene summary, July 2026). Expect examiners to test whether controls actually run, not whether a policy exists. Travel Rule data is also a screening input, covered in the crypto Travel Rule explained.
• Sanctions exposure is concentrated. Chainalysis's 2026 figures above point to sanctions evasion, much of it in stablecoins, as the main driver of illicit volume in 2025. Name screening alone will not catch it.
• US stablecoin issuers come into scope. The GENIUS Act treats US payment stablecoin issuers as financial institutions under the Bank Secrecy Act, with AML, customer identification and sanctions compliance duties. The implementing rules were still proposals as of early October 2026.

Where it fits

Screening is the gate. Behavioural monitoring is what runs afterwards (see crypto transaction monitoring software). Identity verification comes first, in best crypto KYC providers. And if you are starting with no budget, free crypto sanctions screening sets out what that does and does not cover.

The full programme is in our crypto AML compliance guide. If you are building toward authorisation, the cost of all this together is broken down in CASP licence cost in 2026.

One scope note. These obligations fall on regulated intermediaries that onboard customers. JewelSwap is a non-custodial DeFi protocol on MultiversX, Sui and Radix: users interact with smart contracts from wallets they control, and JewelSwap does not open customer accounts. For how identity checks fit into DeFi, see KYC in DeFi explained.

Frequently asked questions

What is a PEP watchlist?

A PEP watchlist is a database of politically exposed persons: people who hold or recently held prominent public functions, plus their family members and close associates. Firms screen customers against it to decide when enhanced due diligence applies. No single official global PEP list exists. Watchlists are compiled by data providers from official and public sources.

Is there an official PEP list?

Not a global one. The EU publishes a list of prominent public functions, which sets out the positions that count in each Member State, in international organisations and in EU institutions. It does not name the people who hold them. Firms rely on commercial or open data providers to link those positions to individuals.

What is the difference between sanctions screening and PEP screening?

Sanctions screening is a legal prohibition: if a party is designated, you may not transact, and there is no risk-based override. PEP screening is a risk trigger, not a prohibition: identifying a politically exposed person means you apply enhanced due diligence, document source of wealth and funds, and obtain senior sign-off. Blocking every PEP is over-compliance that costs you legitimate customers.

How long does someone stay a PEP after leaving office?

It depends on the jurisdiction and the risk. FATF guidance takes a risk-based approach rather than a fixed period. Under the EU AML Regulation, which applies from 10 July 2027, firms must keep applying risk-based measures for at least 12 months after a person leaves a prominent public function, and for longer if the risk remains.

Do I have to screen for PEPs if I am not in the EU?

In most regulated markets, yes. PEP obligations derive from FATF recommendations that have been implemented in the great majority of national AML regimes, so the requirement travels well beyond the EU. What varies is the scope of "domestic" PEPs and how long the status persists after leaving office. Check your own regulator's definition rather than assuming the EU one applies.

How often should customers be re-screened?

Sanctions: on every list update, automatically. PEP: at onboarding and on a periodic cycle set by customer risk rating, typically annually for standard risk and more frequently for high risk. Adverse media: at onboarding, at periodic review, and on trigger events. The point is that the cadence is defined and evidenced, not that a specific number is universally correct.

Why do crypto firms get more false positives than banks?

Partly customer base: crypto skews international, so a larger share of names require transliteration and fall outside the Western name conventions most matching engines were tuned on. Partly data: crypto onboarding often collects fewer secondary identifiers than a bank account opening, and secondary identifiers are what resolve a name match. Collecting date of birth and nationality at onboarding measurably reduces alert volume.

Is address screening the same as name screening?

No, and you need both. Name screening checks the person against sanctions, PEP and adverse-media lists. Wallet address screening checks the on-chain counterparty against designated addresses and, in better tools, against indirect exposure: funds that reached the address through an intermediary hop. A customer can pass name screening cleanly and still be receiving funds from a sanctioned entity.

Can a small team run this manually?

At low volume, sanctions screening can be run manually against official lists if the process is documented and the results retained. PEP and adverse media are much harder to do by hand because they require ongoing monitoring rather than a lookup. See free crypto sanctions screening for where the manual approach stops being defensible.