PEP screening for real estate agents in Australia

A politically exposed person, or PEP, is not a criminal. A PEP match is not an accusation. It is a flag that tells your agency to look closer before you decide how to proceed. Under AUSTRAC Tranche 2, customer due diligence for every client now includes a PEP check, and agencies that treat a match as a refusal or a report are getting the process wrong in a way that can itself cause problems.

The fast path

AML Simple's client screening workflow runs a PEP check alongside the DFAT sanctions check as part of the same CDD step, not a separate task you have to remember. DFAT sanctions screening is included on every plan, including Foundation. PEP screening is Starter and above: Starter includes 5 PEP checks a month then A$2 per check, Professional 20 a month then A$1 per check, Agency 50 a month then A$1 per check. An agency onboarding 30 clients in a month on Starter will run past the included allowance, worth knowing before it shows up on an invoice.

1. Enter the client's details once, during onboarding. Name, date of birth, and nationality are the fields a PEP check runs against.
2. The screening runs automatically against PEP data sources and the DFAT Consolidated List in the same pass, within your plan's included volume, and returns a result in the client's file.
3. A clear result closes the check. No match means you record that and move on. A possible match opens a review queue item with the details you need to work through it, timestamped and stored.

That is the hard part of screening done, the part that is easy to skip when it is a manual step buried in a busy week.

Prefer to understand what is happening behind the check, or run it by hand? Here is what a PEP is, what your agency records, and what happens when a name comes back as a possible match.

What a PEP actually is

PEP stands for politically exposed person. Under the AML/CTF framework, the term covers people who hold, or have recently held, a prominent public position that gives them access to public funds or significant decision-making power, plus their close family members and close associates. Current guidance groups PEPs into three categories.

Foreign PEP. Someone who currently holds, or has held, a senior role in a foreign country: head of state, senior politician, senior government official, central bank governor, senior judicial official, senior military official, or senior executive of a state-owned enterprise. A foreign PEP is treated as high-risk automatically, and that classification carries through to a close family member or close associate of that person.

Domestic PEP. The equivalent roles, held in Australia. A domestic PEP is not automatically high-risk the way a foreign PEP is, but must still be risk-assessed and monitored under your program.

International organisation PEP. Someone who holds, or has held, a prominent position in a body like the United Nations or the World Trade Organisation, or their close family member or close associate. Current guidance points to these individuals carrying risk considerations similar to a foreign PEP.

"Close associate" is doing real work in that definition. It is not limited to the person who held office. A business partner, a joint venture co-owner, or someone who manages assets on the PEP's behalf can also fall inside the category, depending on the closeness of the relationship. Your agency's risk assessment should set out how you assess that boundary, because it is a judgment call, not a fixed list.

Under current guidance, a person generally stops being classified as a PEP once they leave the qualifying role, but a former PEP can still carry elevated risk depending on the influence they retain. The classification should be reviewed when someone leaves office, not simply dropped.

PEP screening is not sanctions screening

The two checks run together in most workflows, including AML Simple's, which is exactly why they get conflated. They are different obligations with different consequences.

A confirmed sanctions match is a stop. A confirmed PEP match triggers enhanced due diligence and a documented decision, and in most cases the transaction proceeds with extra scrutiny in place.

Why so many matches are false positives

Name-only matching produces a lot of noise. A screening tool that flags anyone sharing a name with a listed official will surface people who are not that official. This is normal and expected, not a failure of the check.

A possible match should never be actioned automatically. It needs a human to look at the identifying details, date of birth, nationality, and any aliases on record, and decide whether the match is genuine. Software can surface a possible match. It cannot make the call on whether it is the same person, and it should not try to.

What your agency does when a client matches

Review the details. Compare date of birth, nationality, and any other identifying information against the flagged record. A shared surname on its own is not evidence of a match.

Confirm or dismiss, and record the reasoning either way. If the details line up, or there is enough overlap to leave genuine doubt, treat it as a confirmed PEP and proceed to enhanced due diligence. If it is clearly a different person, document why and close the item. AUSTRAC guidance expects a documented, considered decision, not just a note that a name was checked.

Apply enhanced due diligence if confirmed. A confirmed foreign PEP is one of the standard triggers for enhanced CDD under the AML/CTF Act. That typically means senior management approval before the relationship or transaction proceeds, additional identity verification, source of funds and source of wealth checks, and ongoing monitoring for the life of the relationship. A domestic PEP is risk-assessed rather than automatically escalated to enhanced CDD, so how you treat one should be set out in your own program.

Decide, do not default. A confirmed PEP match is a risk decision for your agency, informed by your risk assessment, not a rule that ends the relationship. Most confirmed PEP files proceed, with more scrutiny attached. Refusing a client outright because they are a PEP is neither required nor a substitute for actually assessing the risk.

What to keep on file

• The screening result for the client, including the date it ran
• The identifying details used to confirm or dismiss a possible match
• The reasoning behind that decision, in writing
• Evidence of enhanced due diligence where a PEP match was confirmed, including any senior management approval
• A record of when the file was last reviewed, since a PEP's status and risk profile can change over time

Records like these are what turns "we screened the client" into something you can actually show an auditor. AML Simple timestamps and stores every screening result and decision against the client's file automatically, alongside the source of funds evidence collected during enhanced due diligence, so the file builds itself as you work through it rather than getting assembled after the fact.

PEP screening is one piece of a working AML/CTF program. If you want the full picture of what else that program needs to cover, 5 AML program components in plain English walks through the rest.