Controls for PEPs and Complex Ownership Structures

Why This Topic Matters

Politically Exposed Persons (PEPs) and complex ownership structures are two of the most heavily tested risk areas on the CAMS exam, and for good reason. Together they represent the two primary ways that corrupt officials, kleptocrats, and sophisticated criminals move illicit wealth into the legitimate financial system: by exploiting their position of public trust, and by hiding behind layers of legal entities so that no one can see who truly owns or controls the money.

High-profile scandals such as 1MDB, the Panama Papers, the Pandora Papers, and the Danske Bank Estonia case all share a common thread. In each one, financial institutions failed to identify PEPs, failed to unwrap opaque corporate vehicles, or failed to scrutinize the source of wealth behind the funds. Regulators responded with record fines, and the FATF, the Wolfsberg Group, and national supervisors tightened expectations. For a CAMS candidate, this means you must understand not only what a PEP or beneficial owner is, but what controls a compliant institution is expected to apply, and why those controls work.

Part One: Politically Exposed Persons

What Is a PEP?

The FATF defines a PEP as an individual who is or has been entrusted with a prominent public function. Examples include heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, and important political party officials. The FATF distinguishes three categories:

1. Foreign PEPs – individuals entrusted with prominent public functions by a foreign country.
2. Domestic PEPs – individuals entrusted with prominent public functions domestically.
3. International organization PEPs – members of senior management of international organizations such as the United Nations, the IMF, or the World Bank, including directors, deputy directors, and board members.

The definition is deliberately extended to family members and close associates (often called RCAs – relatives and close associates). A spouse, child, parent, or business partner of a PEP may be used as a conduit for corrupt funds, so the risk follows the relationship.

Middle-ranking or junior officials are generally not PEPs, although an institution may apply a risk-based approach and treat them with elevated scrutiny where circumstances warrant.

Why Are PEPs High Risk?

PEPs are not presumed to be criminals. The heightened risk arises because their position gives them the opportunity to abuse public office through bribery, embezzlement, misappropriation of state assets, and acceptance of kickbacks. The proceeds of such corruption must then be laundered, and PEPs often have the means and the networks to do so through private banking, real estate, luxury assets, and offshore vehicles. Dealing with a PEP who turns out to be corrupt exposes the institution to severe reputational, regulatory, and legal consequences.

FATF Recommendation 12 and the Required Controls

For foreign PEPs, the FATF requires that financial institutions, in addition to normal customer due diligence (CDD):

• Have appropriate risk management systems to determine whether a customer or beneficial owner is a PEP.
• Obtain senior management approval before establishing (or continuing, for existing customers) the business relationship.
• Take reasonable measures to establish the source of wealth and the source of funds.
• Conduct enhanced ongoing monitoring of the relationship.

For domestic PEPs and international organization PEPs, institutions must take reasonable measures to determine whether a customer or beneficial owner is such a person and, where the relationship is assessed as higher risk, apply the same enhanced measures as for foreign PEPs. In practice, many jurisdictions (for example under the EU Anti-Money Laundering Directives) now treat domestic PEPs with mandatory EDD as well.

These requirements also apply to beneficiaries of life insurance policies. The institution should determine whether the beneficiary or the beneficial owner of the beneficiary is a PEP, no later than the time of payout, and if higher risk is identified, inform senior management before payout and consider filing a suspicious transaction report.

Source of Wealth vs. Source of Funds

This distinction is a favorite exam point. Source of funds refers to the origin of the specific money used in a transaction or deposited into an account, for example a salary payment, the sale of a property, or a transfer from another bank. Source of wealth refers to how the person accumulated their total net worth over time, for example inheritance, business ownership, investments, or a career in public service. A PEP earning a modest government salary who deposits millions presents an obvious mismatch between declared source of wealth and observed activity. Institutions should corroborate source of wealth with independent documentation rather than relying solely on customer declarations.

How PEP Controls Work in Practice

Identification and Screening. Institutions screen customers and beneficial owners at onboarding and periodically thereafter against commercial PEP databases, government lists, and adverse media. Screening should be sensitive to name variations, transliterations, and aliases. Self-declaration forms asking whether the customer or any family member holds a public function are a useful supplement but should never be the sole control.

Risk Rating and Classification. Not all PEPs carry equal risk. A risk-based approach considers the prominence of the position, the level of corruption in the home country (Transparency International indices are frequently referenced), the nature of the products and services sought, the jurisdiction of the funds, and whether the PEP is current or former. Many institutions apply a tiered approach: a head of state from a high-corruption jurisdiction warrants far more scrutiny than a retired municipal judge.

Senior Management Approval. The decision to onboard or retain a PEP must be escalated to senior management, typically a committee or a designated executive, who weighs the risk against the business rationale. This approval must be documented. Where an existing customer later becomes a PEP, the same approval should be sought to continue the relationship.

Enhanced Due Diligence (EDD). EDD for PEPs typically includes verification of identity through reliable independent sources, understanding the purpose and intended nature of the relationship, establishing and corroborating source of wealth and source of funds, identifying related parties and associated entities, reviewing adverse media, and understanding the PEP's business and political affiliations.

Enhanced Ongoing Monitoring. PEP accounts should be subject to lower transaction monitoring thresholds, more frequent periodic reviews (often annually or more frequently), and scrutiny of transactions that are inconsistent with the stated profile, such as large round-number transfers from government-linked entities, payments from companies that hold public contracts, or wire transfers involving offshore jurisdictions.

The 'Once a PEP, Always a PEP' Question

The FATF does not prescribe a fixed period after which a former PEP ceases to be a PEP. Instead, it recommends a risk-based approach that considers the level of influence the individual still exerts, the seniority of the former position, and whether the previous and current positions are linked. Some jurisdictions impose a minimum period (often 12 months) of continued enhanced measures after the individual leaves office. On the exam, the correct answer typically favors a risk-based assessment over an automatic declassification after a set time.

Part Two: Complex Ownership Structures

What Is Beneficial Ownership?

The beneficial owner is the natural person who ultimately owns or controls a customer, or the natural person on whose behalf a transaction is being conducted. It also includes those who exercise ultimate effective control over a legal person or arrangement. The critical word is natural. A beneficial owner can never be another company, trust, or foundation. The institution must look through every layer until it reaches a human being.

Most jurisdictions set a threshold, commonly 25 percent ownership or voting rights, for identifying beneficial owners. The U.S. FinCEN CDD Rule, for example, requires identification of each individual owning 25 percent or more (the ownership prong) plus at least one individual with significant managerial control, such as a CEO or managing member (the control prong). Where no natural person meets the ownership threshold, institutions must identify the natural person who exercises control through other means, and failing that, the senior managing official. Remember that thresholds are a floor, not a ceiling: a risk-based approach may require looking below 25 percent for higher-risk customers.

Why Are Complex Structures High Risk?

Legal entities and arrangements have many legitimate uses, including asset protection, tax planning, estate planning, and limited liability. However, they are also the primary tool for disguising beneficial ownership. The FATF and the Egmont Group have documented that virtually every large-scale corruption and money laundering case involves the misuse of corporate vehicles. Complexity itself is not illegal, but unexplained complexity, or complexity that serves no apparent commercial purpose, is a significant red flag.

Key Vehicles and Concepts to Know

Shell companies – entities with no significant assets, operations, or employees. They may be legitimate (for example a holding company) but are frequently used to layer funds.

Shelf companies – companies incorporated and left dormant so they can later be sold with an established history, lending an appearance of longevity and legitimacy.

Nominee shareholders and directors – individuals or firms who hold shares or directorships on behalf of the true owner, concealing the real party in interest. Professional nominee services are common in certain offshore centers.

Bearer shares – share certificates that confer ownership on whoever physically holds them, with no registration of the owner. The FATF calls for their abolition or immobilization because they make ownership nearly impossible to trace. Any customer with bearer shares requires enhanced measures, and many institutions refuse such customers entirely.

Trusts – legal arrangements in which a settlor transfers assets to a trustee to manage for beneficiaries. Key parties to identify include the settlor, the trustee(s), the protector (if any), the beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control. Discretionary trusts, where beneficiaries are not fixed, pose particular challenges.

Private investment companies (PICs) – entities often established in offshore jurisdictions to hold the personal assets of wealthy individuals. They are common in private banking and are frequently linked to PEPs.

Foundations – legal entities that hold assets for a purpose or for beneficiaries, used in civil law jurisdictions in a manner similar to trusts.

Layered multi-jurisdictional structures – chains where a company in one country is owned by a trust in a second, whose trustee is a company in a third, and so on. Each layer and each jurisdiction adds opacity and legal obstacles to disclosure.

Required Controls for Complex Structures

FATF Recommendation 10 requires institutions to identify the beneficial owner and take reasonable measures to verify identity, and to understand the ownership and control structure of legal person customers. Recommendations 24 and 25 call on countries to ensure adequate, accurate, and timely beneficial ownership information is available to competent authorities, often through registries.

In practice, effective controls include:

Mapping the Structure. Obtain or construct an organizational chart showing every entity, arrangement, and natural person in the chain, with percentages of ownership and control at each level. The chart should be documented in the customer file and updated when changes occur.

Identifying and Verifying Beneficial Owners. Collect identifying information (name, date of birth, address, identification number) for each beneficial owner and verify it using reliable, independent documents, data, or information. Reliance on customer certification alone is acceptable only in lower-risk situations and is generally insufficient for complex structures.

Screening All Parties. Every identified beneficial owner, director, trustee, settlor, protector, and controlling person should be screened for sanctions, PEP status, and adverse media. A PEP hidden two layers deep inside a trust is still a PEP, and the PEP controls described above are triggered.

Understanding Purpose and Rationale. Ask the customer to explain why the structure exists and why it is configured as it is. Legitimate explanations are usually straightforward (tax efficiency, succession planning, regulatory requirements in a particular market). Evasive, inconsistent, or absent explanations are red flags.

Applying EDD and Senior Approval. Complex or opaque structures, structures involving secrecy jurisdictions, nominee arrangements, or bearer shares should be risk-rated high and subjected to EDD and senior management approval, mirroring the PEP controls.

Using External Sources. Corroborate information with public and private beneficial ownership registries, company registries, legal entity identifiers (LEIs), audited financial statements, and reputable third-party data providers. Remember that registry information may be incomplete or self-reported and should not be relied upon blindly.

Ongoing Monitoring and Periodic Review. Monitor transactions for activity inconsistent with the stated purpose of the entity, such as pass-through activity, round-dollar transfers between related entities, or funds moving to jurisdictions unrelated to the business. Refresh beneficial ownership information on a risk-based schedule and upon trigger events such as a change in ownership, a change in directors, or adverse media.

Declining or Exiting. Where the institution cannot identify or verify the beneficial owner, or cannot obtain a satisfactory explanation of the structure, it should not open the account, should terminate an existing relationship, and should consider filing a suspicious activity report.

Red Flags Associated with Complex Structures

• Ownership chains that are far more complicated than the business purpose requires.
• Entities incorporated in jurisdictions known for secrecy, with no business connection to those jurisdictions.
• Use of nominee directors or shareholders without a clear commercial reason.
• Issued or authorized bearer shares.
• Frequent or unexplained changes in ownership, directors, or registered agents.
• Multiple companies sharing a single registered address, often that of a corporate service provider.
• Reluctance or refusal to provide information about beneficial owners.
• Directors or officers who appear to have no knowledge of the business.
• Companies with no physical presence, employees, or operating history yet handling large flows.
• Transactions routed through intermediary entities with no apparent economic rationale.

Part Three: Where PEPs and Complex Structures Intersect

The exam frequently combines these topics because corrupt PEPs almost always use corporate vehicles. A typical scenario describes a private banking client who is a company registered in a Caribbean jurisdiction, owned by a trust in a second jurisdiction, whose beneficiaries turn out to include the spouse of a government minister. The key insight is that the institution must unwrap the structure to the natural persons, recognize that the structure involves a PEP's family member, and then apply the full suite of PEP controls: senior management approval, source of wealth and funds, and enhanced ongoing monitoring. Treating the corporate customer as a simple low-risk company because the entity itself is not a PEP would be a serious failure.

Exam Tips: Answering Questions on Controls for PEPs and Complex Ownership Structures

1. Know the four mandatory PEP controls cold. Risk management systems to identify PEPs, senior management approval, source of wealth and source of funds, and enhanced ongoing monitoring. If a question asks what must be done when a customer is identified as a foreign PEP, look for an answer containing one or more of these four elements.

2. Distinguish source of wealth from source of funds. If an answer option mentions only verifying where a particular deposit came from, it addresses source of funds. If the question concerns the PEP's overall legitimacy or a mismatch between salary and assets, the better answer involves source of wealth.

3. Remember that PEP status does not mean automatic rejection. Answer options that say the institution must refuse all PEPs or must immediately close the account are usually wrong. The correct approach is a risk-based decision with EDD and senior approval. Exiting is appropriate only when risk cannot be mitigated or information cannot be obtained.

4. Family members and close associates count. When a scenario mentions a spouse, child, sibling, or business partner of a public official, the PEP controls apply. Do not be distracted by the fact that the customer personally holds no public office.

5. PEP status of a beneficial owner triggers the controls for the entity. If a company or trust has a PEP as a beneficial owner, settlor, or controlling person, the relationship with the entity is a PEP relationship.

6. Former PEPs require a risk-based assessment, not automatic declassification. Avoid answers that specify a fixed number of years as the sole determinant. Favor answers that consider ongoing influence and the seniority of the former role.

7. Beneficial owners are always natural persons. Any answer that identifies a company, trust, or foundation as the beneficial owner is incorrect. Keep unwrapping until you reach a human being.

8. Recognize the 25 percent threshold but treat it as a floor. Questions may test the standard threshold, but the best answer in a high-risk scenario often involves looking below the threshold or identifying control through other means.

9. Unexplained complexity is the red flag, not complexity itself. If a scenario gives a plausible commercial reason for the structure, the appropriate response is to document and verify it. If the customer cannot or will not explain, escalate, apply EDD, and consider declining or reporting.

10. Bearer shares and nominees should immediately raise your risk assessment. Any scenario involving bearer shares or unexplained nominee arrangements calls for EDD at minimum, and the best answer frequently involves requiring the shares to be immobilized or registered, or declining the relationship.

11. Senior management approval must be documented. When asked how to evidence compliance, answers involving documented approval, a documented rationale, and a documented ownership chart are stronger than answers relying on verbal confirmation or customer self-declaration.

12. Do not tip off. If a scenario moves toward filing a suspicious activity report, the institution must not inform the PEP or the entity that a report is being filed. Answer options that involve asking the customer to explain the suspicious activity after a report is contemplated can be traps.

13. Watch for the 'most appropriate first step' phrasing. CAMS questions often ask what the compliance officer should do first. The first step is usually to gather information, escalate internally, or conduct EDD, not to close the account or contact law enforcement. Read the sequence carefully.

14. Apply the risk-based approach consistently. When two answers both seem reasonable, the one that reflects proportionality to risk, documentation, and escalation to the appropriate level of authority is usually the one the exam is seeking.

15. Connect to the broader AFC organization. Questions in this section may ask about the role of the compliance function versus the business line. Remember that the business line owns the relationship and gathers information, compliance provides independent oversight and challenge, and senior management bears ultimate accountability for approving high-risk relationships.

Summary

Controls for PEPs and complex ownership structures sit at the heart of effective anti-financial crime programs because they target the two mechanisms most consistently exploited in grand corruption and large-scale laundering. For PEPs, the institution must identify them (including family members, close associates, and PEPs hidden within entities), obtain senior management approval, establish and corroborate source of wealth and source of funds, and monitor on an enhanced basis. For complex structures, the institution must map the ownership and control chain, identify and verify every natural person who ultimately owns or controls the customer, understand and document the rationale for the structure, screen all parties, and apply EDD where opacity or secrecy features are present. On the exam, success comes from recognizing these triggers quickly, favoring risk-based and documented responses over automatic refusals, and always tracing ownership down to the natural person behind the structure.