Managing Politically Exposed Persons Risk in the GCC: What Financial Institutions Need to Know

FATF Recommendation 12: The International Standard

The international framework for managing PEP risk is set by FATF Recommendation 12. The recommendation requires that financial institutions take reasonable measures to determine whether a customer or a beneficial owner is a politically exposed person. Where a customer or beneficial owner is identified as a PEP, the institution must apply enhanced due diligence, including obtaining senior management approval for establishing or continuing the business relationship, taking adequate measures to establish the source of wealth and source of funds, and conducting enhanced ongoing monitoring of the relationship.

FATF Recommendation 12 also addresses the risk of family members and close associates of PEPs. Known close associates are individuals whose relationship or connection with a PEP creates reputational risk and who may present similar money laundering or terrorism financing risk.

The FATF guidance on politically exposed persons clarifies that the PEP framework is not a prohibition on serving PEP customers. It is a risk management framework that requires institutions to understand the risk, to apply proportionate controls, and to be able to demonstrate the adequacy of those controls to their supervisor.

FATF Recommendation 12 should be read alongside FATF Recommendation 10 on customer due diligence and FATF Recommendation 11 on ongoing due diligence. Together, these three recommendations establish the full framework within which PEP risk management operates.

Domestic and Foreign PEPs: The GCC Distinction

A key distinction in the PEP framework is between domestic PEPs (individuals who are PEPs by virtue of a position held within the country where the financial institution operates) and foreign PEPs (individuals who hold prominent positions in another country).

GCC states have substantial populations of domestic PEPs. Royal family members, senior government ministers, senior officials in state-owned enterprises, senior judicial officers, and senior military commanders are PEPs under the domestic definition. For financial institutions operating in Saudi Arabia, Saudi domestic PEPs are subject to enhanced due diligence. For institutions in the UAE, UAE domestic PEPs are subject to enhanced due diligence.

Foreign PEPs are individuals who hold prominent public functions in another country. A Saudi financial institution serving a senior official of the UK government is dealing with a foreign PEP. A UAE bank serving a senior official of the Qatari government is dealing with a foreign PEP.

The risk profile of foreign PEPs can be significantly higher or lower depending on the country of origin, the nature of the role, and the relationship between that country and the GCC state. Financial institutions should assess each foreign PEP relationship on its merits, taking into account the specific circumstances.

International organisations, including multilateral development banks, are also within the scope of the PEP framework under FATF Recommendation 12, though typically with lower risk profiles.

Enhanced Due Diligence for GCC PEPs

The enhanced due diligence requirements for PEPs apply across the GCC, with jurisdiction-specific elaboration in each country’s regulatory framework.

Senior management approval is a core requirement. The decision to establish or continue a relationship with a PEP must be taken at an appropriate senior level within the institution. In practice, this means approval from a senior compliance officer, a senior relationship manager, or a credit and risk committee, depending on the risk profile of the PEP and the nature of the relationship.

Source of wealth and source of funds documentation is required. Financial institutions must be able to demonstrate that they understand how the PEP’s wealth was acquired and that the funds involved in the relationship come from legitimate sources. This is particularly important in the GCC context where the size of wealth associated with some PEP relationships can be substantial and where wealth may derive from a complex mix of official positions, business activities, family connections, and investment activities.

Understanding the PEP’s role and exposure is necessary for risk profiling. A senior government minister responsible for financial regulation presents a different risk profile from a senior figure in a cultural ministry. An individual who has recently left a PEP role may present a different profile from one who is currently active. Institutions must gather sufficient information to make an informed judgment about the risk.

Understanding family and close associate connections is required under both FATF Recommendation 12 and the domestic PEP frameworks of GCC states. Family members and known close associates of a PEP may be treated as presenting elevated risk, and their involvement in a relationship may trigger EDD requirements.

Beneficial Ownership Complications in the GCC

Beneficial ownership in the GCC presents complications that are more acute than in many other jurisdictions, and these complications are directly relevant to PEP risk management.

Royal families represent a particular challenge. In GCC states, royal families can be large and complex, with members at varying levels of seniority, wealth, and influence. Identifying which royal family members are PEPs and which are not requires specific knowledge of the succession structures, titles, and roles within each royal family. A member of a ruling royal family who holds no official government position may still be treated as a PEP under some GCC regulatory frameworks, depending on their influence and the nature of their activities.

Sovereign wealth funds are a significant feature of the GCC financial landscape. Entities owned or controlled by sovereign wealth funds may be associated with PEPs, and the governance structures of sovereign wealth funds can create beneficial ownership complications. An entity that is owned by a sovereign wealth fund may nonetheless be connected to a PEP through a family relationship or through a complex chain of intermediate ownership.

Family business conglomerates in the GCC frequently involve ownership structures that interweave family, state, and commercial interests. Tracing the ultimate beneficial owner through a complex conglomerate to identify whether a PEP is connected requires detailed ownership mapping and ongoing monitoring of changes in ownership structure.

Trust and foundation structures are used in the DIFC and in some GCC onshore structures, and these introduce additional layers of complexity for beneficial ownership identification. The DFSA and UAE regulatory framework address trust beneficial ownership, but the practical challenge of identifying all PEP connections through a trust structure remains significant.

The FATF Recommendations require that beneficial ownership information be accurate, adequate, and timely. In the GCC context, achieving this standard requires significant investment in ownership mapping, relationship analysis, and ongoing monitoring.

Ongoing Monitoring Requirements

PEP risk management does not end at onboarding. FATF Recommendation 12 requires enhanced ongoing monitoring of PEP relationships throughout the duration of the relationship.

Transaction monitoring for PEP relationships should be calibrated at lower thresholds than for standard-risk customers. An unusual transaction pattern that would not generate an alert for a standard-risk customer may generate an alert for a PEP customer, reflecting the higher inherent risk.

Periodic review of PEP risk profiles should be conducted more frequently than for standard-risk customers. The risk profile of a PEP can change significantly over time as their official position changes, as political circumstances evolve, or as their personal circumstances change.

Re-screening against PEP databases, sanctions lists, and adverse media sources should be conducted at defined intervals and when triggered by material events. A change in a PEP’s official position, an adverse media story, or a change in sanctions status should prompt an immediate re-assessment of the relationship.

Triggered review is required when material changes occur. The departure of a PEP from a government role, a change in family circumstances, or information surfacing through adverse media should trigger a review of whether the PEP framework continues to apply and whether the risk profile has changed.

Sanctions Screening for PEPs

Sanctions compliance and PEP risk management overlap significantly. Individuals who are PEPs may also be subject to targeted financial sanctions under UAE, US, EU, or UN sanctions regimes. Where a PEP is subject to sanctions, the institution must freeze the relevant assets and must not provide any services to the sanctioned individual.

The overlap between PEP and sanctions risk means that financial institutions must screen PEPs against all applicable sanctions lists at onboarding and on an ongoing basis. The sanctions status of individuals can change rapidly in response to geopolitical events, and institutions must have processes for responding promptly to new sanctions designations.

The UAE has its own targeted financial sanctions framework, and SAMA in Saudi Arabia has issued specific guidance on targeted financial sanctions compliance. Financial institutions in the GCC must maintain sanctions compliance programmes that cover all applicable sanctions regimes.

De-recording and Filing After Leaving a PEP Role

A practical question that arises frequently is when the PEP framework ceases to apply to an individual who has left a PEP role. FATF Recommendation 12 does not specify a fixed period after which a former PEP becomes a standard-risk customer.

In practice, most jurisdictions apply a period of elevated scrutiny for a defined period after a PEP leaves their role. The rationale is that the PEP may retain influence after leaving office, that proceeds of corruption may be accessed after departure from office, and that the risk of money laundering does not cease immediately when a person leaves a public role.

The appropriate post-service period depends on the jurisdiction and the specific circumstances. For senior PEPs in the GCC, institutions should apply elevated scrutiny for a significant period following departure from a PEP role, and should document the rationale for any decision to reduce the scrutiny applied.

UAE Federal Decree-Law No. 10 of 2025 : PEP Provisions

In the UAE, Federal Decree-Law No. 10 of 2025 on AML/CFT includes specific provisions on the treatment of PEPs. The decision applies the FATF Recommendation 12 framework into UAE domestic law and adds jurisdiction-specific elaboration.

The UAE Cabinet Decision distinguishes between domestic PEPs (UAE PEPs) and foreign PEPs. It establishes enhanced due diligence requirements, senior management approval requirements, and ongoing monitoring obligations that align with the FATF standard.

For hawala registrants, which are brought within the regulatory framework under Cabinet Decision No. 10, the PEP provisions apply as part of their DNFBP obligations. This means that even smaller hawala operators are required to implement EDD for PEP relationships, which represents a significant change in compliance expectations for informal value transfer operators.

The DFSA Rulebook includes PEP provisions in its AML Module that apply to DFSA-regulated entities in the DIFC.

SAMA PEP Guidance in Saudi Arabia

SAMA has issued specific guidance on the treatment of PEPs under the Saudi AML/CFT framework. The SAMA AML/CFT Rules incorporate FATF Recommendation 12 and provide Saudi-specific guidance on the application of enhanced due diligence for PEPs.

The SAMA framework addresses both domestic and foreign PEPs, with enhanced due diligence requirements calibrated to the risk profile of each relationship. SAMA has indicated through its supervisory priorities and enforcement activity that PEP compliance is an area of focus, and institutions should ensure their PEP frameworks are well-developed and operationally effective.

Practical Compliance Considerations

For compliance teams managing PEP risk in the GCC, several practical considerations arise.

PEP identification must be proactive. Waiting for a customer to disclose PEP status is insufficient. Financial institutions must have processes for identifying PEPs through screening at onboarding, through periodic re-screening, and through relationship management conversations.

PEP databases must be current. The GCC PEP landscape is dynamic, with frequent changes in government roles, royal family positions, and senior appointments. Institutions should ensure their PEP databases are updated regularly and cover both domestic and foreign PEPs.

Beneficial ownership mapping for PEP relationships must extend beyond the immediate PEP. Family members, close associates, and complex ownership structures must all be identified and assessed.

Training for relationship managers and front-line staff must ensure that PEP red flags are recognised and escalated promptly. Staff must understand the difference between domestic and foreign PEPs and must know which escalation procedures apply.

Documentation must be complete and current. Every PEP relationship should have a file that records the PEP’s role and basis for PEP classification, the senior management approval for the relationship, the source of wealth and source of funds analysis, the ongoing monitoring that has been conducted, and any changes in risk profile that have occurred over time.

Conclusion

Managing PEP risk in the GCC is a complex, ongoing compliance challenge that requires more than procedural compliance with a checklist. The concentration of wealth, the complexity of family and ownership structures, and the geopolitical significance of the GCC make PEP risk management both more important and more demanding than in many other regions.

The regulatory framework, anchored by FATF Recommendation 12 and elaborated in UAE Federal Decree-Law No. 10 of 2025, SAMA PEP guidance, and DFSA AML Module provisions, establishes the standard that financial institutions must meet. The practical challenge is implementing this standard in a context where beneficial ownership is complex, where PEP roles change frequently, and where the volume of high-value transactions associated with some PEP relationships is substantial.

Institutions that invest in robust PEP identification, thorough beneficial ownership mapping, proactive sanctions screening, and enhanced ongoing monitoring will be best positioned to satisfy their regulators and to manage the financial crime risks associated with politically exposed persons in the Gulf.

This article was accurate at the time of publication in August 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.