How to Choose PEP Screening Software for Insurance Compliance

Why PEP Screening in Insurance Is a Different Problem

On 7 July 2025, the FCA published finalised guidance FG25/3 on the treatment of politically exposed persons for anti-money laundering purposes, with a revised version following on 15 July 2025 to clarify a point the original publication had missed. It is the first substantial update to PEP guidance since 2017, and it changes the starting assumption for how UK firms should treat domestic PEPs. Any compliance function still running the pre-2025 playbook is now working from an outdated risk model.

Insurance has a version of this problem that banking does not. A retail bank screens the individual opening an account. You are screening a distribution chain: brokers, coverholders, delegated authority partners, reinsurers, UBOs and the connected entities behind all of them. A screening tool built for point-of-sale onboarding was never designed to sit across that structure, and most of the software marketed under “PEP screening” still assumes a single customer, not a network of counterparties.

The scale of the underlying problem is well documented. REG’s research found that around 41% of general insurance firms still rely on spreadsheets to manage regulatory, legal and compliance risk, rising to 51% across financial services firms more broadly, and 74% of industry leaders report a notable increase in regulatory demand over the past year. Screening sits inside that same fragmented picture for most firms, tracked in one place while ownership structures, licensing status and risk assessments sit somewhere else entirely.

This guide covers what FG25/3 actually changed and what it did not, why software that cannot discriminate between risk levels is now a bigger liability than it used to be, the criteria that separate genuinely useful screening technology from a database with a search box, and how to evidence oversight across a distribution chain you do not directly control.

What FG25/3 Actually Changed, and What It Did Not

FG25/3 retains the presumption of lower risk for domestic PEPs, their family members and known close associates. Enhanced due diligence measures such as verifying source of wealth or source of funds should not be applied automatically to a domestic PEP unless other risk factors are genuinely present. The revised version, published a week after the original, clarified that non-executive board members of UK civil service departments should not be treated as PEPs at all. The FCA’s core expectation across all of it is a risk-based and proportionate approach: assess the actual risk in front of you, avoid blanket EDD, and be able to show your documentation controls support that judgement.

This is not a relaxation, and treating it as one is the wrong read. It raises the bar on judgement rather than lowering it. A tool that flags every domestic PEP as high risk by default is no longer a cautious default, it is creating work your firm cannot justify under a standard that now expects discrimination between risk levels as a matter of course. Blanket EDD applied to a low-risk domestic PEP is, under this guidance, itself a finding. It also sits alongside your Consumer Duty obligations: proportionate information requests and appropriately calibrated friction at onboarding align directly with the Consumer Understanding and Consumer Support outcomes, so a screening approach that over-collects from low-risk counterparties is a duty issue as much as an AML one. Read the guidance in full at FG25/3: the treatment of politically exposed persons.

The Real Cost of Screening Software That Cannot Discriminate

Industry analysis of sanctions screening performance puts false positive rates at 90% or higher across standard screening systems. At an average of 15 to 20 minutes per false positive review, that works out to 112 to 150 hours a year lost to alerts that were never real, for a modestly sized compliance team. Scale that across a distribution chain of brokers, coverholders and delegated authority partners rather than a single customer base, and the number stops being an inconvenience and starts being a structural drag on the team.

The cause is usually mundane rather than mysterious. Similar surnames, minor spelling variations, transliteration differences and matching algorithms that key off name similarity alone, ignoring contextual data such as date of birth, nationality or jurisdiction, generate the bulk of the noise. Under FG25/3’s proportionate, risk-based standard, this stops being purely an efficiency problem. A screening system that over-flags distorts your underlying risk assessment, and it becomes harder to demonstrate to the FCA that your controls are actually calibrated to risk rather than defaulting to caution because the tool cannot tell the difference.

There is a second-order cost too, and it is the more dangerous one. When 90% of alerts are noise, analysts learn to triage rather than investigate properly, because the volume leaves no other option. Alert fatigue sets in, and the genuine match, the one alert in ten that actually matters, is the one most likely to get waved through in the rush to clear the queue.

Seven Criteria That Actually Matter When Evaluating PEP Screening Software

Most procurement conversations start with list coverage, how many sanctions and PEP lists a vendor screens against. That is the wrong starting question. Coverage is table stakes. What actually determines whether a system reduces your workload or adds to it is what happens after a name is flagged, and whether the tool was built for a customer base or for a counterparty network. Put these seven questions to any vendor before list coverage comes up.

Contextual matching, not name matching. Does the system use date of birth, nationality, jurisdiction and role to refine a match, and can your team tune the matching threshold, or does every near-miss on a surname generate an identical alert regardless of context?

Counterparty coverage, not just customer coverage. Can it screen corporate entities, UBOs, directors and connected parties across a distribution chain, or is it built around individual retail onboarding and adapted afterwards? This is where most of the tools ranking for this keyword fall down. They were built for banks screening account holders, not insurers screening a network of trading relationships.

Continuous monitoring, not point-in-time checks. Political roles and appointments change constantly. A check performed at onboarding and never repeated leaves you blind from day two of the relationship onwards, which is most of its life.

Risk categorisation aligned to FG25/3. Can the system distinguish domestic from non-domestic PEPs and apply genuinely differentiated treatment, or does everything land in a single blanket classification regardless of the guidance’s presumption of lower risk?

Audit-ready evidence by default. Every screening decision, override and rationale should be captured with a timestamp and a named owner as a by-product of the workflow, not assembled manually by someone building a file before an audit.

Management information for governance. Can you produce board-level MI on screening volumes, hit rates, escalations and outstanding reviews without exporting everything to a spreadsheet first?

Integration with the wider compliance record. Screening evidence that sits in a separate system from onboarding, licensing and risk assessment is evidence you will have to reconcile later, usually at the worst possible moment. It should live alongside the rest of what you know about a counterparty, not apart from it.

REG Network builds AML screening on that last principle directly, screening PEPs, sanctions and adverse media alongside onboarding, licensing checks and ongoing counterparty monitoring rather than as a standalone module bolted on afterwards. For firms that need to configure risk appetite and thresholds more precisely across a larger or more complex counterparty base, REG Risk 365 adds structured, continuous risk assessment on top of that same underlying data.

Evidencing Oversight Across the Distribution Chain

Screening a name correctly is only half of what the FCA is actually asking for. The guidance does not just want screening performed, it wants outcomes evidenced, and that distinction is where most firms lose ground at audit. Performing the check and being able to show, on demand, that the check was proportionate, current and properly authorised are two different capabilities, and screening software is usually only built for the first one.

The specific insurance problem is that your exposure runs through counterparties you do not directly control. A coverholder’s screening failure, or a delegated authority partner that has not re-checked a director appointment in eighteen months, becomes your oversight failure the moment the FCA asks how you monitor the chain, not theirs. Good practice looks like a single source of truth where screening status, ownership structures, licensing and risk assessment sit together against each counterparty, so oversight is visible in real time rather than reconstructed from separate systems when the regulator calls. REG Exchanges supports this by structuring how information and documentation move across trading relationships, so screening status is not the only thing you can see about a counterparty at any given moment.

That is the practical difference between reactive compliance and embedded compliance. Reactive compliance means assembling evidence when the regulator asks, pulling screening logs from one system, ownership records from another, and licensing status from a third, and hoping the dates line up. Embedded compliance means the evidence already exists as a by-product of how the work gets done, because screening, ownership, and risk assessment were never separated in the first place. For a firm managing counterparty risk across a distribution chain, that difference is usually the one that decides how a Section 166 review or an FCA information request actually goes.

What to Expect From Screening Technology Over the Next Two Years

Investment in this problem is accelerating. Precedence Research puts the global AML software market at $10.74 billion by 2035, up from an estimated $3.84 billion in 2025, a compound annual growth rate of 10.83% between 2026 and 2035. That is capital going into a genuine, well-documented operational problem, not a speculative category.

Where the real improvement is coming from matters more than the headline figure. It is better contextual matching and entity resolution that cuts false positives at source, not broader list coverage. Be cautious of vendors who conflate the two. More lists with the same blunt matching logic makes the false positive problem worse, not better, because it adds volume without adding precision. The forward question for a compliance function is not really changing, but its emphasis is. It is shifting from “did we screen them?”, which has always been answerable, to “can we show our screening was proportionate, current and defensible?”, which is the question FG25/3 has made explicit and the one your evidence trail now needs to answer without a scramble.

PEP screening software for insurance should be judged on counterparty coverage, contextual matching and evidence quality, not on the size of its underlying database. Under FG25/3, a blanket approach to domestic PEPs is a finding in itself, and screening evidence scattered across separate systems cannot support the level of oversight the FCA expects you to demonstrate across a distribution chain you do not directly control. The practical next step is straightforward: audit your current screening approach against the seven criteria above, quantify what your false positive burden is actually costing your team in hours, and treat evidence capture as a design requirement for any system you choose, not something to bolt on once the regulator has already asked the question.