Why PEP Screening Has Changed for Insurers
In July 2025 the FCA published its finalised guidance, FG25/3 on the treatment of politically exposed persons. It builds on the January 2024 amendment to Regulation 35 of the Money Laundering Regulations 2017, under which UK PEPs are presumed lower risk than foreign PEPs by default. The guidance also says non-executive board members of UK government departments should not automatically be treated as PEPs, and it expects a documented review when a PEP leaves office.
The guidance followed the FCA’s PEP review, published in July 2024. The regulator surveyed over 1,000 PEPs, received 65 replies and reviewed 15 firms in detail across five retail sectors. It found no systematic over-application of enhanced due diligence. It did find firms applying wider PEP definitions than the regulations require, and some firms with no process for removing PEP status once someone had left office.
That creates a tension for insurers. The FCA is asking for proportionality, but proportionality only protects you if you can evidence it. A lighter touch on a domestic PEP is defensible when the rationale is recorded, the red flags were checked and the decision can be reproduced on demand. It is not defensible when it simply reflects a tool that could not do anything else. This post covers what to look for in PEP screening software, why the distribution chain changes the question, and where proportionality stops.
Why Bank-Built Screening Tools Struggle in Delegated Authority
Insurance screening is rarely just the policyholder. As a principal firm, you are accountable for the MGAs, brokers and coverholders you delegate authority to, and for the directors, ultimate beneficial owners (UBOs) and controllers behind each of them. Those relationships change constantly. A broker is acquired, a director resigns, a new shareholder appears on the register. Each change can alter the PEP picture without anyone telling you.
Tools designed for retail banking tend to assume a simple model: one customer, one individual, one check at onboarding. They screen people one at a time and have no concept of a distribution chain, so they cannot show you which of your delegated authority relationships a flagged individual connects to. The result is a screening process that looks complete on paper but leaves you stitching results together in spreadsheets when you need to answer a simple question: where is our exposure?
That gap matters because the FCA expects firms to evidence oversight, not just perform checks. If your tooling cannot map screening results to the entities you have appointed, you carry the burden of proof manually. Our AML compliance checklist sets out the wider controls that sit around screening, and the criteria below show where the tool has to carry its share.
Criteria 1 and 2: Risk-Based PEP Logic and Accurate Matching
Criteria 1: Risk-based PEP logic. Your tool should let you configure how it treats domestic PEPs, foreign PEPs, family members and close associates. That configuration is what allows you to apply the lower-risk presumption in FG25/3 for UK PEPs without switching off judgement. A tool that treats every PEP as high risk produces the over-application the FCA warns against. A tool that treats every domestic PEP as low risk misses the cases where the presumption should fall away.
The test is escalation. The tool should surface adverse media, unexplained wealth indicators and international links, and route those cases to enhanced due diligence even when the individual is a UK PEP. Ask any provider to show you the rule set, not just the headline feature.
Criteria 2: Accurate matching. False positives are a cost and a risk. The cost is obvious: analyst hours spent clearing names that were never a concern. The risk is less visible. Analysts working through high volumes of noise become less likely to spot the real hit, and the review record that results is thin because the volume leaves no time to document reasoning.
Ask how the tool matches names across spellings, transliterations and partial dates of birth, and how you can tune thresholds without losing the audit record of what changed. Ask for evidence from your own data during a trial rather than relying on a quoted accuracy figure.
Criteria 3 and 4: Ongoing Monitoring and Delisting Evidence
Criteria 3: Ongoing monitoring, not point-in-time checks. A PEP check at onboarding tells you who someone was on that day. PEP monitoring tells you when something changes: a director takes public office, a shareholder is newly listed, a sanctions designation appears. Your tool should refresh screening automatically against defined triggers and alert you when the position changes, rather than relying on a periodic re-screen that someone has to remember to run.
The strongest set-ups combine sanctions and PEP screening with adverse media screening in a single workflow. Separate tools for each create separate alert queues, separate records and a gap in the middle where a connected risk goes unnoticed. One workflow means one view of the individual and one audit trail.
Criteria 4: Delisting evidence. FG25/3 expects prompt review when a PEP leaves office, with a documented rationale for the decision. The FCA’s 2024 review found that some firms had no process for removing PEP status at all, which means individuals can stay classified as PEPs long after the regulations would require it, driving unnecessary enhanced due diligence and unnecessary friction for your counterparties.
Your tool therefore needs to keep a time-stamped audit trail of declassification decisions: who made the decision, when, on what evidence, and what the individual’s status was before and after. If a tool can add a PEP flag but cannot show you the history of removing one, it cannot support the part of the guidance that the FCA has already identified as weak across the market.
Criteria 5 and 6: Chain-Wide Coverage and Audit-Ready Management Information
Criteria 5: Chain-wide coverage. Screening has to cover the MGAs, brokers and coverholders you work with, and their key individuals, across the whole distribution chain. Ideally that sits on a single source of truth rather than in spreadsheets, so that a change to a director at one counterparty is visible against every relationship it touches. This is the area where bank-built tools fall furthest short, and it is where delegated authority AML risk is concentrated.
REG Network was built for this model. Its AML screening covers companies, directors, UBOs and shareholders for sanctions, PEPs and adverse media, and it monitors counterparties continuously after onboarding. REG’s network connects 24,000+ counterparties across 191 countries, which means data on a counterparty already known to the network can be surfaced immediately rather than collected again from scratch.
Criteria 6: Audit-ready management information. As Head of Compliance, you need to evidence oversight to the FCA, to your board and to your capacity providers. That means management information that shows outcomes, not activity: how many alerts were raised, how each was resolved, how long review took and where risk is concentrated. A tool that produces only a log of checks leaves you to build that picture yourself before every committee.
Look for real-time visibility of your counterparty population and the ability to configure thresholds that reflect your own risk appetite. Where you need structured counterparty risk assessment beyond screening, REG Risk 365 adds configurable monitoring and risk scoring on top of REG Network, so the same data supports both day-to-day screening and board-level reporting.
What Proportionality Does Not Mean
In July 2025 the FCA fined Monzo £21.1 million for financial crime control failings, in relation to the onboarding of about 34,000 high-risk customers. The case is a reminder that regulators will act where the controls around risk classification are weak, whatever the firm’s size or growth ambitions.
The lesson for PEP screening is direct. Lighter treatment of domestic PEPs does not mean lighter oversight. The presumption in FG25/3 is a starting point, and it must give way when red flags appear. Your tools have to surface those flags reliably, apply your escalation rules consistently and keep the record that shows you did so. REG Technologies provides the technology, monitoring and workflow to support that discipline, but the decisions, and the regulatory accountability for them, remain with your firm.
Proportionality, in other words, is a position you defend with evidence. The firms that will hold up best under scrutiny are those that can show a regulator the rule, the data, the decision and the date, for any individual in the chain, without a week of preparation.
Choose PEP screening tools that apply risk-based logic, monitor continuously and evidence every decision across the whole distribution chain. The stakes are supervisory scrutiny, analyst time lost to false positives and exposure that goes undetected because the tool could not see beyond the end customer. FG25/3 gives you room to be proportionate, but only if you can prove it. Before your next audit cycle, review your current screening against the six criteria in this post and close the gaps in delisting evidence, chain-wide coverage and management information first.
