Who Is a Politically Exposed Person (PEP) in the UAE — and What Changes If You Are

Politically exposed person is the compliance label most people discover the day it is applied to them — a bank pauses onboarding, a registered agent asks for source-of-wealth evidence, a form asks about a parent’s former ministry post. The UAE’s definition is written into Cabinet Decision No. 10 of 2019, the executive regulation of the federal AML law, and RAK ICC has published its own guidance note applying it to offshore structures. This guide decodes both: who counts, how far the family-and-associates net reaches, why foreign and domestic PEPs are treated differently, how screening works when no official list exists, and what to prepare on each side of the table — whether you are the PEP, or the business that must check for one. It draws on the practice of the AML compliance team at Fastlane, which builds these controls for DNFBPs and prepares the dossiers that get PEP-linked relationships approved.

Who is a politically exposed person under UAE law?

The Cabinet Decision defines PEPs as natural persons who are or have been entrusted with prominent public functions in the UAE or any other foreign country. The words carry three loads at once. “Prominent public functions” sets the seniority bar — this is about positions of real public power, not every civil servant. “In the State or any other foreign country” makes the test global — a former minister anywhere is a PEP everywhere. And “are or have been” means leaving office does not, by itself, end the status: the exposure the position created is what the label tracks, and it fades on a risk-assessed basis rather than on a resignation date.

Note the last row’s breadth: directors, deputy directors and board-equivalent roles at international organisations are inside the definition on the same “are or have been” basis. If a role ever carried the power to direct public resources or decisions — national or supranational — assume the definition reaches it and let the risk assessment, not wishful reading, decide the rest.

Which family members and associates are included?

The definition extends past the office-holder in two rings. Direct family members are listed exhaustively: the PEP’s spouse, children, spouses of children, and parents. Read it precisely — a minister’s son-in-law is inside the net; on the letter of this list, a sibling is not, though a sibling in business with the PEP may enter through the second ring. That second ring is known close associates, captured by two tests: individuals having joint ownership rights in a legal person or arrangement, or any other close business relationship, with the PEP; and individuals having individual ownership rights in a legal person or arrangement established in favour of the PEP.

That second associate test deserves a slow read, because it is aimed squarely at proxy structures: a company or arrangement owned by one name but established for the benefit of a politically exposed one makes the visible owner a PEP-associate. Holding assets “for” an exposed friend does not keep the friend out of the compliance picture — it pulls the holder in. Combined with the UBO look-through and nominee-disclosure rules, the design leaves no angle where exposure can be parked with a clean-looking third party.

For families, the practical consequence is planning-grade: when one member holds or held prominent office, the whole first ring should expect PEP treatment in every onboarding — and the household’s source-of-wealth story, kept documented once, will serve spouse, children and in-laws across every bank and agent file they touch.

Why does PEP status raise risk — and does it incriminate?

The regulatory logic is stated plainly in the registry’s guidance: persons with a high political profile, or holding or having held public office, may be vulnerable to corruption by virtue of the position itself — and a business relationship could be used as a medium for laundering money obtained by way of corruption. The risk extends naturally to family and close associates, because that is precisely where proceeds are historically parked. None of this is a judgement about any individual; it is a statement about the attack surface a public position creates.

Hence the sentence every PEP should be able to quote back: “PEP status itself does not incriminate individuals or entities. It does, however, put the Customer into a higher risk category.” The label changes the process, not the presumption: more verification, senior sign-off, closer monitoring. A PEP with a documented, legitimate wealth story clears enhanced due diligence the way a well-papered file clears any review — slower than a standard case, and perfectly successfully.

The framing matters for behaviour, too. Treating the question “are you a PEP?” as an insult — or worse, answering it inaccurately — converts a manageable risk category into a credibility problem. Treating it as the routine legal test it is, and declaring with evidence ready, is the single highest-leverage move available; the guidance’s red flags for evasiveness are covered in our RAK ICC compliance checklist.

Foreign vs domestic PEPs: which duties differ?

Cabinet Decision 10/2019 does not treat all PEPs identically — it prescribes a full mandatory package for foreign PEPs and a risk-conditional one for domestic PEPs. In addition to standard customer due diligence, financial institutions and DNFBPs must apply the following:

Three details reward attention. First, the duties expressly cover the beneficial owner, not just the named customer — a PEP behind a company triggers the regime exactly as a PEP across the table does. Second, measure (b) bites on continuing relationships: a long-standing client who is appointed to prominent office mid-relationship re-triggers senior-management approval, which is why screening is periodic rather than once-at-onboarding. Third, the domestic limb explicitly pairs domestic PEPs with persons previously entrusted with prominent functions at international organisations — the conditional treatment, keyed to whether the relationship itself is high-risk.

How are PEPs identified when no official list exists?

Here is the uncomfortable operational truth the guidance states outright: there is no official, centralised global PEP list. Commercial vendors compile databases; the United Nations maintains a compilation of heads of state falling within the FATF definition; but no register settles the question. The determination is left to each relevant person — the bank, the agent, the firm — applying its own risk-management systems and judgement.

In practice, screening is close fact-checking: names, dates of birth, photographs and identification numbers run against reputable PEP databases, then adverse-media and public-source checks layered over the hits. The work is, in the guidance’s own words, time-consuming and difficult — common names generate false positives that only document-level comparison resolves, while transliteration differences can hide true matches. This is exactly why complete, passport-exact identity data across your files does double duty: it clears false positives fast and leaves no gap for a true match to hide in.

The no-list reality cuts one clear behavioural rule for clients: self-declare. Because identification is judgement-based, an undeclared connection that screening later surfaces reads as concealment even when it was oversight — and the file inherits the credibility damage. A declared connection, by contrast, simply routes the case into the defined process above. The choice between those two paths is entirely yours, and it is made in the first onboarding form.

What should a politically exposed person prepare?

If the definition reaches you — or your spouse, parent, child or business partner — the preparation list is short and almost entirely front-loadable. The centrepiece is the source-of-wealth dossier: a documented account of how the family’s asset base was built — business sale agreements, salary and dividend history, inheritance papers, property deeds, financial statements with a visible track record — assembled once to the strictest standard and reused across every bank, agent and registry file. The distinction between source of wealth and source of funds, and the evidence each demands, is unpacked in our guide to how banks vet offshore accounts; for PEP files, both are asked, and wealth is the harder one to reconstruct under deadline.

Then calibrate expectations. Senior-management approval takes time — your application is escalated by design, so build days, not hours, into onboarding plans. Enhanced monitoring is permanent — unusual transactions will draw questions faster than a standard account, which well-run PEP relationships treat as routine correspondence rather than affront. And status fades by assessment, not anniversary: the “are or have been” wording means declassification is a risk-based judgement about lapsed influence — the mechanics of how a registry evidences that, via the enhanced-due-diligence confirmation letter, are covered in our RAK ICC PEP confirmation letter guide.

What do PEP rules mean for RAK ICC and offshore structures?

Offshore structures concentrate every element of the regime. The duties attach to the beneficial owner, so a PEP anywhere in the ownership chain — through holding layers, joint arrangements or nominee positions — triggers the framework for the whole structure; the look-through mechanics are the same eleven grounds mapped in our RAK ICC UBO register guide. Your Registered Agent, as a DNFBP, is legally the first screen: expect the PEP question at incorporation, at every UBO confirmation, and whenever ownership moves.

The associate rules bite hardest here. A company established in favour of a politically exposed person makes its visible owner a PEP-associate — which is precisely the arrangement offshore structures are capable of creating by accident, when a friend or adviser incorporates “on behalf of” someone exposed. If a structure exists for a PEP’s benefit, the compliant version says so, carries the dossier, and clears enhanced due diligence; the quiet version is a discovered file waiting to happen.

And the registry side has its own artefact: where a shareholder is a PEP, the Registered Agent’s confirmation to the registry runs through the enhanced-due-diligence letter — senior-management sign-off and verified source of wealth in documentary form. Between that letter, the UBO register and the bank’s controlling-person analysis, a PEP-linked structure is described three times in parallel; keeping all three descriptions identical is the whole art, and the standing theme of our compliance checklist.

What must firms and DNFBPs build into their AML programme?

If you sit on the other side of the table — a corporate service provider, real-estate broker, dealer in precious metals, auditor or any other DNFBP — the Cabinet Decision’s PEP clauses translate into four concrete programme components. Screening systems: risk-management tooling that checks customers and beneficial owners against PEP databases at onboarding and periodically thereafter, with documented false-positive resolution. An escalation workflow: senior-management approval wired to fire before establishing — and on continuing — any foreign-PEP relationship, and any high-risk domestic-PEP one. Source-of-funds procedures: defined evidence standards for PEP cases, not ad-hoc requests. Enhanced monitoring: PEP relationships flagged in the transaction-monitoring logic with tighter thresholds and review cycles.

Around those four sit the general obligations the framework assumes: a compliance officer with independence, staff training that covers the family-and-associates perimeter, record-keeping that preserves the approval trail, and goAML registration for the reporting duty when suspicion does arise. Regulators test PEP controls precisely because they are hard to fake — either the escalation records exist or they do not. Fastlane builds the full DNFBP framework from AED 349 — policies, screening procedures, MLRO support and goAML — sized to businesses that need controls that work, not binders that sit.

How does Fastlane handle PEP compliance?

We work both sides of the PEP question, with the same file at the centre:

1. Determine status honestly — the definition applied to the person, the family ring and the associate tests, documented either way.
2. Build the wealth dossier — source-of-wealth and source-of-funds evidence traced to origin, assembled once to bank standard.
3. Sequence the approvals — declarations made at onboarding, senior-management sign-off obtained before exposure, the registry’s enhanced-due-diligence letter prepared where a RAK ICC structure is involved.
4. Align the three descriptions — UBO register, KYC file and bank controlling-person analysis resolving to the same people on the same grounds, with FTA corporate tax registration at AED 199 completing the file.
5. For DNFBPs: install the controls — screening, escalation, source-of-funds procedure and monitoring, with training and goAML, as one working programme.

PEP compliance done early is administration; done late it is crisis management. The glossary below fixes the terms this guide uses.