Politically Exposed Persons (PEP): The UAE AML Rules

What is a politically exposed person (PEP) under UAE law?

A politically exposed person is a natural person who is, or has been, entrusted with a prominent public function — in the UAE or in any other country. The definition sits in Cabinet Decision No. 10 of 2019, the Implementing Regulation of the UAE's federal anti-money-laundering law, and it deliberately reaches beyond the office-holder to include their immediate family and known close associates.

The reason regulators single out PEPs is risk, not suspicion. A person who holds, or has held, a high political profile or public office may be more vulnerable to bribery and corruption than an ordinary customer, and that vulnerability can make a business relationship a potential channel for laundering the proceeds of corruption. RAK ICC's own guidance frames it plainly: a PEP may seek to use a business relationship as a medium for laundering money obtained by way of corruption, and that risk extends to the PEP's family and close associates.

This is why PEP screening is a core part of every UAE anti-money-laundering compliance programme. It is not an optional refinement for large banks — it is a specific obligation on financial institutions and on Designated Non-Financial Businesses and Professions (DNFBPs), the category that captures corporate service providers, real-estate brokers, dealers in precious metals and stones, auditors and certain legal professionals.

The critical mindset to carry through the rest of this guide is that being a PEP is a classification, not a verdict. The rules do not ask you to refuse PEPs or treat them as wrongdoers. They ask you to identify them, understand where their wealth comes from, get a senior person to sign off on the relationship, and watch it more closely than an ordinary account.

Who counts as a politically exposed person?

The prominent public functions that create PEP status are listed in Cabinet Decision No. 10 of 2019, and they cover the senior tiers of government, the judiciary, the military, state-owned enterprise and political parties — in the State or in any foreign country. A person who has left office does not automatically lose PEP status; the definition captures those who are or have been entrusted with these functions.

Two edges of the definition trip businesses up. The first is seniority: the rules target prominent and senior functions, not every public-sector employee. A junior clerk in a ministry is not a PEP; the minister and the senior officials around them are. The second is foreignness: PEP status attaches to prominent functions in any country, so a customer who holds no UAE office may still be a foreign PEP by virtue of a role held abroad. Screening only against UAE offices misses the larger population.

The international-organisation limb is the one most often forgotten. A person who manages, or holds a prominent function within, a body such as a United Nations agency or a comparable inter-governmental organisation falls within the definition, and is treated in the same risk-based way as a domestic PEP under the due-diligence rules covered later in this guide.

Are a PEP's family members and close associates also covered?

Yes — and this is the part that most enlarges the population you have to screen. Cabinet Decision No. 10 of 2019 extends PEP status to a PEP's direct family members and to known close associates. The rationale is straightforward: corruption proceeds are frequently moved through the people closest to the office-holder rather than through the office-holder's own name.

The family limb is a defined list, not an open-ended one: spouses, children, spouses of children (that is, sons- and daughters-in-law) and parents. Siblings and grandchildren are not named in the definition, though a business assessing risk may still treat a close relative as relevant where the facts warrant it.

The close-associate limb is where the real analysis lives, because it is defined by relationship rather than by a family tree. It captures anyone who shares ownership of a company or arrangement with the PEP, anyone in a close business relationship with the PEP, and — importantly — anyone who is the sole owner of a legal person or arrangement that was set up for the benefit of the PEP. That last category is designed to catch the nominee-style structure where an associate holds an asset on the PEP's behalf, which is exactly why PEP screening and beneficial-ownership analysis have to be run together rather than in separate silos.

Foreign, domestic or international-organisation PEP — what is the difference?

The distinction decides how much you must do. Under Cabinet Decision No. 10 of 2019, foreign PEPs always attract the full set of enhanced measures, while domestic PEPs and international-organisation officials attract those measures on a risk-based trigger — specifically, when the business relationship is high-risk. Getting this classification right is the single most consequential judgement in PEP compliance, because it sets the baseline for everything that follows.

Read the comparison carefully: the identification obligation applies to everyone. You must always take steps to work out whether a customer or beneficial owner is a domestic PEP or an international-organisation official — the risk-based element governs the enhanced measures (approval, source of funds, monitoring), not whether you bother to check at all. A common error is to skip domestic screening entirely on the assumption that only foreign PEPs matter; the rule does not permit that.

The reason foreign PEPs sit at the top of the scale is the difficulty of verifying their circumstances at a distance and the wider variation in governance standards across jurisdictions. A domestic PEP operating inside the UAE's own supervised system is treated as lower baseline risk — but "lower baseline" is not "no obligation", and a domestic relationship that shows high-risk features (opaque structures, unusual transaction patterns, adverse media) climbs straight back up to the full enhanced set.

Does being a PEP make someone a criminal?

No. PEP status itself does not incriminate any individual or entity. Cabinet Decision No. 10 of 2019 and RAK ICC's guidance are explicit on this point: identifying a customer as a PEP places them in a higher-risk category, it does not brand them a criminal or a money launderer. The correct response to a PEP match is more diligence, not refusal or suspicion.

This matters commercially as well as legally. A business that treats every PEP as radioactive and declines the relationship outright is not being cautious — it is misunderstanding the rule, and it will turn away legitimate customers who happen to hold or have held public office, or who are related to someone who does. The regulation asks for managed risk, not avoided risk.

It also cuts the other way. Because PEP status is about elevated vulnerability to corruption rather than proven wrongdoing, you cannot discharge the obligation by simply noting "customer is a PEP" and moving on. The classification is the beginning of the work, not the end of it: it switches on the enhanced measures set out below, and those measures are what actually protect the business.

What enhanced due diligence must you apply to a foreign PEP?

For a foreign PEP, Cabinet Decision No. 10 of 2019 requires four enhanced measures in addition to standard customer due diligence — and all four apply in every case, with no risk-based off-switch. Standard CDD (identifying and verifying the customer and the beneficial owner, and understanding the purpose of the relationship) is the floor; the PEP measures sit on top of it.

1. Risk-management systems — put suitable systems in place to determine whether a customer or beneficial owner is a PEP, before or as the relationship is established.
2. Senior-management approval — obtain sign-off from senior management before establishing a new business relationship with a PEP, and before continuing an existing relationship once PEP status is identified.
3. Source of funds — take reasonable measures to establish the source of funds of customers and beneficial owners identified as PEPs.
4. Enhanced ongoing monitoring — conduct enhanced, continuing monitoring of the relationship, not a one-off check at onboarding.

The word "continuing" in the second measure catches businesses out. Senior-management approval is not only for new customers — if an existing customer becomes a PEP, or you discover that a current customer was a PEP all along, you must escalate to senior management to decide whether to continue the relationship. A customer who takes public office, or whose child marries into a political family, can convert an ordinary relationship into a PEP relationship overnight, and the approval obligation is triggered at that moment.

What are the rules for domestic PEPs and international-organisation officials?

For domestic PEPs and for individuals previously entrusted with prominent functions at international organisations, the obligation is two-part. First, you must take sufficient measures to identify whether the customer or beneficial owner is such a person — this is unconditional. Second, you must apply the enhanced measures — senior-management approval, source of funds and enhanced monitoring — when there is a high-risk business relationship accompanying such persons.

The practical question therefore becomes: what makes a relationship high-risk? Cabinet Decision No. 10 of 2019 operates a risk-based approach across the board, and a domestic-PEP relationship tips into high-risk on the same factors that elevate any relationship — the presence of complex or opaque ownership structures, transactions inconsistent with the customer's known profile, links to higher-risk jurisdictions, adverse media, or unexplained wealth. When those factors are present, the domestic PEP is treated, in effect, like a foreign PEP.

Because the identification step is always required, the safe operating model is to screen every customer and beneficial owner for domestic and international-organisation PEP status as a matter of course, then run a documented high-risk assessment on any match. That gives you a defensible record whichever way the risk decision falls, and it avoids the trap of never looking in the first place.

How do you actually screen for PEPs when there is no central list?

You screen against commercial PEP data and then verify carefully, because there is no official, centralised global PEP list. Various vendors compile PEP databases, and the United Nations maintains a list of heads of state falling within the FATF definition, but no single authoritative register exists — which means it is left to each regulated business to determine whether it would consider a particular individual a PEP.

That absence of an official list has two consequences. It makes screening a matter of judgement rather than a lookup, and it makes verification the hard part. Matching a name against a database is easy; establishing that this customer is the same person as the database entry — and not an unrelated namesake — is where the diligence actually happens.

1. Collect the identifiers — full legal name, date of birth, nationality and identification numbers at onboarding, so you have something to match against.
2. Screen against reputable PEP data — use a recognised vendor database and the available public lists, covering foreign, domestic and international-organisation functions.
3. Resolve the match — compare names, dates of birth, photographs and identification numbers to confirm a true hit or clear a false positive.
4. Extend to family and associates — screen the beneficial owners and, where relevant, the named family members and close associates.
5. Rescreen periodically — PEP status changes as people take or leave office, so ongoing monitoring must include re-screening, not a single onboarding check.

What is "source of funds" and how do you evidence it?

Source of funds means establishing where the specific money involved in the relationship actually came from — and for a PEP, you must take reasonable measures to establish it. It is distinct from source of wealth, which is the origin of the customer's overall net worth; both are relevant, but the regulation's PEP measure is framed around source of funds, and the goal is to satisfy yourself that the money is not the proceeds of corruption.

"Reasonable measures" is proportionate, not absolute. You are not expected to trace every dirham to its ultimate origin, but you are expected to obtain and corroborate a credible explanation, with documentary support scaled to the risk. A salary and a property sale are easy to evidence; a large, round-figure transfer described only as "consultancy" is not, and the weaker the explanation the more corroboration you need.

Worked example. A DNFBP onboards a customer who is the daughter of a serving foreign minister — a foreign PEP by the family limb. The four enhanced measures are mandatory. The customer states her funds come from a UAE property sale and a salaried role. The firm obtains the sale-and-purchase agreement and the title transfer confirming an AED 3.2 million disposal, plus an employment contract and payslips showing an annual salary of AED 480,000. Those documents reconcile to the funds entering the relationship, senior management approves onboarding on the strength of the file, and the relationship is placed on enhanced monitoring. The same customer with the same declared sources but no supporting documents, and a first transaction of AED 3.2 million described only as "family support", is a very different file — and the reasonable measure there is to keep asking until the money is explained or to decline.

Which UAE businesses must apply the PEP rules?

The PEP obligations in Cabinet Decision No. 10 of 2019 apply to financial institutions and to DNFBPs — Designated Non-Financial Businesses and Professions. If your business falls into either group, PEP screening and the enhanced measures are not optional, and RAK ICC applies the equivalent standard to the relationships it and its registered agents maintain.

For a corporate service provider or registered agent, PEP screening interlocks with the beneficial-ownership work covered in our guide to the UAE AML compliance framework. You cannot reliably screen for PEPs without first knowing who the beneficial owners are — and the close-associate limb of the PEP definition, which reaches anyone holding an asset in favour of a PEP, is precisely the kind of arrangement that a proper beneficial-ownership analysis is designed to surface. The two exercises share the same underlying facts and are best evidenced from one file.

If your firm is a DNFBP, the PEP obligation sits inside a wider AML programme that also requires goAML registration, a written AML policy, a business risk assessment and an appointed MLRO. PEP screening is one control within that framework, not a stand-alone task, and supervisors expect to see it operating consistently with the rest of the programme.

What happens if you get PEP screening wrong?

The consequences run on two tracks: regulatory and commercial. On the regulatory side, failing to identify PEPs, onboarding a PEP without senior-management approval, or neglecting source-of-funds and enhanced-monitoring obligations are AML control failures that expose a business to administrative penalties under the UAE's federal AML framework. On the commercial side, a PEP relationship that later produces a corruption or money-laundering problem is exactly the reputational event that can end banking relationships and licences.

Across the UAE, breaches of AML obligations attract administrative fines that escalate for repeat or serious failures, alongside supervisory measures up to and including restrictions on the licence [VERIFY — confirm the current federal AML penalty schedule against the Ministry of Economy and the relevant supervisory authority before relying on specific figures]. RAK ICC administers its own regulations, so a RAK ICC company or registered agent should confirm the specific consequences that apply through its own compliance channel.

The reassuring news is that PEP compliance is systematic. A business that screens every customer and beneficial owner, resolves matches with a written rationale, escalates PEPs to senior management, documents source of funds proportionately and re-screens on a cycle has a defensible programme — and that programme is far cheaper to build than the remediation, and the lost banking access, that follow a control failure.

Key terms used in UAE PEP compliance

PEP compliance runs on a compact vocabulary drawn from Cabinet Decision No. 10 of 2019 and the FATF standards behind it. These are the terms that recur throughout screening and file reviews.