Six jurisdictions, six answers to who counts as a politically exposed person

The texts in all six jurisdictions start from a similar idea: people who hold important public functions. Each then draws the edges differently: which relatives count, whether a domestic official is treated like a foreign one, and when senior management must…

Illustration for “Six jurisdictions, six answers to who counts as a politically exposed person”

The texts in all six jurisdictions start from a similar idea: people who hold important public functions. Each then draws the edges differently: which relatives count, whether a domestic official is treated like a foreign one, and when senior management must sign off the relationship.

A PEP list bought for one jurisdiction answers that jurisdiction’s question. It does not answer the others.

Where the lines are drawn

JurisdictionWho is coveredRelatives and associatesSenior management approval
MauritiusForeign, domestic and international-organisation PEPs (FIAMLR 2018, reg. 2)Family members by blood, marriage or civil partnership, and close associates, of all types of PEP (reg. 15); the FIU’s 2026 guidelines say they should be determined to be PEPsForeign PEPs; domestic and international-organisation PEPs where the relationship is higher risk (reg. 15)
Saudi ArabiaProminent public functions in the Kingdom or a foreign country, or a senior management position in an international organisation (Implementing Regulation, Art. 8)Family up to the second degree by blood or marriage; known joint beneficial owners and close business contactsForeign PEPs; PEPs from the Kingdom where money laundering risk is higher (8/5)
QatarFunctions entrusted by the State, a foreign State or an international organisation (Law No. 20 of 2019, Art. 1)Relatives by blood or marriage up to the second degree, partners and close business or social contacts (Implementing Regulations, Art. 28); the QFC rules also use the second degreeEvery PEP, family member and close associate (Implementing Regulations, Art. 27)
DIFCOne definition that names ambassadors and includes family members and close associates where relevant (DFSA Glossary)Within the definitionEvery PEP customer or beneficial owner (AML 7.3.8)
ADGMFunctions in the UAE or elsewhere, and international or supranational organisations (FSRA AML Rulebook)In the definition; guidance names spouses or partners, children and their spouses or partners, parents and siblingsForeign PEPs get a high-risk rating; any PEP triggers Enhanced CDD, which includes Senior Management approval (AML 7.1.2, 8.3.1, 8.4.1)
MoroccoMoroccan or foreign persons who hold or have held civil or judicial public functions or important political missions, in Morocco, abroad or in or for an international organisation (Law 43-05, Art. 4)First-degree ascendants and descendants, spouses, and closely linked natural or legal personsEnhanced vigilance adapted to the risk; an approval rule could not be confirmed for this briefing

The UAE also has a federal definition. Cabinet Resolution No. 134 of 2025, the executive regulations of Federal Decree-Law No. 10 of 2025, in force since 14 December 2025, covers present and past holders of prominent public functions in the UAE or any other country, naming senior political party officials and the senior management of international organisations. Its examples of immediate family members are spouses, children and their spouses, and parents, and its close associates include joint beneficial owners. Senior Management approval is required for foreign PEPs, and for domestic and international-organisation PEPs where the relationship is high risk (Art. 16). The FSRA’s rulebook reminds ADGM firms that they must comply with federal AML legislation as well as its own rules.

Three differences that matter

The family tree is not the same size. Saudi Arabia and Qatar reach the second degree; the QFC rules list what that means, including grandparents, grandchildren, brothers and sisters, and in-laws. ADGM’s guidance names siblings. Morocco’s law stops at first-degree ascendants and descendants and spouses, but also names closely linked legal persons: companies, not just people.

Domestic is not always lighter. Mauritius, Saudi Arabia and the UAE federal regulations make senior management approval automatic for foreign PEPs and risk-based for domestic ones. The DFSA (AML 7.3.8) and Qatar’s Implementing Regulations (Art. 27) draw no such line: approval is required for every PEP. ADGM rates foreign PEPs high risk automatically, but sends any PEP into Enhanced CDD, whose measures include Senior Management approval.

Leaving office is not the end of the risk. The DFSA considers that a PEP may remain a higher risk after leaving office if they continue to exert political influence; the FSRA says a PEP remains a higher risk after leaving office, particularly in that case. The Mauritius FIU’s January 2026 guidelines say establishing or continuing relationships with PEPs should be based on an assessment of risks, and not on prescribed time limits and revenue alone.

Qatar adds a criminal edge. Under Law No. 20 of 2019, anyone who intentionally, and with unlawful intent, conceals or helps conceal that a customer is a PEP faces up to three years’ imprisonment and a fine of up to QR 500,000, or one of the two.

The failure mode

A group buys one PEP dataset, sets one family-member rule and one approval path, and applies them everywhere. The programme ends up over-strict in one centre and short in another: a Moroccan subsidiary with no process for the companies around a PEP, or a DIFC or Qatar branch treating a domestic official as routine.

Three things worth doing this week

  1. Write down each jurisdiction’s family-member rule next to the one your screening tool actually applies. Degree of relationship is where the gaps are.
  2. Check your approval matrix in the DIFC and Qatar. If domestic PEPs skip senior sign-off anywhere in the group, confirm that no DIFC or Qatar relationship is routed that way.
  3. Base the off-boarding of former PEPs on a documented risk assessment. The DFSA, the FSRA and the Mauritius FIU all point to an assessment of risk.

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu