Sanctions screening and PEP screening under the AMLR: who must be screened, and how deep

Under the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), which applies from 10 July 2027, sanctions screening and PEP screening are written into customer due diligence itself: Article 20(1) lists them next to identifying the customer and its beneficial owners.

The practical questions are whom a firm screens, how often and what it does with a hit. This article answers those questions for business clients, party by party.

Status: November 2026. Based on the AMLR and AMLA's drafts published by 30 September 2026. No legal advice, see the note at the end.

Sanctions screening under the AMLR covers the customer, its beneficial owners and anyone who controls it

Article 20(1)(d) AMLR requires institutions to verify whether the customer or its beneficial owners are subject to targeted financial sanctions. For a customer that is a legal entity, the check goes further: institutions must also verify whether sanctioned natural or legal persons control the entity or hold more than 50% of its proprietary rights or a majority interest in it, individually or collectively.

When to screen is set out in AMLA's draft standards on customer due diligence, submitted to the European Commission in September 2026. Under AMLA's draft standards, customers, beneficial owners and controlling persons must be screened for targeted financial sanctions at onboarding, whenever the sanctions lists change, whenever their due diligence data change, such as a new name or a new beneficial owner, and regularly.

AMLA also plans to ask how fast this happens when it selects institutions for direct supervision. In its draft methodology for that selection, AMLA collects the maximum number of hours between the publication of targeted financial sanctions and their implementation in an institution's screening tools. It also records whether tasks such as sanctions screening and PEP detection are outsourced to service providers.

A list update that sits in a queue for days is then no longer an internal matter. AMLA's draft asks for exactly that delay.

A politically exposed person is anyone who holds or held a prominent public function, and the rules extend to family and close associates

What is a politically exposed person under the AMLR? Article 2(1), point (34), defines a PEP as a natural person who is or has been entrusted with prominent public functions. In a Member State, that includes:

• heads of state and government, ministers and members of parliament
• members of supreme and constitutional courts, courts of auditors and central bank boards
• ambassadors and high-ranking officers in the armed forces
• members of the management bodies of state-owned enterprises
• heads of regional and local authorities with at least 50,000 inhabitants

Equivalent functions in international organisations, at Union level and in third countries count as well.

The rules do not stop at the PEP. Article 20(1)(g) requires institutions to determine whether the customer and its beneficial owner are a PEP, a family member of a PEP or a person known to be a close associate. Family members are the spouse or partner, children and their spouses or partners, parents and, for heads of state, heads of government, ministers and deputy or assistant ministers, siblings. AMLA must issue guidelines on identifying close associates by 10 July 2027.

For KYB that means: the check covers the customer and its beneficial owners. Checking the person who signs the onboarding form is not enough.

A confirmed PEP requires senior management approval, source of wealth checks and enhanced monitoring, and the measures continue for at least 12 months after office

A confirmed PEP changes the relationship, not just the file. Article 42 AMLR adds to the standard due diligence:

• senior management approval to establish or continue the business relationship
• adequate measures to establish the source of wealth and source of funds involved
• enhanced, ongoing monitoring of the relationship

Leaving office does not end it. Under Article 45(2), institutions keep applying risk-mitigating measures until the risk no longer exists, and in any case for not less than 12 months after the person ceased to hold the function. Article 46 applies the same measures to family members and close associates.

PEP status is not a one-time label either. Under AMLA's draft standards, institutions would have to recheck the PEP status of existing customers at a risk-based frequency and without delay when new information arrives, using automated tools, manual checks or both.

AMLA's draft selection methodology counts this exposure too: its inherent-risk data for institutions includes the number of legal-entity customers whose beneficial owners are PEPs.

Screening has to be repeated whenever sanctions lists or customer data change, and new adverse media can trigger a review

Sanctions screening at onboarding is only the first run. AMLA's draft standards add re-screening whenever the lists change, whenever the customer's due diligence data change and at regular intervals. For the existing client base, this work comes back with every list update. Delta lists help here: list updates that contain only the changes, so the whole client base need not be re-screened against the full lists every time.

In AMLA's consultation on the draft due diligence standards, firms named additional screening and alert handling among the main sources of recurring cost under the new due diligence rules.

AMLA's consultation paper on ongoing monitoring, published in June 2026 with draft guidelines that are not final yet, names new adverse media and a new PEP status as events that may trigger a review of customer information, next to changes in ownership, directors or authorised signatories. For low-risk customers with no new activity, the same draft allows lighter periodic reviews, for example checking business registries, running PEP and adverse media screening and checking internally whether the relationship has changed.

All of this sits inside the updating periods of Article 26(2) AMLR: customer information must be updated at least every 5 years, and at least every 1 year for higher-risk customers under enhanced due diligence. AMLA reads the updating periods as maximums: firms should set more frequent updates based on each customer's risk profile, and a review done earlier than scheduled can reset the timeline for the next one.

The AMLR sets which check applies to which party

Article 20(1) AMLR names the parties for each check:

• the customer: the sanctions check of Article 20(1)(d) and the PEP determination of Article 20(1)(g)
• the beneficial owners, including natural persons who control the customer via other means (Article 51): the sanctions check and the PEP determination
• natural or legal persons who control a legal-entity customer or hold more than 50% of its proprietary rights or a majority interest, individually or collectively: the check for targeted financial sanctions under Article 20(1)(d)
• where relevant, the person on whose behalf a transaction is carried out: the PEP determination of Article 20(1)(g)
• senior managing officials, identified when no beneficial owner can be found: the AMLR states that they are not beneficial owners (recital 125)

Screening results are due diligence records, kept for 5 years

Sanctions and PEP checks are part of customer due diligence under Article 20(1) AMLR. Article 77 AMLR requires institutions to keep the documents and information from customer due diligence, unredacted, for 5 years from the end of the business relationship.

Under AMLA's draft standards on pecuniary sanctions under the AML directive, supervisors would sort breaches into four categories of increasing severity. A breach would fall into the most severe category where there is a structural failure of a firm's AML/CFT systems, controls or policies. What that means for the people who sign off is the subject of our article Personal liability under AMLR 2027.

Evidence has to come out of the process itself. OTTO Payments went from 16 audit findings to 0 after its internal audit reviewed the new KYB setup on Sinpex. For the full stack from identity verification to continuous screening, read the recap of our webinar The Full AMLR Stack.

FAQ: sanctions and PEP screening under the AMLR

What is sanctions screening?

Under the AMLR, sanctions screening means verifying whether the customer or its beneficial owners are subject to targeted financial sanctions, and for legal entities whether sanctioned persons control the entity or hold more than 50% of it.

How often does sanctions screening have to be done?

Under AMLA's draft standards: at onboarding, whenever the sanctions lists change, whenever the customer's due diligence data change, and regularly.

What is a politically exposed person?

A natural person who is or has been entrusted with a prominent public function, such as a minister, a member of parliament, a judge at a supreme court or the head of a regional or local authority with at least 50,000 inhabitants.

How long does someone remain a PEP?

Institutions keep applying risk-based measures after the person leaves office until the risk no longer exists, and in any case for not less than 12 months.

Do family members of a PEP count?

Yes. The PEP measures also apply to family members and to persons known to be close associates. Family members are the spouse or partner, children and their spouses or partners, parents and, for heads of state, heads of government, ministers and deputy or assistant ministers, siblings.

This article is for general information only and does not constitute legal advice. It reflects the AMLR, the related EU implementing acts and the published AMLA drafts as of November 2026. Some technical standards are still drafts and may change before they are adopted. Whether and how the rules apply depends on your institution's business model, risk profile and national supervisory practice. Please verify the information independently and seek legal advice for your specific situation. Status: November 2026.

Sources: Regulation (EU) 2024/1624 (AMLR) · AMLA, final report on the draft customer due diligence standards · AMLA, consultation paper on draft guidelines on ongoing monitoring · AMLA, final report on draft standards for selecting institutions for direct supervision · AMLA, final report on draft standards on pecuniary sanctions