PEP Screening for Gaming Venues — Who Needs It, When, and What to Do About a Match
Politically Exposed Person screening is part of the AML/CTF obligations every Australian pub and club must meet. It is also widely misunderstood. Here is what PEP screening actually requires, when to run it, and how to handle a match professionally.
What a PEP Is — and What It Isn’t
A Politically Exposed Person (PEP) is an individual who holds, or has recently held, a prominent public function. The Financial Action Task Force and AUSTRAC identify several categories:
- Heads of state or government
- Senior politicians (ministers, members of parliament in leadership roles)
- Senior judicial or military officials
- Senior executives of state-owned enterprises
- Senior officials of international organisations
- Close family members and known close associates of the above
Most PEPs are legitimate public figures whose financial activity is entirely ordinary. PEP status does not mean the patron has done anything wrong — it means the patron’s public role creates elevated risk exposure that warrants enhanced scrutiny.
The reason PEP status matters in AML/CTF is that public officials are, internationally, more frequently associated with corruption and bribery risk than the general population. PEP screening does not accuse the patron; it simply flags that the general risk profile is elevated enough to warrant ECDD.
Why PEP Screening Applies to Gaming Venues
The AML/CTF Act and AUSTRAC guidance require reporting entities to have risk-based PEP screening procedures. For gaming venues, this is not optional — it is part of meeting the general obligation to apply enhanced due diligence to higher-risk patrons.
In practice, most pub and club patrons are not PEPs. Screening every patron at every payout would be disproportionate. The obligation is to screen in risk-based circumstances — typically at higher cumulative payout thresholds or when other risk indicators are present.
When to Screen
Your AML/CTF program sets the specific triggers. Practical triggers that most venues use include:
Common PEP Screening Triggers
- Cumulative payouts reach a threshold (commonly $10,000 over a defined period)
- Patron assessed as MEDIUM or HIGH risk by the venue’s risk framework
- ECDD is triggered by other factors (structuring indicators, source-of-funds concerns)
- Periodic re-screening for flagged patrons — typically a 90-day cycle
- Initial screening at CDD for any patron whose identification is performed
Many venues adopt a two-layer approach: initial PEP screening on every identified patron (quick check against consolidated PEP lists) and enhanced PEP screening (detailed review) on patrons who cross secondary thresholds.
What to Screen Against
The Four Screening Categories
- Domestic PEPs — Australian public figures currently or recently in prominent roles
- Foreign PEPs — the highest-risk category, public figures from other jurisdictions
- International organisation PEPs — senior officials of international bodies
- Close associates and family — spouses, children, close business associates
Sanctions Screening — Separate but Related
PEP screening is often run alongside sanctions screening, though the two are distinct. Sanctions screening checks whether a patron is on Australian, UN, or other applicable sanctions lists. A sanctions match is a different order of problem from a PEP match — sanctions matches typically require immediate service refusal and escalation, whereas PEP matches trigger ECDD.
Confusing the two is a common failure. Sanctions screening is a regulatory compliance check with potential criminal consequences for providing services to a sanctioned person. PEP screening is a risk indicator that triggers enhanced due diligence. Your program must describe both separately and handle matches differently.
The 90-Day Validity Window
PEP and sanctions data is time-sensitive. Status changes — a politician leaves office, a new executive is appointed to a state-owned enterprise, a sanctions list is updated. A screening performed 12 months ago may be out of date.
A widely adopted practice is a 90-day validity window on PEP screening results. A patron flagged or cleared within the last 90 days is considered current; outside that window, re-screening is required when the patron re-triggers a screening event.
The 90-day cycle is not mandated in the Act — it is a practical standard that balances thoroughness with operational feasibility. Your program should define your chosen cycle and apply it consistently.
What to Do About a PEP Match
Step 1 — Verify the Match
Screening systems produce false positives. A name match is not necessarily a PEP match. Verify that the matched record actually corresponds to the patron — date of birth, home country, role details should all align.
Step 2 — Escalate to the Compliance Officer
A verified PEP match is an ECDD event. The compliance officer reviews the full patron picture, considers the PEP category (domestic, foreign, associate), and decides the appropriate controls.
Step 3 — Apply ECDD
ECDD measures typically include: additional identity verification, source of funds enquiry, source of wealth enquiry, and enhanced ongoing monitoring with lower alert thresholds.
Step 4 — Senior Management Awareness
For foreign PEPs (the highest risk category), AUSTRAC guidance points to senior management approval of continued service. Document the approval and the reasoning.
Step 5 — Periodic Review
PEP-flagged patrons receive periodic re-review. If no adverse information emerges and activity remains within expected bounds, ECDD status may continue unchanged. If new indicators emerge, further action may be warranted.
Importantly, a PEP match does not automatically mean refusing service. Most PEP-flagged patrons continue to receive services with enhanced oversight. The controls are proportionate to the risk, not punitive.
Common PEP Screening Failures
1. No Screening at All
The most basic failure: programs that describe PEP screening as a concept but never actually run it. AUSTRAC will look for evidence that screening was performed at the expected triggers.
2. Screening That Is Not Documented
The screening was run but no record was kept. From an evidential standpoint, an undocumented screening is no screening. The record must show the patron screened, the time, the result, and the actions taken.
3. Matches Treated As Red Flags Rather Than Triggers
A PEP match is escalated, the compliance officer panics, and the patron is effectively cut off without proper ECDD. This overreaction is a different failure from under-reaction — it often produces discrimination complaints and damages legitimate patrons.
4. False Positives Not Investigated
Name matches assumed to be genuine without verification. A common-name match that is not the PEP produces ECDD measures applied to a patron who does not warrant them, and diverts compliance resources from real risks.
5. No Sanctions Component
PEP screening implemented without sanctions screening. These should run together, and the consequences of a hit differ significantly.
6. Screening Data Not Refreshed
Screening performed once and never re-run. Underlying PEP and sanctions lists change; old results become unreliable.
Privacy Considerations
PEP screening produces personal information about patrons. This information is subject to the Privacy Act 1988 and the Australian Privacy Principles.
- Collection must be limited to what is necessary (APP 3)
- Use must be limited to the purpose of collection — AML/CTF compliance (APP 6)
- Disclosure must be tightly controlled — internal compliance staff only, and AUSTRAC on request (APP 6)
- Storage must be secure (APP 11)
- Retention must be consistent with the seven-year AML/CTF requirement, after which destruction is required
PEP status is sensitive information. Staff outside the compliance function should not have access to whether a patron is PEP-flagged, and the information must not be discussed casually.
Where ComplyIQ Fits
ComplyIQ runs PEP and sanctions screening automatically at every identification event and at configurable thresholds. Matches are verified with structured prompts, escalated to the compliance officer, and the full ECDD workflow is scaffolded — additional verification, source of funds capture, senior management sign-off where applicable. 90-day re-screening is automated. All results are retained for the seven-year record with access restricted to authorised roles.
For the full CDD framework, see our Customer Identification for Gaming Venues Pillar Guide.
PEP Screening Without the Guesswork.
ComplyIQ runs PEP and sanctions screening at every CDD event, verifies matches, scaffolds ECDD, and keeps defensible records — all inside the same platform that handles your AUSTRAC and state gaming compliance. Simpler operations. One audit trail. Support from a team who know pubs and clubs.