UAE Compliance Guide
Why Relatives and Associates Matter in PEP Risk Reviews
A Politically Exposed Person rarely acts alone. In the UAE, banks, exchange houses, real estate brokers and DNFBPs are expected to look one step further, at spouses, children, business partners, and known associates, before they can say a customer file is clean.
The basics
Who counts as family or a close associate?
Under UAE Central Bank guidance and the FATF standards, a PEP is a person entrusted with a prominent public function, a minister, senior judge, ambassador, military general, head of a state-owned company, or a senior official in an international body. That is only half the picture. Regulators also apply enhanced scrutiny to two extended groups.
Family members typically include the spouse (or partner treated as such), children and their spouses, parents, and siblings. Some jurisdictions extend this to in-laws and grandchildren.
Close associates are individuals with close business ties: joint beneficial owners of a company, long-term business partners, personal advisers holding power of attorney, and people who benefit from an arrangement set up for the PEP, such as a trust or a nominee shareholding.
Common relationships that trigger deeper review
Family ties
Spouse, children and their partners, parents, siblings. In Gulf family structures, extended family members involved in shared businesses often warrant a look too.
Business partners
Joint shareholders, co-directors, and long-standing commercial partners who share ownership of legal entities with the PEP.
Advisers and proxies
Lawyers, accountants, or personal representatives who hold signing authority, act as nominee shareholders, or manage assets on behalf of the PEP.
Why it matters
How these connections raise financial-crime risk
The reason regulators care is simple: someone who wants to move illicit funds tied to a public office rarely uses their own name. They use people they trust. That is why PEP screening in the UAE covers the wider network, not just the named official.
- Bribes routed through a spouse’s personal account or a child’s company
- Real estate purchased in the name of an in-law or a nominee director
- Contracts awarded to a business partner who then shares proceeds
- Trusts and foundations where the PEP is a hidden beneficiary
Being related to a PEP does not automatically make a person high risk. It means the file needs a closer look before a decision is made.
How UAE businesses actually screen these individuals
- Identify the connection. At onboarding, ask the customer directly whether they are, or are related to, a PEP. Combine this with automated screening against structured PEP and adverse-media databases.
- Map the network. Pull beneficial ownership data, corporate registry entries, and public disclosures to see who sits around the customer.
- Assess the risk. Weigh the PEP’s country, function, sector exposure, and the nature of the relationship. A retired local official’s adult child running an unrelated business is not the same as the spouse of a sitting minister in a high-corruption jurisdiction.
- Apply enhanced due diligence. Senior management approval, source of wealth and source of funds evidence, and ongoing transaction monitoring at a higher intensity.
- Review periodically. Refresh the screening at least annually, and immediately whenever there is a trigger event.
Extra checks that go beyond a name match
Source of wealth
Documented evidence of how the customer built their assets over time: salary history, business sale documents, inheritance papers, dividend records.
Source of funds
Proof of where the specific money being transacted came from, such as a signed sale agreement, a loan contract, or a payroll statement.
Adverse media
Structured searches in Arabic and English across news, court filings, and sanctions listings. According to FATF guidance adverse media is a core input for PEP decisions.
Senior management sign-off
A designated committee or MLRO signs the file before the relationship starts and before any material change.
A short real-world illustration
A Dubai-based property brokerage onboards a buyer purchasing a villa in cash. Screening flags the buyer’s father as a foreign deputy minister. The buyer is not a PEP herself, but she is a family member of one, and the source of funds is a personal transfer from that same father.
The brokerage requests salary certificates and asset disclosures for the father, checks his home-country asset-declaration filings, and obtains senior management approval before completing the deal. The relationship proceeds under enhanced monitoring. That is the mechanism working as intended.
What if a customer becomes connected to a PEP later?
People are not static. A long-standing customer may marry into a political family, be appointed to a public board, or take a senior role in a state-owned enterprise. This is one reason ongoing monitoring is a requirement, not a nice-to-have.
When a trigger fires (a name match on a refreshed screening run, an adverse media hit, or a self-disclosure by the customer), the file should be reopened. The compliance team re-runs due diligence, updates the risk rating, refreshes source-of-wealth documentation, and, where the risk warrants it, escalates to senior management. In some cases the correct answer is to exit the relationship. In many cases the correct answer is to continue with tighter controls.
Family vs close associate: how the checks compare
| Aspect | Family member | Close associate |
|---|---|---|
| How the link is proved | Civil status, ID documents, family book | Corporate registry, shareholder agreements, POA |
| Typical risk driver | Assets held or funded on behalf of the PEP | Business proceeds channelled through shared entities |
| Source of wealth focus | Inheritance, gifts, personal earnings | Business revenue, joint ventures, contract awards |
| Common pitfall | Missing extended family in Gulf structures | Overlooking nominee or silent partners |
| Ongoing review | Annually or on trigger | Annually plus on any ownership change |
Mistakes UAE organisations should avoid
- Treating every relative as high risk. This creates alert fatigue and unfair de-risking. Grade each case on its facts.
- Screening only the primary customer. Beneficial owners, directors, and authorised signatories all need to run through the same checks.
- Relying on a single database. PEP lists are compiled differently by different providers. A second source catches gaps, especially in Arabic-language name variants.
- Skipping ongoing monitoring. A clean file at onboarding is not a clean file forever.
- Poor documentation. If the reasoning behind an approval is not written down, it does not exist during a regulatory inspection.
The purpose of enhanced due diligence is not to keep PEPs out. It is to make sure the institution understands who it is dealing with.
Frequently asked questions
Does being related to a PEP automatically make someone high risk?
No. A family link or business connection is a signal that requires closer review, not an automatic decline. The risk rating depends on the PEP’s country, function, the nature of the relationship, and the customer’s own profile. Many relatives of PEPs are onboarded and maintained as customers under enhanced due diligence with no issues.
How long does someone stay classified as a PEP-connected person?
The PEP designation itself often continues for at least 12 months after the individual leaves public office, and many UAE institutions apply a longer look-back based on risk. Family members and close associates are typically reassessed at the same time as the primary PEP, but the connection can outlast the office if the person still benefits from arrangements set up during that time.
What documents are usually required for source of wealth?
Common evidence includes salary certificates, tax returns, business sale contracts, dividend statements, inheritance and probate documents, property title deeds, and audited financials for owned companies. The goal is a plausible, documented story explaining how the customer accumulated their assets.
How often should PEP screening be refreshed?
UAE guidance and FATF standards expect ongoing monitoring. In practice, most institutions run screening in real time against updated lists, refresh full customer due diligence at least once a year for high-risk files, and trigger an immediate review whenever there is a change in circumstances such as a new appointment, a corporate restructuring, or an adverse media hit.
Are domestic UAE PEPs treated differently from foreign PEPs?
Historically, foreign PEPs are automatically high risk under FATF Recommendation 12, while domestic PEPs and heads of international organisations are risk-assessed. In practice, UAE institutions apply enhanced due diligence to both categories when the customer or transaction profile warrants it. The distinction affects the starting point, not the ceiling, of the checks.
What should a business do if a customer refuses to disclose PEP connections?
Refusal to provide required information is itself a red flag. Institutions should not proceed with onboarding on that basis alone, and existing relationships should be escalated to the MLRO. Depending on the circumstances, the correct outcome may be a suspicious transaction report, exit of the relationship, or both.
Cyclist, doer, hiphop head, Vignelli fan and storyteller. Operating at the junction of modernism and programing to create strong, lasting and remarkable design. I sometimes make random things with friends.