PEP Screening in Crypto: Enhanced Due Diligence for Pakistani VASPs

Operating a Virtual Asset Service Provider (VASP) in Pakistan comes with significant responsibilities, particularly concerning anti-money laundering (AML) and counter-terrorist financing (CFT) compliance. A critical area of focus for regulators globally, and increasingly in Pakistan, is the management of risks associated with Politically Exposed Persons (PEPs).

PEPs, by their very nature, present a higher risk of involvement in bribery, corruption, and illicit financial flows. For a VASP, failing to adequately identify, assess, and mitigate these risks can lead to severe penalties, including substantial fines, licence revocation, and significant damage to reputation. This is not merely a box-ticking exercise; it is fundamental to the integrity and sustainability of a virtual asset business.

Understanding the proposed regulatory expectations for PEP screening and enhanced due diligence (EDD) is therefore essential for any operator seeking to secure or maintain a VASP licence in Pakistan. Proactive preparation for these requirements can help ensure smooth operations and robust compliance. For guidance on securing such a licence, operators can review our VASP licensing service.

What is a Politically Exposed Person (PEP)?

A Politically Exposed Person (PEP) is an individual who is or has been entrusted with a prominent public function, along with their family members and close associates. These individuals are considered to pose a higher risk for potential involvement in bribery and corruption by virtue of their position and influence.

The definition of a PEP extends beyond the individual holding public office. It typically includes:

• Foreign PEPs: Individuals holding prominent public functions in a foreign country. This might include heads of state or government, senior politicians, judicial or military officials, and senior executives of state-owned corporations.
• Domestic PEPs: Individuals holding prominent public functions within Pakistan. This category mirrors the foreign PEP list but applies to national officials.
• International Organisation PEPs: Persons entrusted with a prominent function by an international organisation, such as directors, deputy directors, or members of the board.
• Family Members: Direct family members of a PEP, including spouses, partners, children and their spouses/partners, and parents.
• Close Associates: Individuals who are known to have close business or personal relationships with a PEP. This could include joint beneficial ownership of legal entities or arrangements, or sole beneficial ownership of a legal entity set up for the benefit of the PEP.

The Financial Action Task Force (FATF), whose recommendations heavily influence Pakistan’s regulatory framework, emphasises a risk-based approach to identifying and managing PEPs. This means the level of scrutiny should be proportionate to the assessed risk.

Why do PEPs require special attention in crypto?

PEPs require special attention in the virtual asset sector because their prominent positions can be exploited for illicit activities, presenting a heightened risk of money laundering and terrorist financing. The pseudonymous or anonymous nature of some virtual asset transactions, combined with their global reach, can make them attractive for concealing the origin and ownership of illicit funds.

FATF Recommendation 15, which specifically addresses new technologies like virtual assets, highlights the need for countries to apply AML/CFT requirements to VASPs, including those related to PEPs. This recommendation is a key driver for Pakistan’s proposed virtual asset regulations, influencing how the Pakistan Virtual Assets Regulatory Authority (PVARA) would structure its rules. Understanding what FATF Recommendation 15 is and why it shapes Pakistan’s rules is crucial for operators. The State Bank of Pakistan and the Securities and Exchange Commission of Pakistan (SECP) have long applied similar principles to traditional financial institutions, and the virtual asset sector is expected to follow suit.

What is Enhanced Due Diligence (EDD) for PEPs?

Enhanced Due Diligence (EDD) for PEPs involves applying additional, more rigorous checks and ongoing monitoring beyond standard customer due diligence to mitigate the heightened risks associated with their transactions and relationships. This is a crucial part of a VASP’s overall AML compliance programme.

When a VASP identifies a customer as a PEP, or becomes aware that a customer has become a PEP, standard customer due diligence (CDD) is insufficient. The VASP must then implement a series of enhanced measures, which typically include:

• Senior Management Approval: Obtaining approval from senior management (or a designated compliance officer) before establishing or continuing a business relationship with a PEP.
• Source of Wealth and Funds: Taking reasonable measures to establish the source of wealth and the source of funds involved in the business relationship or specific transactions. This goes beyond simply verifying the origin of funds and seeks to understand how the wealth was accumulated.
• Purpose and Nature of Relationship: Understanding the purpose and intended nature of the business relationship with the PEP.
• Ongoing Monitoring: Conducting enhanced ongoing monitoring of the business relationship. This means scrutinising transactions more closely and frequently to ensure they are consistent with the VASP’s knowledge of the customer and their risk profile.

These measures aim to ensure that the VASP is not inadvertently facilitating money laundering, corruption, or other illicit activities through its platform.

How do Pakistani regulations address PEPs and EDD?

Pakistan’s evolving virtual asset regulatory framework, guided by FATF standards, proposes specific obligations for Virtual Asset Service Providers regarding PEP identification and enhanced due diligence. The Pakistan Virtual Assets Regulatory Authority (PVARA) is developing a comprehensive framework that would require VASPs to implement robust AML/CFT controls.

While the specific rules are still under consultation, the proposed framework from PVARA, which can be found at https://pvara.org, is expected to align closely with international best practices. These practices are already reflected in AML/CFT regulations for traditional financial sectors overseen by the State Bank of Pakistan and the SECP. VASPs should anticipate requirements for a risk-based approach to customer due diligence, including specific provisions for identifying and managing PEPs. This includes detailed procedures for EDD and continuous monitoring. For a broader understanding of the regulator, see our guide on what is PVARA, Pakistan Virtual Assets Regulatory Authority.

What steps should a VASP take for PEP screening?

A VASP should implement a robust, risk-based system for identifying PEPs at onboarding and throughout the customer relationship, applying appropriate enhanced due diligence measures. This involves a combination of technology, clear policies, and trained personnel.

Key steps include:

1. Develop a Risk-Based Approach: Integrate PEP screening into the VASP’s overall VASP Risk Assessment: Building an AML Methodology for Pakistan. Determine the level of risk associated with different types of customers and transactions, and tailor PEP screening efforts accordingly.
2. Implement Screening Tools: Utilise reliable third-party PEP screening databases and software. These tools can automatically check customer names against global lists of PEPs, their family members, and close associates.
3. Establish Clear Policies and Procedures: Document detailed internal policies for:
   • Identifying PEPs during the customer onboarding process.
   • Conducting EDD once a PEP is identified.
   • Obtaining senior management approval for PEP relationships.
   • Ongoing monitoring of PEP accounts and transactions.
   • Handling false positives and escalating genuine PEP matches.
4. Train Staff: Ensure all relevant staff, especially those involved in customer onboarding, compliance, and transaction monitoring, are thoroughly trained on PEP definitions, risks, screening procedures, and EDD requirements.
5. Integrate Screening into Onboarding: Make PEP screening a mandatory step in the customer due diligence process for all new customers. This should occur before a business relationship is established. For a practical walkthrough of these processes, consider our article on Crypto KYC & CDD for Pakistan’s VASPs: A Practical Guide.
6. Ongoing Monitoring: Regularly rescreen existing customers against updated PEP databases. PEP status can change over time, and a non-PEP customer could become a PEP, or new information about an existing PEP could emerge.

What information must a VASP collect for PEP EDD?

For PEPs, a VASP is expected to collect additional information beyond standard customer due diligence, focusing on the source of wealth and funds, and the rationale for the transaction. This deeper dive aims to understand the legitimacy of their financial activities.

The specific information to collect for Enhanced Due Diligence (EDD) on PEPs typically includes:

• Source of Wealth (SoW): This refers to the origin of the PEP’s entire net worth. VASPs should seek to understand how the PEP accumulated their wealth. Examples of documentation or information could include:
  • Employment history and salary statements.
  • Business ownership details and financial statements.
  • Inheritance documents.
  • Investment portfolios.
  • Property records.
• Source of Funds (SoF): This refers to the origin of the specific funds or virtual assets being used in a particular transaction or to establish the business relationship. VASPs should understand where the funds originated immediately prior to the transaction. Examples could include:
  • Bank statements showing fund transfers.
  • Proof of sale of assets.
  • Details of a previous virtual asset transaction.
• Purpose and Intended Nature of the Business Relationship: A clear understanding of why the PEP wishes to use the VASP’s services and what types of transactions they intend to conduct. This helps in assessing the legitimacy and consistency of their activities.
• Beneficial Ownership Information: If the PEP is acting on behalf of a legal entity, the VASP must identify and verify the ultimate beneficial owners of that entity. This is a standard requirement for all customers but becomes even more critical for PEPs. More details on this can be found in our article on Beneficial Ownership for Crypto Licences: What Regulators Want.
• Rationale for Complex or Unusual Transactions: Any transactions that appear unusually large, complex, or inconsistent with the PEP’s known profile should be scrutinised further, with a clear rationale documented.

All information collected must be properly verified using reliable, independent sources.

How often should PEP screening and EDD be reviewed?

PEP status and associated enhanced due diligence measures must be subject to continuous monitoring and regular review to ensure ongoing compliance and risk mitigation. The dynamic nature of public office and personal associations means a PEP’s risk profile can change.

Key aspects of review frequency include:

• Continuous Monitoring: Utilise automated screening tools that regularly check customer databases against updated PEP lists. This helps identify if an existing customer becomes a PEP or if new adverse media or risk factors emerge.
• Periodic Reviews: Conduct scheduled, in-depth reviews of all PEP relationships at least annually, or more frequently based on the assessed risk level of the individual PEP. High-risk PEPs may require quarterly or semi-annual reviews.
• Event-Driven Reviews: Trigger a review whenever there is a significant change in a PEP’s circumstances, such as:
  • A change in their public office or position.
  • Negative news or adverse media reports.
  • Unusual or suspicious transaction activity.
  • Changes in the VASP’s risk assessment of the PEP.
• Transaction Monitoring: Implement robust Crypto Transaction Monitoring in Pakistan: Setting Rules and Thresholds to identify any patterns or individual transactions that deviate from the expected behaviour of the PEP or raise red flags.

The VASP’s internal policies should clearly define the frequency and triggers for these reviews, ensuring that the level of scrutiny remains appropriate to the ongoing risk.

What are the consequences of failing to identify or manage PEP risks?

Failure to adequately identify and manage Politically Exposed Person risks can lead to significant regulatory penalties, severe reputational damage, and potential involvement in financial crime for a Virtual Asset Service Provider. Regulators view such failures very seriously.

The consequences can be multi-faceted:

• Regulatory Fines and Penalties: PVARA, like other financial regulators, would have the power to impose substantial monetary fines for non-compliance with AML/CFT regulations, including those related to PEPs.
• Licence Suspension or Revocation: Repeated or severe breaches could lead to the suspension or outright revocation of a VASP’s operating licence, effectively shutting down the business. Our article on PVARA’s Enforcement Powers: What VASP Operators Should Expect provides more detail.
• Reputational Damage: Public exposure of a VASP’s involvement with illicit funds or a failure to prevent financial crime can severely damage its reputation, eroding customer trust and making it difficult to attract new business or partners.
• Increased Scrutiny: A VASP with a poor compliance record may face intensified scrutiny from regulatory bodies, including more frequent audits and inspections.
• Legal Action: In cases where a VASP is found to have knowingly or negligently facilitated money laundering or terrorist financing, the firm and its senior management could face criminal prosecution.
• Loss of Banking Relationships: Traditional financial institutions are highly sensitive to AML/CFT risks. A VASP with inadequate PEP controls might find it challenging to maintain banking relationships, which are crucial for fiat on/off-ramps.

What resources are available to assist VASPs with PEP compliance?

Virtual Asset Service Providers can leverage various resources, including compliance software, expert guidance, and regulatory publications, to help establish robust PEP screening and enhanced due diligence frameworks. Building a strong compliance programme requires a multi-faceted approach.

Useful resources include:

• Third-Party PEP Screening Solutions: Specialised software providers offer access to comprehensive global databases of PEPs, sanctions lists, and adverse media. These tools automate the screening process and provide ongoing monitoring capabilities.
• Compliance Consultants: Engaging expert consultants can help VASPs design and implement effective AML/CFT frameworks tailored to their specific business model and Pakistan’s regulatory landscape. This includes developing a sound VASP Risk Assessment: Building an AML Methodology for Pakistan that incorporates PEP risks.
• PVARA Guidance: Once published, official guidance and circulars from PVARA will be the primary source for specific regulatory requirements concerning PEPs and EDD.
• FATF Guidance: The Financial Action Task Force publishes extensive guidance on AML/CFT, including specific recommendations and best practices for managing PEP risks.
• Internal Compliance Officer: Appointing a qualified Compliance Officer or Money Laundering Reporting Officer (MLRO) is crucial. This individual is responsible for overseeing the VASP’s AML/CFT programme, including PEP compliance. Understanding the MLRO role in Pakistan’s virtual asset sector: regulator expectations is vital.
• Industry Associations and Forums: Participating in industry groups can provide opportunities to share best practices and stay informed about evolving threats and compliance solutions.

Effective record-keeping is also paramount. VASPs must ensure they maintain comprehensive records of all PEP screening activities, EDD measures taken, senior management approvals, and ongoing monitoring reports. These VASP Record Keeping in Pakistan: What to Retain and For How Long are crucial for demonstrating compliance during regulatory inspections.

About this analysis

This analysis was prepared by Sarzif Policy based on a review of international anti-money laundering and counter-terrorist financing standards set by the Financial Action Task Force (FATF), existing regulatory frameworks in Pakistan for traditional financial sectors (from the State Bank of Pakistan and the Securities and Exchange Commission of Pakistan), and the proposed virtual asset regulatory framework from the Pakistan Virtual Assets Regulatory Authority (PVARA).

The information provided is for general guidance only and reflects our understanding of the evolving regulatory landscape as of 24 August 2026. Pakistan’s virtual asset regulations are currently at a consultation stage, and specific requirements, thresholds, and deadlines may change as the framework is finalised. Virtual Asset Service Providers should always verify current and specific obligations directly with PVARA or seek independent legal and compliance advice to ensure full adherence to applicable laws and regulations. This article does not constitute legal advice.