When a PEP appears: decide with data, not in haste.

In everyday life, PEP It appears as a word that triggers alarms and generates two extremes: everything is halted as a precaution, or it is minimized because "it's probably a homonym." To avoid both, let's first clarify the term. PEP means Politically Exposed Person (in English, Politically Exposed PersonThis is a preventative category used to identify individuals who hold or held a prominent public office. Important: being a PEP (Politically Exposed Person) does not imply a crime or penalty; it simply means that your process must be more careful and, above all, documented.

PEPs in seconds

• What is a PEP?
  It is a preventative category: people with a prominent public role (current or past). It does not imply any crime.
• What do you do if you get a match?
  Don't block or ignore: break the tie with data (country, position, dates, identifiers) and leave a record.
• What minimum evidence should you keep?
  Source consulted + date/time + result + decision (and who approved/why).

Introduction

It happens at the worst possible time: you're registering a client, verifying a real owner, or validating a key third party… and A PEP match appears. In many teams, this triggers two opposing reactions: Everything comes to a standstill just in case, or it is minimized because “It's definitely a homonym”Both have a cost: the first due to operational friction; the second because it leaves you without control and without evidence.

Effective management of PEPs No It is about tick people. It's about making proportionate and consistent decisions, with a process that anyone can explain afterward (another department, audit, committee). The most underestimated issue is the traceability: be able to demonstrate what you consulted, when, with what parameters and how you resolved the match.

Types of PEPs in Mexico

To maintain clarity, think in two layers:
1) Types of PEPs according to the origin of the public service.
2) People close to you when the applicable framework considers it (family members or associates).

 Why it matters

• OperationWithout clear rules, each PEP match becomes a "special case" and creates friction between areas.
• Control and audit“Yes, we reviewed it” is not enough if you cannot show evidence (source, date/time, result and resolution).
• Risk managementThe goal is not to "avoid PEPs", but to manage risk in a proportionate and consistent manner.

How to manage them step by step

The goal is for your process to be fast, repeatable, and explainable (to other areas, committees, and audits).

Step 1) Define your PEP policy before the case arises

• What do you consider PEP and how will you treat close contacts when applicable?.
• Who approves higher-risk cases and at what point in the workflow?.
• What triggers make you "level up" (simple rule).

Step 2) Ensure minimum data to break ties (homonyms)

• Country/jurisdiction, position/function, dates/periods and identifiers where possible.
• If data is missing: ask for information or a scale. Avoid guessing.

Step 3) Screen and separate list types

• Separate restrictive, regulatory, and informational lists for proper documentation.
• Record: source, date/time, search parameters and result.

Step 4) Resolve matches with a clear flow

• Simple criteria: exact/partial match, country, position, period.
• Record whether it is confirmed or rejected (and why, in one line).

Step 5) Classify the risk in an explainable way

• Use understandable factors: PEP type, job level, jurisdiction, product/service, additional findings.
• Avoid overcomplicating things: consistency + evidence is usually worth more than an endless matrix.

Step 6) Apply reinforced measures where appropriate

• Examples: higher-level approval, additional documentation, more frequent monitoring.
• Record what measure you applied, when, and who approved it.

Step 7) Define tracking and updating

• Frequency by risk level and triggering events (change of position, structure, jurisdiction).
• Change log: what changed and what action you took.

 Common mistakes and how to avoid them

• PEP = automatic rejection → change it to a proportionate approach: confirm, classify and document.
• It's definitely a homonym without checking. → If data is missing, ask for information or a scale. Don't guess.
• Do not separate list types → Differentiating between restrictive/regulatory/informative improves explanation and recording.
• Do not leave traceability → Without source + date/time + decision, control becomes indefensible.
• Do not define approvers → clarifies who authorizes higher risk cases and at what stage.
• Failure to follow up → defines periodicity and triggering events by risk level.

How to manage PEPs

Managing PEPs well is not about having a list, but about having reliable sources, frequent updates, and evidence for consistent decisions. Quién es Quién It works with verified data and updated sources (changes typically reflected in <24h), with national and international lists, as well as personalized support and assistance (without promising zero risk).