AML Risk Assessment, Enhanced Due Diligence, PEPs and Sanctions

Use reliable identity details to investigate screening matches. Name similarity is a signal requiring assessment, not proof of identity. Record false-positive reasoning and actual-match action under the applicable law.

A reporting entity begins a new cross-border service. It reassesses geographic and delivery-channel exposure, beneficial ownership, expected transactions and control capacity before launch. It does not merely add one line to an annual form while leaving monitoring unchanged.

For a high-risk customer, enhanced enquiry should be proportionate and comply with the sector requirements. Keep source-of-funds/source-of-wealth evidence where required, approvals and ongoing review. PEP-related measures must follow the relevant definition and treatment of connected persons.

Evaluate whether controls work in practice, including linked activity and incomplete ownership. Preserve limitations and remediation. Check current sector rules, sanctions information and reporting deadlines as part of the entity’s compliance assessment.

A proportionate assessment considers the customer, the service, the geography, the delivery channel and the pattern of funds. For an activity subject to customer due diligence, enhanced measures should address the particular uncertainty: complex ownership may require a fuller ownership analysis; unusual wealth may require additional source evidence; a remote transaction may require stronger identity verification.

An enhanced review is not satisfied by copying a standard paragraph that says “high risk.” Record the concern, evidence obtained, responsible approval and the effect on monitoring. Revisit the assessment when facts change. A change in ownership, payment channel or business purpose can matter more than an unchanged customer name. Statutory auditors' distinct responsibilities under ICAN's 2026-effective STR guidance must remain separate from the duties of firms providing other covered services.

PEP status calls for the measures required by the governing rules; it does not itself prove wrongdoing or mean the person appears on a sanctions list. Targeted financial sanctions address designated persons, funds and resources under the applicable legal regime. Ordinary enhanced due diligence cannot substitute for a required sanctions measure.

ICAN's January 2026 TFS guideline directs covered reporting entities to distinguish a potential name match from a confirmed match. Compare identifying information such as nationality, date of birth, registration details and aliases. Similar names require further enquiry. For a confirmed match, the guideline requires applicable freezing measures without delay and without prior notice, together with the prescribed notifications. The ownership and control analysis of the actual asset matters.

A Nepal professional firm encounters a client name resembling a listed person's name. The client's passport and date of birth establish a different identity. The firm records the list checked, matching details, contradictory identifiers and the authorised conclusion, rather than repeatedly overriding the alert without evidence.

If the same review reveals unexplained third-party funding, resolving the name match does not resolve that separate concern. Investigate and assess the facts through the applicable process. A sanctions result, customer-risk classification and STR decision answer different questions and should each have a clear basis.