PEP Screening in Nigeria: CBN Guidance and Compliance Requirements for Financial Institutions

Politically Exposed Person screening is an important part of Nigeria’s anti-money laundering, counter-terrorist financing and counter-proliferation financing framework.

In June 2023, the Central Bank of Nigeria issued its Guidance Notes on Politically Exposed Persons, building on the CBN AML/CFT/CPF Regulations 2022.

The objective of the Guidance is to help financial institutions identify Politically Exposed Persons (PEPs), assess the risks associated with those relationships and implement appropriate controls to prevent the financial system from being exploited for money laundering, terrorist financing, proliferation financing, corruption and related financial crimes.

The Guidance applies to financial institutions under the regulatory supervision of the CBN.

Since then, the regulatory framework has continued to evolve. The CBN Customer Due Diligence Regulations 2023 reinforced requirements around customer identification, beneficial ownership, risk assessment and Enhanced Due Diligence, while the CBN Baseline Standards for Automated AML/CFT/CPF Solutions, issued in 2026, now specifically include PEP and other high-risk profiling among the expected capabilities of automated AML systems.

PEP compliance should therefore not be treated simply as checking a customer’s name against a database at onboarding.

An effective PEP framework should connect:

Identification → Screening → Verification → Risk Assessment → Senior Management Approval → Enhanced Due Diligence → Ongoing Monitoring → Regulatory Reporting

This guide explains what the CBN requires and how financial institutions can build an effective PEP screening and risk-management process.

A Politically Exposed Person is someone who is, or has been, entrusted with a prominent public function. Being a PEP does not mean that an individual is involved in corruption or financial crime.

The risk arises because prominent public positions may give individuals significant influence over public policy, government expenditure, procurement, state assets or other resources that could potentially be abused for personal benefit. PEPs may also use family members, close associates, intermediaries, companies or other legal arrangements to hold or move assets.

The CBN therefore requires financial institutions to adopt a risk-based approach to identifying and managing PEP relationships.

The objective is not to exclude PEPs from the financial system. It is to understand the particular risk presented by the relationship and apply controls proportionate to that risk.

The CBN recognises three principal categories of PEP.

Domestic PEPs are individuals who are, or have been, entrusted with prominent public positions in Nigeria.

These may include heads of government; governors; senior politicians; senior government officials; senior judicial officials; senior military officials; senior executives of state-owned corporations; important political party officials; and other persons exercising significant public authority or influence.

The CBN makes an important distinction when determining whether a public function is sufficiently prominent. Institutions should not look only at the individual’s job title, grade or rank.

They should also consider the person’s actual power or influence over decisions, policy or the expenditure of government funds.

Foreign PEPs are individuals who are, or have been, entrusted with prominent public functions in another jurisdiction. These may include heads of state or government; senior politicians; senior government officials; senior judicial officials; senior military officials; senior executives of state-owned enterprises; and other persons exercising comparable public functions. Foreign PEP relationships require Enhanced Due Diligence under the CBN framework.

International Organisation PEPs are individuals who are, or have been, entrusted with prominent management or comparable functions within international organisations.

This may include members of senior management; directors; deputy directors; members of governing boards; and persons exercising equivalent senior functions.

Middle-ranking or junior employees would not ordinarily qualify simply because they work for an international organisation.

PEP screening extends beyond the individual public officeholder. Under the CBN Guidance, relevant family members include:

• a PEP’s spouse;

• children and their spouses;

• parents; and

• siblings.

Close associates include individuals closely connected to a PEP socially or professionally, such as:

• publicly known close personal friends;

• business colleagues;

• personal advisers; and

• persons who have joint ownership or control of a legal person or arrangement established for the benefit of a PEP.

This is important because proceeds of corruption or other illicit assets may be held, transferred or invested through people connected to a PEP rather than directly in the PEP’s own name.

This is one of the most important Nigeria-specific provisions in the CBN Guidance.

The CBN states that, given the country’s corruption-risk environment, domestic PEPs are considered highly vulnerable to financial risk and, by default, most domestic PEPs should be considered high risk. That does not mean every domestic PEP must permanently be treated in exactly the same way.

The Guidance remains risk-based.

Where a domestic or International Organisation PEP is assessed as presenting medium or lower risk, the institution may apply normal customer due-diligence and monitoring measures appropriate to that risk. Foreign PEPs and higher-risk PEPs, however, require Enhanced Due Diligence.

PEP screening should therefore not end with: “PEP: Yes.”

Financial institutions are required to obtain appropriate senior management approval before establishing a business relationship with a PEP.

Where an existing customer is subsequently identified as, or becomes, a PEP, senior management approval is required to continue the relationship.

Approval should not be treated as an administrative formality.

The relevant senior manager should understand:

• who the PEP is;

• the public function giving rise to the exposure;

• the institution’s risk assessment;

• the expected nature of the relationship;

• relevant EDD findings;

• source-of-funds and source-of-wealth considerations; and

• the controls proposed to manage the relationship.

The approval or decision should be properly documented.

Foreign PEPs and higher-risk PEP relationships require Enhanced Due Diligence. Depending on the risk, EDD measures may include:

• obtaining additional customer information;

• obtaining further identification or verification documents;

• understanding the nature and intended purpose of the relationship;

• establishing expected account activity;

• conducting additional beneficial-ownership checks;

• establishing source of funds;

• establishing source of wealth;

• conducting adverse-media searches;

• increasing the frequency of reviews; and

• applying enhanced transaction monitoring.

The level of EDD should be proportionate to the identified risk.

Source of Funds

Source of funds refers to the origin of the specific money involved in a transaction or business relationship. Examples may include:

• salary;

• business income;

• investment proceeds;

• sale of property;

• inheritance; or

• another identifiable legitimate source.

The institution should obtain sufficient information and, where appropriate, evidence to determine whether the explanation is reasonable in the context of the customer’s profile.

Source of Wealth

Source of wealth is broader. It considers how the customer accumulated their overall wealth. Examples may include wealth generated through:

• employment;

• business ownership;

• investments;

• property;

• inheritance; or

• other legitimate economic activities.

For a PEP, a substantial difference between known legitimate income and apparent wealth can be an important risk indicator requiring further investigation.

PEP compliance does not end once the account has been opened. Higher-risk PEP relationships require enhanced ongoing monitoring.

The institution should understand and document:

• why the customer is classified as a PEP;

• the position and jurisdiction giving rise to the exposure;

• the duration of the appointment;

• relationships with relevant family members or associates;

• the purpose of the account or relationship;

• expected transaction activity;

• source of funds;

• source of wealth; and

• relevant adverse information.

Transaction monitoring should then be capable of identifying activity inconsistent with those expectations.

In addition, PEP screening should be ongoing rather than a one-time onboarding exercise. A customer who is not politically exposed when the relationship begins may later:

• win an election;

• receive a political appointment;

• assume a senior public role;

• become closely associated with a PEP; or

• become a beneficial owner of a company in circumstances that create new PEP exposure.

Financial institutions should therefore maintain processes for detecting changes in PEP status. PEP accounts should also be periodically reviewed at a frequency determined by the customer’s risk profile.

A common statement is: “Once a PEP, always a PEP.”

The CBN Guidance makes clear that this is too simplistic. There is no fixed period after which a former officeholder automatically stops being treated as a PEP. Equally, a person does not necessarily need to be treated as presenting the same PEP risk for the rest of their life.

The appropriate treatment should be determined by a risk assessment rather than a prescribed time limit.

Factors to consider include:

• the seniority of the previous position;

• the level of formal or informal influence the individual continues to exercise;

• whether the previous and current roles remain connected;

• influence over successors or public decision-making;

• continuing political relationships;

• links to sectors with elevated corruption risk; and

• how politically connected the person remains after leaving office.

Where corruption or financial-crime risk remains significant, the institution may continue treating the former officeholder as a PEP.

Identifying and monitoring Politically Exposed Persons is only one part of the compliance requirement. Financial institutions regulated by the CBN are also required to render monthly returns on transactions involving PEPs to both the CBN and the Nigerian Financial Intelligence Unit (NFIU).

Therefore, an effective PEP reporting process starts well before the monthly return is due. The institution should be able to identify its PEP population accurately and ensure that transactions involving those customers can be captured throughout the reporting period.

In practice, the process should connect: PEP Identification → Customer Record → Transaction Activity → Monthly PEP Return

rather than requiring the compliance team to reconstruct the institution’s PEP activity manually at the end of every month.

The process should enable the institution to:

• maintain an accurate and current record of customers identified as PEPs;

• identify relevant accounts and relationships associated with PEP customers;

• capture transactions involving those customers during the reporting period;

• incorporate newly identified PEPs into the reporting population;

• distinguish confirmed PEPs from unresolved or false-positive screening alerts;

• validate transaction information before submission;

• review and approve the monthly return;

• submit the required report through the appropriate regulatory channel; and

• retain evidence of what was reported, when it was reported and who approved the submission.

This becomes particularly important where a customer becomes a PEP after onboarding.

If PEP screening and transaction data operate in separate systems, the institution may detect the customer’s change in status without automatically connecting that change to its regulatory-reporting process.

Monthly PEP reporting can become operationally difficult when the institution’s PEP register, customer records and transaction data sit in different systems.

Common problems can include:

• newly appointed PEPs not being added promptly to the reporting population;

• former PEP status not being reviewed appropriately;

• false-positive matches being incorrectly included;

• confirmed PEPs being missed because their status sits in a separate spreadsheet;

• beneficial-owner PEP exposure not being connected to the corporate customer;

• incomplete transaction information;

• duplicate reporting;

• manually maintained PEP registers becoming outdated; and

• weak evidence of review, approval and submission.

PEP reporting therefore depends heavily on the quality of the institution’s wider PEP screening and customer-risk process. If the institution’s PEP population is inaccurate, its regulatory reporting is also likely to be inaccurate.

Because PEP reporting is recurring, institutions should treat it as a formal compliance obligation rather than an ad hoc monthly exercise. The compliance framework should clearly establish:

• who owns preparation of the PEP return;

• who reviews the return;

• who approves submission;

• which systems provide the underlying customer and transaction information;

• how exceptions or discrepancies are resolved;

• how submission is evidenced;

• how rejected or incomplete filings are addressed; and

• how previous returns are retained.

The institution should also have a process for determining whether its PEP population changed during the reporting period.

For example:

• Did an existing customer become a PEP?

• Was an existing PEP appointed to a more senior role?

• Did a corporate customer acquire a PEP beneficial owner?

• Was a previous PEP match subsequently determined to be a false positive?

• Did new information materially change the risk classification of an existing PEP?

Embedding these checks into the compliance calendar creates accountability and reduces the risk that the monthly return depends on the memory of an individual compliance officer.

Regfyl can help institutions connect PEP identification and ongoing monitoring with the wider regulatory-reporting process.

Where a customer is identified as a PEP, that status can form part of the customer’s compliance profile rather than existing in a separate spreadsheet or manually maintained list.

This makes it easier for compliance teams to identify the institution’s PEP population, monitor changes in status and maintain visibility over transactions associated with PEP customers.

The objective is to create a connected workflow:

PEP Screening → Match Confirmation → Customer Risk Rating → Ongoing Monitoring → PEP Transaction Identification → Review → Monthly Regulatory Reporting

Connecting these processes reduces the operational burden of attempting to reconstruct PEP activity manually at the end of each reporting period and provides a clearer audit trail around how PEP-related regulatory obligations are managed.

In March 2026, the CBN issued its Baseline Standards for Automated AML/CFT/CPF Solutions.

The Standards specifically identify PEP and other high-risk profiling as a core capability expected of automated AML solutions.

For regulated financial institutions, this raises the technology expectations around PEP compliance.

Institutions should be moving beyond:

• static PEP spreadsheets;

• one-time onboarding searches;

• manually maintained lists;

• screening systems disconnected from customer risk assessment;

• manual periodic reviews; and

• investigation processes that cannot produce a clear audit trail.

An effective automated environment should support:

Customer Identification → PEP Screening → Match Resolution → Risk Profiling → EDD → Ongoing Monitoring → Investigation → Regulatory Reporting

The CBN’s Baseline Standards do not eliminate the need for human judgement. Rather, they increase the expectation that technology should enable institutions to apply those judgements consistently, efficiently and with appropriate evidence.

A mature PEP programme should enable the institution to answer questions such as:

• Can we reliably identify domestic, foreign and International Organisation PEPs?

• Can we identify PEP exposure behind corporate customers?

• Can we screen beneficial owners?

• Can we identify relevant family members and close associates?

• Can we distinguish a genuine PEP from a false-positive name match?

• Are domestic PEPs appropriately risk assessed?

• Are foreign and higher-risk PEPs subject to appropriate EDD?

• Is senior management approval obtained and documented?

• Can we establish and evidence source of funds and source of wealth?

• Can we identify when an existing customer becomes a PEP?

• Are PEP relationships periodically reviewed according to risk?

• Can our monitoring identify transactions inconsistent with the customer’s profile?

• Are monthly PEP returns being filed?

• Can suspicious PEP activity be escalated into the STR process?

• Can we demonstrate the complete decision trail to the CBN?

If these processes operate across spreadsheets, emails, manual internet searches and disconnected compliance systems, consistently managing PEP risk becomes significantly more difficult.

Regfyl helps financial institutions connect PEP screening with the wider customer due-diligence and financial-crime compliance lifecycle.

PEP Screening at Onboarding

Regfyl enables institutions to screen customers for PEP exposure as part of the onboarding process, alongside sanctions and adverse-media screening.

This helps identify relevant exposure before or during establishment of the customer relationship rather than through a separate manual process.

Nigerian PEP Coverage

Domestic PEP coverage is particularly important for Nigerian financial institutions.

Regfyl supports screening for Nigerian political and public officeholders, helping institutions address the local PEP exposure that may not always be captured adequately by international datasets.

Ongoing PEP Monitoring

PEP status can change after onboarding.

Regfyl supports ongoing monitoring so institutions can identify where an existing customer subsequently becomes politically exposed or where new information changes the customer’s risk profile.

Beneficial Owner Screening

For corporate customers, Regfyl’s KYB and beneficial-ownership capabilities can help identify the natural persons behind the entity and screen relevant directors, shareholders and ultimate beneficial owners for PEP exposure.

This helps connect: KYB → UBO Identification → PEP Screening, rather than treating them as separate compliance exercises.

Sanctions and Adverse-Media Screening

PEP status should not be assessed in isolation. Regfyl also supports sanctions and adverse-media screening, giving compliance teams additional context when evaluating the overall risk associated with a PEP relationship.

Customer Risk Rating

PEP screening outcomes can feed into the institution’s customer risk-rating methodology. PEP exposure can therefore be assessed alongside factors such as:

• geography;

• occupation or business;

• products used;

• ownership;

• transaction behaviour; and

• other financial-crime risk indicators.

Investigation and Case Management

Where screening or ongoing activity requires additional review, Regfyl supports structured investigation workflows incorporating:

• investigation notes;

• supporting documents;

• escalation;

• review;

• approvals;

• case disposition; and

• audit trails.

This helps institutions move from a screening alert to a documented compliance decision.

Connected Financial-Crime Compliance

The broader objective is to connect:

KYC/KYB → Beneficial Ownership → PEP Screening → Customer Risk Rating → EDD → Ongoing Monitoring → Investigation → Regulatory Reporting

within a more integrated compliance environment.

Technology can make this process faster, more consistent and more auditable.

The financial institution nevertheless remains responsible for its risk classification, due-diligence measures, management decisions and regulatory obligations.

PEP screening can no longer be reduced to searching a customer’s name against a list during onboarding.

An effective programme needs to identify the people behind corporate customers, establish whether PEP exposure exists, resolve possible matches, assess the specific risk, obtain appropriate approvals, understand source of funds and source of wealth where required, monitor the relationship over time and maintain evidence of every material decision.

For Nigerian financial institutions, the CBN’s PEP Guidance and the 2026 Baseline Standards make the direction increasingly clear:

PEP screening needs to be risk-based, continuous, connected to the wider customer profile and supported by effective technology and human judgement.

See how Regfyl can support PEP screening, beneficial-owner screening, customer risk assessment and ongoing monitoring.

See Regfyl PEP Screening in Action