PEP and Sanctions Screening at Account Opening
PEP and sanctions screening at account opening — who must be screened, how declarations fit the onboarding flow, and how to handle a hit without stalling good customers.
Screening for politically exposed persons (PEPs) and sanctioned parties is one of the few onboarding controls a bank cannot defer to "later". A sanctioned entity or individual must never receive a live account, and a PEP relationship carries obligations that begin the moment you accept the application. For a business account this is harder than it sounds, because the risk is not concentrated in one person. It is spread across the entity, its directors, its authorised signatories, and the individuals who ultimately own or control it. This article explains who must be screened at account opening, how PEP and FATCA declarations sit alongside the screening, and how to route a potential hit into review rather than rejecting a good customer by reflex. It also shows where the Creodata Bank Account Opening System (BAOS) fits: it works out who needs screening and lists them on the application, while the screening itself runs in a dedicated screening tool.
Why screening belongs at onboarding, not after it
The Central Bank of Kenya's prudential guidance on account opening, together with the Financial Reporting Centre's AML expectations and the broader FATF and ESAAMLG framework, all point in the same direction: you must know who you are dealing with before you open the relationship, and you must understand the risk they carry. Sanctions screening is the clearest case. Onboarding a party who appears on a sanctions list is not a graded risk you manage over time; it is a line you do not cross. PEP screening is more nuanced. A PEP is not a prohibited customer, but the relationship attracts heightened scrutiny, senior sign-off, and a closer look at source of funds and wealth.
Doing this at the point of application has two advantages. First, it stops a high-risk relationship before money moves, when the bank still has full discretion. Second, it captures the screening as a dated, attributable event in the onboarding record, which is exactly what an examiner expects to see. Screening that happens informally, after the account is already transacting, is far harder to evidence. For the wider onboarding picture this sits within, see the complete guide to business account opening, and for how screening connects to the broader due-diligence discipline, the article on customer due diligence for business accounts.
Who and what to screen for a business account
A natural mistake is to screen only the applicant who happens to be filling in the form. For a corporate or business account, the screening surface is wider. You are assessing several distinct parties, and a clean result on one tells you nothing about the others.
| Party | Why they are screened |
|---|---|
| The entity itself | The company can appear on sanctions or watch lists in its own right. |
| Directors | They direct the entity and may be PEPs or connected to one. |
| Authorised signatories | They can operate the account, so their standing matters directly. |
| Beneficial owners / significant stakeholders | The individuals who ultimately own or control the entity carry the real risk. |
The same logic carries over to other kinds of account: on a group or chama account, every member and official; on a joint account, every holder; on a personal account, the applicant. One person can appear in two roles — a director who is also a signatory — and should be screened once, not twice or not at all.
BAOS structures the application so this surface is captured cleanly rather than left to a reviewer to reconstruct. The compliance step records PEP and FATCA declarations and gathers the significant stakeholders — directors, shareholders, partners, or the sole proprietor — as named individuals. A separate step captures up to four authorised signatories with identification and a passport photo. From those records, BAOS works out every person who needs screening — directors, beneficial owners and signatories, and on group and joint applications every member and holder — once each, even when one person holds two roles, and lists them on the application for your compliance team. The screening itself runs in your screening tool, and because each party is a discrete, structured record rather than a free-text note buried in a PDF, your team screens exactly the right names. Identifying who those owners and controllers actually are is its own discipline; the article on beneficial ownership and significant stakeholders at onboarding covers it in depth, and the practical mechanics of distinguishing a list match from a false positive are handled in the AML cluster's piece on sanctions and PEP screening explained.
How declarations and checks fit the BAOS flow
In the nine-step BAOS application wizard, the information screening needs does not arrive as a bolt-on. It is part of the structured data the applicant already provides. The compliance step asks the applicant to make a PEP declaration and a FATCA declaration, and to list the significant stakeholders behind the entity. These declarations matter for two reasons. They put the applicant on record, which has weight if a false answer later surfaces, and they give the bank an explicit signal to test rather than infer.
From those records, BAOS derives the list of people your compliance team must screen. The application auto-saves to a draft between steps, so the data needed for screening accumulates as the applicant progresses rather than arriving in one undifferentiated submission at the end. By the time the application reaches the bank, the entity, its directors, its signatories, and its beneficial owners are all present as structured records ready to be screened.
A point worth stating plainly: BAOS does not screen anyone. It captures the PEP and FATCA declarations and works out who needs screening; the screening itself — matching names against sanctions and PEP lists and clearing false positives — runs in your screening tool, and which tool and which list data to use is the bank's decision. Creodata's own sanctions and PEP screening module is one option, with fuzzy, multi-script name matching, versioned lists and a false-positive workflow; it is a separate product, and BAOS does not pass names to it automatically. FATCA and CRS classification, which the declaration captures, is a related but separate obligation explained in the article on FATCA and CRS for business accounts.
Handling a hit without rejecting good customers
The hardest part of screening is not catching the genuine match. It is dealing with the far larger volume of possible matches — the common name, the partial overlap, the PEP who is a customer the bank is perfectly entitled to serve. A system that auto-rejects on any signal will turn away legitimate businesses and bury the real risks in noise. A system that waves everything through defeats the control entirely. The right answer is a graded one: a potential hit should pause the application and route it to a human, not terminate it.
In practice, a flagged result should not auto-reject the applicant. A compliance officer assesses the match in the screening tool, decides whether it is a false positive, and determines whether the relationship can proceed, proceed with conditions, or be declined. BAOS never rejects an application on its own: a reviewer claims the application, verifies documents and approves or rejects it, or emails the applicant for more information. Approval in BAOS does not wait for screening, so your procedure should make sure the screening is cleared before the reviewer approves. SLA timers run on the workflow steps and a dashboard shows average time per step, so slow applications are visible rather than lost in an inbox. Branch-scoped roles mean a reviewer at a branch sees only that branch's applications, and applicants get an email at each key step. Every workflow action is recorded with who did it, in which role, when and from which address and device, and reviewer decisions keep their comments, which is what turns a judgement call into defensible evidence. The audit dimension is explored further in building an audit-ready onboarding trail, and the discipline of separating the decision from the person who made it in the AML cluster's piece on audit-ready AML and four-eyes review.
Screening is a moment; monitoring is a programme
Screening at onboarding is a snapshot. It tells you the standing of the parties on the day the account is opened. People become PEPs, entities are added to lists, and ownership changes, none of which the onboarding screen can anticipate. A sound programme treats account opening as the first screening event in a relationship that will be screened again and again over its life.
BAOS covers the onboarding record: the declarations, the list of people to screen, the review, and the decision to open or decline. The screening itself, and ongoing screening of the customer base after the account is live, belong to a screening tool and a monitoring programme, which is the remit of the Creodata AML compliance software rather than the account-opening system. The clean separation matters — onboarding controls and continuous monitoring are different disciplines with different data and different cadences. How that monitoring programme should be structured, and how risk drives the depth of review, is set out in the complete AML platform guide and the article on the risk-based approach to AML. Treating the two as a continuum — a strong onboarding screen feeding a disciplined monitoring programme — is what keeps a bank's exposure under control over time.
Frequently asked questions
Does a PEP match automatically block a business account from being opened?
No. A PEP is not a prohibited customer, and a potential match should not auto-reject the application. A potential PEP hit should pause the application while a compliance officer assesses it in the screening tool. The relationship may proceed, proceed with added conditions and senior sign-off, or be declined. BAOS never rejects an application on its own: the decision is the reviewer's, recorded with their comments, so the bank can evidence the judgement later if asked.
Who must be screened on a corporate application — just the applicant?
Not just the applicant. For a business account the screening surface covers the entity itself, its directors, its authorised signatories, and its beneficial owners or significant stakeholders. BAOS captures each of these people as a structured record during the application — the compliance step gathers the significant stakeholders and the PEP and FATCA declarations, while a separate step records up to four authorised signatories with identification — and lists every one of them on the application, once each even when one person holds two roles, for your compliance team. The screening itself runs in your screening tool.
Does BAOS perform the screening itself, and does it monitor customers after the account opens?
No to both. BAOS captures the PEP and FATCA declarations and works out who needs screening, but it does not search sanctions or PEP lists or record screening results: the screening runs in your screening tool, such as Creodata's sanctions and PEP screening module, a separate product to which BAOS does not pass names automatically. Ongoing screening after the account is live is a monitoring programme rather than an onboarding control, and that belongs to the Creodata AML Compliance Platform rather than the account-opening system.
Screening done well protects the bank without punishing legitimate customers, and that balance comes from structure: capturing every relevant party cleanly, screening each of them in a tool built for matching, and routing the hard cases to a person rather than a rejection. See how Creodata BAOS works out who needs screening on the Bank Account Opening System product page, see how matching and false-positive review work in Creodata's sanctions and PEP screening module, or book a demo to walk through the compliance step and the review workflow with our team.
