How should financial institutions monitor relatives and close associates of politically exposed persons without creating unnecessary friction for legitimate customers?

Financial institutions should use a risk based approach. Start by identifying the relationship to the PEP, then assess transaction patterns, business complexity, geography, and source of funds. Apply enhanced due diligence when exposure is higher, and document why the relationship is being monitored. The goal is not to block legitimate activity, but to spot unusual movement early and keep controls proportionate to the actual risk.

Why the monitoring should be risk based, not blanket surveillance

The right approach is to monitor the relationship, not to treat every relative or close associate of a politically exposed person as equally risky. That means starting with the PEP connection, then looking for factors that materially raise exposure, such as transaction behaviour, complexity, geography, and source of funds. This keeps the control proportionate and helps avoid turning a legitimate customer segment into a false-positive queue.

Risk sensitivity matters because the same relationship can be low concern in one case and highly exposed in another. A close associate with ordinary salary-funded activity is not the same as an associate with layered ownership, cross-border flows, or unexplained wealth signals. Monitoring should therefore be calibrated to the actual profile, not just the label attached to the customer.

What should be monitored, and what should not trigger automatic escalation

Useful monitoring focuses on behaviour that does not fit the expected profile: unusual velocity, large or frequent transfers, counterparty changes, movements through higher-risk jurisdictions, inconsistent account usage, and activity that conflicts with known business purpose. The point is to detect patterns that deserve review, not to flag every relationship simply because the person knows a PEP.

That distinction is important for customer experience. If institutions rely on static lists or broad relationship screening alone, they create friction without improving detection quality. Better monitoring uses documented expectations, compares activity to those expectations, and escalates only when the pattern is meaningfully unusual or the source of funds cannot support the activity.

How to keep the control proportionate and defensible

Proportionality comes from documenting the rationale for monitoring, setting a clear escalation threshold, and separating review cases from routine cases. Institutions should be able to explain why a case was monitored, what factors increased the risk score, and what evidence supported the decision to apply enhanced due diligence. That record is what makes the control auditable rather than ad hoc.

For AML teams, the practical aim is to reduce unnecessary intervention while preserving the ability to act early when real exposure emerges. A well-run program distinguishes relationship risk from transactional risk, applies additional scrutiny only where needed, and allows legitimate customers to move through ordinary activity without repeated manual challenge.

Risk and Threat Considerations

PEP-adjacent relationships are attractive because they can be used to obscure beneficial influence, move funds through intermediaries, or give a higher-risk actor indirect access to the financial system. The main risk is not the relationship itself, but the possibility that it masks unexplained wealth, layering, or coordinated activity that would be harder to see if the institution monitors only the named customer.

Failure mechanism: Broad-brush monitoring or weak documentation causes institutions either to miss meaningful escalation signals or to generate so many false positives that analysts stop treating alerts seriously.

Impact: The institution can miss suspicious activity, waste investigative capacity, and create avoidable customer friction that undermines trust and slows legitimate business.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AU-6 — Audit Review, Analysis, and Reporting	Monitoring PEP-adjacent activity depends on review of unusual transactions and alert triage.
Recommendation — Tune alert review to escalate only materially unusual activity and retain audit evidence for case decisions.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities are Identified and Documented	Risk-based monitoring relies on identifying customer and transaction risk factors.
Recommendation — Document the risk factors that justify enhanced monitoring for each customer relationship.
ISO/IEC 27001:2022	A.5.18 — Access rights	Proportionate monitoring supports governance over who can move funds and under what conditions.
Recommendation — Define and review approval thresholds so elevated scrutiny is applied only when risk warrants it.
CIS Controls v8	CIS-5 — Account Management	The topic centers on governance of customer relationships and exceptions rather than blanket treatment.
Recommendation — Maintain current customer relationship records so monitoring rules reflect the actual risk context.
GDPR	A.5 — Article 5 Principles relating to processing of personal data	Monitoring close associates requires proportionality and purpose limitation in handling personal data.
Recommendation — Limit monitoring data to what is necessary for AML risk assessment and keep processing proportionate.

Practitioner Guidance

What to verify: Confirm that the relationship to the PEP is actually relevant to the customer’s activity profile, then verify whether the observed transactions are consistent with stated occupation, business purpose, and source of funds. If those elements line up, keep the case in routine review rather than pushing it into repeated escalation.

Decision rule: If the customer’s activity is explainable, proportionate to profile, and locally consistent, monitor at a lower intensity; if the relationship is paired with unexplained wealth, opaque ownership, or cross-border movement that lacks a credible source of funds, escalate to enhanced due diligence.

Practitioner takeaway: The best control is one that can justify itself case by case, because proportionate monitoring protects the institution without turning legitimate relationship-based banking into unnecessary friction.