On the Isle of Man, enhanced customer due diligence (ECDD) is mandatory under Code para 15 whenever your Customer Risk Assessment rates a customer higher risk — but a customer being a politically exposed person (PEP) does not automatically make them higher risk, and does not automatically trigger ECDD. PEP status triggers a separate set of measures under Code para 14. Whether ECDD applies is a distinct question, decided by the risk rating.

That distinction is the single most misunderstood point in this area, and it is where the Authority's own review found firms going wrong. The Foreign PEP Thematic Report the Isle of Man Financial Services Authority published in May 2023 inspected real files and found that "almost all of the firms inspected have further work to do in order to meet the requirements of the Code" (Executive Summary, p.6). What follows is the framework the Code sets out, and the failings the regulator documented against it.

Who actually counts as a PEP

The most dangerous assumption a firm can make is "we don't have any PEPs, so this doesn't apply to us." It rarely holds. Code para 3 (pp.9–10) defines a PEP as a natural person entrusted with prominent public functions — heads of state and government, ministers, senior government officials, members of parliament and senior politicians, senior judicial officials, central-bank and court-of-auditors board members, ambassadors, high-ranking armed-forces officers, senior members of state-owned enterprises, and senior members of the governing bodies of international organisations. That is a wider net than most people picture when they hear the word "politician."

It gets wider. The same paragraph brings in family members — the PEP's spouse or partner, their children and those children's spouses or partners, their siblings and their siblings' spouses or partners, their parents, parents-in-law, grandparents and grandchildren. It also brings in close associates: a joint beneficial owner or someone in a close business relationship with the PEP, the sole beneficial owner of a structure set up for the PEP's benefit, a beneficiary of the PEP's legal arrangement, or a person able to conduct substantial financial transactions on the PEP's behalf. A customer who is none of these today can become one tomorrow, mid-relationship, and your monitoring has to catch that.

One further split changes which obligations bite. Code para 14(7) (p.26) distinguishes a domestic PEP, who holds prominent public functions in the Island, from a foreign PEP, who holds them outside it — though family members and close associates count regardless of location. That line is not cosmetic: it decides what you are required to do.

PEP status does not automatically mean ECDD

Here is the point the Handbook is at pains to make and firms most often miss. The PEP measures in Code para 14(2)–(4) apply to all foreign PEPs and to higher-risk domestic PEPs. ECDD under Code para 15 is a separate obligation, triggered only once your Customer Risk Assessment rates the customer higher risk. Handbook §3.8.10 (p.144) sets this out, and the summary table at §3.8.11.1 (p.149) makes the four possible combinations explicit:

• A higher-risk domestic PEP attracts both ECDD and the para 14 PEP measures.
• A standard-risk domestic PEP attracts neither.
• A higher-risk foreign PEP attracts both.
• A standard-risk foreign PEP attracts the para 14 PEP measures — but not ECDD.

That last line catches firms out in both directions. A standard-risk foreign PEP still needs senior-management approval, a source-of-wealth exercise and enhanced ongoing monitoring — but does not automatically need the full ECDD package. Equally, a domestic PEP your CRA rates as standard risk needs neither. Treating "PEP" as a single switch that turns on ECDD is not what the Code says, and it produces both under-compliance and wasted effort.

Getting this mapping right depends on the quality of the risk rating beneath it, which is why the Customer Risk Assessment is the load-bearing document here — it is the CRA, not the PEP label on its own, that decides whether ECDD is engaged.

We help Isle of Man firms build the PEP decision into their CRA so the right measures follow automatically from the rating.

What the para 14 PEP measures actually require

Where a PEP is a foreign PEP, or a higher-risk domestic PEP, Code para 14(2)–(4) (pp.25–26) sets three requirements. First, senior-management approval must be obtained before establishing or continuing the relationship — recorded, and given before the business goes ahead, not a rubber stamp applied afterwards. Second, you must take reasonable measures to establish the source of wealth. Third, you must apply enhanced ongoing monitoring. And para 14(6) is unambiguous about failure: if these requirements are not met within a reasonable time, you must proceed no further, consider terminating the relationship, and consider whether an internal disclosure is warranted.

The word "wealth" in that second requirement is not interchangeable with "funds." Source of funds — where the money in a particular transaction came from — applies to every customer relationship. Source of wealth — how the customer's overall wealth was accumulated — begins at a higher-risk threshold and is mandatory for foreign PEP customers, as the Handbook §3.8 explains and the Thematic report quotes at p.15. A satisfactory source-of-funds picture tells you nothing about whether the wealth behind those funds is legitimate, and for a foreign PEP the second question is the one the Code requires you to answer.

How much ECDD is enough

When the CRA does rate a customer higher risk, ECDD becomes mandatory. Code para 15(3) (p.26) makes it compulsory where the CRA assesses higher ML/FT risk, where there is any unusual activity, or where there is any suspicious activity — the only carve-out being where doing the ECDD would tip off the customer. Para 15(2) (p.26) then describes what ECDD contains: additional identification information; verifying additional aspects of the customer's identity through reliable, independent sources; reasonable measures to establish source of wealth; further background research; and additional ongoing monitoring. "Enough" ECDD is not a word count — it is these measures, applied and evidenced, proportionate to the risk the CRA identified.

The Code separates two higher-risk tiers, and the difference matters for how you treat a PEP. Para 15(5) (p.27) sets a mandatory tier: a customer resident or located in a List A jurisdiction, or subject to another jurisdiction's AML/CFT warning, is higher risk as a matter of Code, and para 15(6) requires senior management to approve the relationship. Para 15(7) (p.27) sets a risk-assessed tier of matters that may pose higher risk — including List B jurisdictions, nominee or bearer shares, high-risk products, high-net-worth individuals, legal arrangements, non-face-to-face relationships, and, expressly at para 15(7)(e), a relationship with a PEP. That a PEP relationship sits in the "may pose higher risk" tier — a factor to weigh, not an automatic verdict — is precisely why paras 14 and 15 come apart. The lists themselves are defined in Code para 3 (p.8) and maintained by the Department of Home Affairs: List A covers jurisdictions subject to a FATF call for countermeasures, List B strategic AML/CFT deficiencies or possible higher risk, and List C regimes of a standard equivalent to the Island's.

One related concept is worth knowing so you do not misfile it as a PEP. Handbook §3.8.13 (pp.150–151) formalises the commercially exposed person (CEP): a natural person who, through their position or activity, may face increased exposure to bribery, corruption, fraud, money laundering, terrorist financing or proliferation financing. The two-part test is that they are associated through their occupation with a higher-corruption-risk industry and hold decision-making power, influence or ultimate effective control — so the CEO of a large development company is typically a CEP, while a local sole trader in the same trade is not. Like a PEP, a CEP is a factor for the CRA, not an automatic higher-risk verdict.

The person who has to hold all of this together is the MLRO, whose oversight turns these separate requirements into a defensible position rather than a set of forms.

Common mistakes we see

We do not have to speculate about the errors, because the Authority documented them. Its Foreign PEP Thematic Report — an exercise that ran from 2021 to 2023, gathered questionnaire data from 91 firms in Phase 1, inspected 29 firms in Phase 2, and looked across a population of more than 10,000 unique foreign PEPs — found, in the CEO's foreword (p.3), that "overall a significant number of contraventions were identified across firms," clustered specifically in Code paras 14 and 15 (p.11).

The most common failing was confusing source of funds with source of wealth, with the result that no genuine source-of-wealth exercise was carried out for PEPs at all (p.19) — the exact trap described above. Close behind was missing senior-management approval (p.19), the para 14(2) requirement simply not evidenced. The regulator also found firms onboarding higher-risk PEPs against their own stated risk appetite (pp.16, 19) — a policy on paper contradicted by the book of business. On monitoring, it found firms applying the same monitoring to every customer, foreign PEPs included, never revisiting source of funds or source of wealth over time, and failing to spot customers who had become PEPs after onboarding (p.19). And it recorded a firm rule worth committing to memory: "the Code does not permit deferral of undertaking ECDD, it must be undertaken at the time it is identified as being required" (p.20). ECDD you have identified as necessary but scheduled for "later" is a contravention now, not a task in progress.

We review PEP files against the same paras the Authority inspected, and rebuild the ones that would not survive a visit.

Frequently asked questions

Does every PEP require enhanced due diligence?

No. ECDD under Code para 15 is triggered by a higher-risk rating in your Customer Risk Assessment, not by PEP status itself. A relationship with a PEP is listed at para 15(7)(e) as a matter that may pose higher risk — a factor to weigh, not an automatic verdict. What every foreign PEP and every higher-risk domestic PEP does require is the separate set of measures in Code para 14: senior-management approval, source of wealth, and enhanced ongoing monitoring.

Is source of wealth the same as source of funds?

No, and treating them as interchangeable was the single most common failing the Foreign PEP Thematic Report identified. Source of funds concerns where the money in a specific transaction came from and applies to all customers. Source of wealth concerns how the customer's overall wealth was built, begins at a higher-risk threshold, and is mandatory for foreign PEP customers. A clean source-of-funds picture does not answer the source-of-wealth question.

We do not think we have any PEPs — does this still apply?

Very likely, yes. The Code's PEP definition reaches family members and close associates as well as the office-holders themselves, and foreign PEPs are included regardless of location. A customer can also become a PEP after onboarding — one of the gaps the regulator specifically flagged. The honest answer is usually not "we have none" but "we have not screened thoroughly enough to be sure."

Does introducer reliance move these obligations off our desk?

No. Where you rely on another party's due diligence for a PEP relationship, the obligation to evidence source of wealth, senior-management approval and enhanced monitoring still rests with you — reliance shifts the work, not the accountability, a point we cover in our note on introducer reliance and the Handbook update. Confirm what the introducer actually holds before you lean on it.

The lesson from the Authority's own files is a narrow one: a PEP on your book is not the problem — a PEP whose source of wealth, approval and monitoring you cannot evidence, para by para, is.