PEP Screening in Germany: Requirements under the GwG

German obliged entities must use appropriate risk-based procedures to establish whether a customer or beneficial owner is a politically exposed person (PEP), a family member or a known close associate. A confirmed case brings enhanced due diligence: approval, measures to establish the origin of assets used and enhanced ongoing monitoring. A matching name alone does not establish that status.¹²

This guide explains the German Geldwäschegesetz (GwG), checked on 20 October 2026. It covers the legal assessment and practical review process; the PEP screening product page explains how Checklynx presents information for that review.

Which businesses and people are in scope?

Section 2 GwG defines obliged entities, including financial-sector businesses and specified non-financial activities. Professional scope, transaction conditions and exceptions matter: an entity's inclusion does not mean every activity has identical duties. Section 10 sets the occasions for customer due diligence and includes the PEP assessment of the customer and beneficial owner.³¹

For a corporate customer, identify the relevant beneficial owners and assess those people. Checking the company name alone does not answer their PEP status. The beneficial-owner and related-party screening guide explains how to organise that population.

Use the guidance of the competent supervisor for the firm's sector. Section 50 allocates supervisory responsibility; BaFin guidance must not be treated as guidance for every German obliged entity.⁴

Who qualifies as a PEP, family member or close associate?

Section 1(12) concerns prominent public offices at international, European and national level, and subnational offices of comparable political importance. Its examples include ministers, parliamentarians, senior party bodies, specified senior judicial and public-sector leadership roles. Check the actual function against the statutory categories; an official-sounding title is insufficient.⁵

Domestic office is not a general exemption from the German PEP framework. Nor should a local office automatically be equated with a qualifying prominent function.

The related categories require their own assessment:

• Family members: Section 1(13) includes spouses or registered partners, children and their spouses or registered partners, and parents.
• Known close associates: Section 1(14) covers defined connections, including joint beneficial ownership, other close business relationships and certain structures established for a PEP's benefit. It is not a label for every acquaintance.

A family member or close associate need not hold public office personally. Record the relevant category instead of describing every connected person as an officeholder.⁵

Separate the legal PEP category from company risk policy

The GwG defines when the statutory PEP rules apply. The company also needs its own assessment of the relationship, taking account of factors such as country exposure, ownership, products and expected transactions. Other higher-risk circumstances can require enhanced measures under Section 15(2), even where the person is not a PEP.²

Internal policy can set broader screening criteria, additional checks, approval levels and risk appetite. Keep the reason for each measure clear: a statutory PEP obligation, another applicable requirement or the company's own policy. An internal risk label does not change the statutory PEP definition, and internal policy cannot waive applicable legal minimums.

For example, a company may review local officials because of their influence over public contracts, even where the particular office does not qualify under Section 1(12). Record that as a review under the company's risk criteria unless the legal PEP category is also established. Equally, confirming PEP status does not decide whether the company will accept the relationship: that decision also depends on the facts, required measures and its risk appetite.⁵

Broader screening also needs an appropriate basis for processing personal data. See GDPR in sanctions and PEP screening for the distinction between a legal duty, internal policy and lawful processing.

Turn a candidate into an explained decision

A practical review can follow these steps. The suggested record fields support the assessment; they are not a separate statutory checklist.

1. Collect the relevant identity information. Establish the customer and beneficial owners before reviewing screening candidates.
2. Compare the candidate. Use available dates, locations, roles and source evidence. Missing or conflicting information needs investigation; a single data point should not decide the case.
3. Verify the office or relationship. Identify the qualifying role, period in office or relevant family/business connection.
4. Apply the German category. Record whether the evidence supports PEP, family-member or known-close-associate treatment, or why the candidate is a different person.
5. Assign measures and responsibility. Connect the finding to approval, asset-origin enquiries and ongoing monitoring.

Keep unresolved cases visible to the responsible reviewer. A software score or a dismissed name candidate does not replace the wider customer-risk assessment.

What changes when the status is confirmed?

Section 15(3)(1) identifies PEP, family-member and known-close-associate cases as higher risk. The extent of the measures is risk-based, but the minimum measures in Section 15(4) are not optional merely because an individual relationship appears straightforward.²

Section 1(15) defines the relevant senior-management role; it does not necessarily require a board member. Use the statutory asset-origin requirement accurately, and distinguish any broader wealth enquiries required by applicable supervisory guidance or the firm's risk assessment.⁵²

If a relevant person takes office during the relationship, or the firm learns of the office later, Section 15(4), sentence 2 requires senior-management approval for continuation. Reassess the record and measures rather than treating the original onboarding result as permanent clearance.²

Former PEPs: twelve months is not automatic clearance

Under Section 15(4), sentence 3, the firm must consider the specific PEP risk for at least twelve months after the person leaves office. Appropriate risk-based measures continue until it can be assumed that this risk no longer exists. Do not turn the anniversary into an automatic status removal or a promise that all measures end then.²

Record the departure date, relevant continuing influence and reasons for retaining or changing measures. This is an assessment of the facts, not simply a database expiry date.

What should the record explain?

Section 8 requires records of information gathered through due diligence and sufficient information about risk assessment and the appropriateness of measures. For a PEP case, a useful file connects identity evidence, role or relationship, sources, reasoning, approval and follow-up responsibility.⁶

A practical record also states what was missing and how it was resolved. A screenshot saying “PEP match” cannot explain the office, identity decision or approval on its own.

Section 8(4) generally requires five-year retention, subject to longer statutory requirements, and provides for destruction after ten years at the latest. For the relationship case in Section 10(3), sentence 1, point 1, the clock starts at the end of the calendar year in which the relationship ends. In other cases it starts at the end of the year in which the relevant information was established. Apply the correct category and trigger; do not describe this as a free choice between five and ten years.⁶

Three fictional review examples

A similar name with conflicting identifiers

A customer shares a former minister's name, but the available birth information conflicts. The reviewer checks the reliability of both records and seeks further identifiers where needed. Record why the candidate is a different person, or leave the identity question unresolved for further investigation. A nationality difference alone is not conclusive.

A beneficial owner related to a minister

A company's beneficial owner is the spouse of a serving minister. Establish the identity, qualifying office and relationship, then apply the family-member category and required enhanced measures. A small expected transaction does not by itself remove those minimum measures. Approval depends on the completed assessment, not the example's outcome.

An officeholder left eight months ago

A beneficial owner left a qualifying office eight months earlier. Record the actual departure date and assess continuing PEP-specific risk. The minimum twelve-month period has not elapsed; reaching month twelve later will still require an assessment rather than automatic clearance.

Evaluate PEP screening software against the review work

Test relevant countries, roles and relationships with cases the team understands. Ask how source evidence, missing fields, corrections and changes in office are handled. Available birth information, roles and relationships should help compare identity; none is a universal unique identifier.

Checklynx groups source results into profiles and presents enriched, structured information for review. Test whether that context helps the team distinguish candidates and explain decisions in its own workflow. Do not assume every profile has every field or that a clear screening result completes customer due diligence.

Compare the PEP screening software with these requirements and use the PEP software buyer guide for the wider evaluation.

Frequently asked questions

Does PEP status mean someone is sanctioned or has committed a crime?

No. Public office or a relevant relationship does not establish criminal conduct or a sanctions designation. A person can separately be subject to sanctions, so assess those restrictions independently. PEP status alone is not a general prohibition on the relationship.

Must every German business buy a PEP database?

No universal vendor or database mandate follows from Section 10(1)(4). Obliged entities need appropriate risk-based procedures within their applicable scope. Whether a commercial service fits depends on the population, evidence and repeat-review needs.¹

Must every PEP check run daily?

Section 10 requires risk-appropriate updating and reviews of existing relationships at appropriate times, including relevant changes. It does not set a universal daily PEP screening schedule. Apply relevant supervisory expectations and the firm's documented risk-based arrangements.¹

Are all mayors and their spouses automatically covered?

Do not assume that. Assess the office against Section 1(12), including the comparable political importance condition for subnational roles. Only then assess the relevant family connection. A generic “mayor” example cannot establish the legal category.⁵