Sanctions and PEP Screening for UK Forex Brokers

A forex broker can open an account for one person, receive money from another and later be asked to send a withdrawal to a different recipient. Sanctions and PEP screening needs to follow those relationships. Checking only the account holder's name at registration leaves the funding and withdrawal teams with unanswered questions.

This guide focuses on UK-authorised retail forex and contracts-for-difference (CFD) brokers. It explains how to connect supplied customer, ownership and payment information with screening, review and approval. A currency-exchange business, remittance provider or institutional FX desk needs its own assessment of activities and applicable rules.

Start with the broker's activities and legal scope

The label “forex broker” does not establish every applicable obligation. Identify the legal entity, permissions, services, customer population and countries involved. The Money Laundering Regulations 2017 (MLRs) apply to relevant persons acting in the course of business in the UK; Regulations 8 and 10 establish the relevant-person and financial-institution perimeter.¹ Do not assume that FCA authorisation alone answers every scope question.

For an in-scope broker, Regulation 28 covers customer due diligence, including beneficial ownership, persons acting for a customer and ongoing monitoring. Regulation 35 addresses PEPs, their family members and known close associates.²³ UK financial sanctions are a separate framework: they apply within UK territory and to UK persons abroad, whether or not a business falls within the MLR perimeter.⁴

Retail leveraged FX/CFD brokerage is not interchangeable with changing currency or transferring money. The remittance screening guide addresses a payment-focused relationship; the investment-management guide addresses investors, mandates and fund events. Neither replaces a broker's account-funding and withdrawal process.

Who should enter the screening process?

Start with information collected through the firm's customer and business-partner procedures. Screen the relevant supplied records under the applicable framework and documented policy. Identifying or verifying a party and checking that party against risk sources are distinct tasks.

The table below is a recommended operating model, not a universal statutory list. It helps the broker assign checks and review responsibility. FCA guidance supports screening systems suited to the nature, size and risk of the business, including appropriate customer, counterparty and payment controls.⁵

A director is not automatically a beneficial owner. An introducer's entire staff is not automatically the screening population. Define relevant roles and the reasons for checking them. The UBO and related-party guide explains the handoff from established ownership information to screening.

Account opening: separate identity, screening and acceptance

For an individual account, retain the supplied identity and enough relevant context to assess candidates. For a joint account, preserve separate records for each holder. For a corporate customer, connect the company with the people identified through the due-diligence process.

Compare available names, aliases, dates of birth, registration details and other relevant identifiers with the selected source records. A name result is not identity verification. A clear company-name search also does not resolve whether an unlisted entity is owned or controlled by a designated person.⁴

Keep three decisions visible: whether identity and authority have been established, what the screening result means, and who can approve the relationship. A missing identifier, unresolved ownership question or possible match needs an assigned next step rather than a generic “passed” label.

Deposits, withdrawals and changed instructions

A deposit from a different person can raise questions about the payer's relationship to the customer and the firm's third-party funding policy. Screening the payer can support the relevant control, but it does not establish the source of funds or prove the customer is entitled to use them.

For a withdrawal, connect the recipient with the customer's entitlement and verify changed instructions through the approved process. If the policy prohibits third-party withdrawals, another name check does not override that policy. If a sanctions issue arises, switching to a different recipient or returning funds is not an automatic solution.

These are control-design checkpoints. They are not a claim that UK payment-services rules impose a universal name/IBAN matching requirement on forex brokers. Checking a person against sanctions sources is also different from verifying ownership of a bank account.

PEP findings need a proportionate response

Under Regulation 35, a PEP is an individual entrusted with a prominent public function, excluding middle-ranking or more junior officials. Family members and known close associates are separately defined categories to which specified measures also apply; they do not all personally hold the public office.³

The applicable PEP measures include senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. The extent of those measures reflects risk. For UK domestic PEPs, their family members and known close associates, the statutory starting point is a lower level of risk than for non-domestic PEPs. If no enhanced risk factors are present, the extent of enhanced due diligence must be less than for non-domestic PEPs; the applicable enhanced measures still apply.³

Use the FCA's FG25/3, revised in July 2025, for its current proportionate approach. PEP status alone should not lead to refusal or closure.⁶ Establish the person's role, relevant relationships and current or former status before deciding the measures. Do not turn a database label into an automatic “high risk” or “reject” instruction.

The firm's broader risk policy can call for additional review of other people or circumstances. Record that rationale separately: internal policy does not change the statutory PEP definition or remove legal minimums. The PEP screening guide explains the wider process.

Review sanctions candidates before deciding the legal response

OFSI distinguishes a name match from a target match. Compare available identifiers, aliases and source details, and escalate uncertainty promptly. Relevant obligations can arise where the firm knows or has reasonable cause to suspect the facts specified by the applicable prohibition; absolute certainty is not always required.⁴

Separate an internal processing hold from a legal asset freeze. Determine the designation, applicable measure, ownership/control, affected funds or activity and any exception or licence. Take required freezing and reporting action without delay when the relevant conditions are met. A possible recipient match does not automatically establish that every asset in the customer's account belongs to that recipient.

Keep the UK sanctions guide available to the team handling escalation. A sanctions report to OFSI and an AML suspicious-activity report are different processes; assess each under its own requirements.

Keep screening current through the relationship

Regulation 28(11) requires ongoing monitoring of the business relationship, including scrutiny of transactions and keeping due-diligence information up to date.² Named-party re-screening supports part of that work; it does not analyse trading behaviour or complete ongoing due diligence.

Define relevant source-update, customer-data, ownership, authority and PEP-role changes, alongside periodic reviews. Assign an owner to new candidates and a process for unresolved cases. Do not describe one annual interval as sufficient for every broker or risk. A new designation can matter before the next scheduled review.

When a public role ends, reassess the applicable former-PEP treatment rather than treating a changed database label as automatic expiry of obligations.³ Record the evidence and the firm's next review decision.

Three fictional broker scenarios

A common name during account opening

An applicant produces a candidate with a similar name. The analyst compares available birth details, aliases and source context. Reliable identifiers establish that the source record concerns someone else, and the analyst records why the candidate was dismissed.

The outcome belongs to that reviewed candidate and evidence. It is not a blanket clearance of everyone sharing the name, and a material change may require another review.

A corporate customer's owner has held public office

A company's supplied beneficial owner appears to match a former overseas minister. The team verifies identity and role dates, assesses the applicable PEP requirements and residual risk, and obtains the required approval and supporting information.

The company is not automatically sanctioned because its owner is a PEP. The decision records the person's status, relevant measures and accountable approver.

A withdrawal names a different recipient

A customer requests a withdrawal to a new recipient. Operations verifies the instruction and checks it against the broker's third-party payment policy. Screening returns a possible sanctions candidate.

The team controls payment release while the responsible specialists assess identity and applicable restrictions. They determine any required freeze or report from the actual facts and legal threshold; they do not presume that a name similarity freezes the entire account or that another payment route resolves the issue.

How Checklynx fits into the broker's process

Checklynx can screen supplied people and companies through portal, API and CSV/batch workflows against supported, configured sources. Grouped profiles bring related source records together, while enriched structured identifiers, roles and relationship information help analysts compare a candidate with the person they intended to check.

That context can help distinguish people with similar names and reduce avoidable false positives. The result depends on available data, configuration and review; it is not a promised percentage reduction. Configured ongoing screening and case management support follow-up and recorded decisions.

For a broker evaluation, test representative individual and company accounts, a common-name case, supplied related parties and a changed payment recipient. Check the supported source coverage, information returned, review process and retained evidence. Explore sanctions screening and PEP screening against those requirements.

Keep an account-linked decision record

Retain the account reference, event, supplied party and role, sources checked, time, relevant configuration, candidate evidence, reasoning, approver and outstanding action. Connect the funding or withdrawal instruction with the review rather than leaving finance to reconstruct it from screenshots.

Set access and retention by record category and applicable requirements. Regulation 40 addresses specified due-diligence and transaction records; it is not a reason to retain every screening field indefinitely.⁷ For UK personal-data decisions, use applicable UK GDPR and Data Protection Act requirements and the ICO's guidance.⁸ The EU GDPR screening guide addresses the separate EU framework where relevant.

Frequently asked questions

Does every deposit require a fresh PEP search?

There is no universal per-deposit rule stated here. Define the applicable obligations, relevant parties and review triggers. A new payer, changed customer information or relevant source update can create a different question from an unchanged payment by an existing customer.

Is a PEP result a reason to reject a forex account?

PEP status alone should not determine refusal. Establish identity and status, apply the required proportionate measures and make the firm's authorised risk decision.⁶

Can a clear name check approve a withdrawal?

No. Entitlement, verified instructions, third-party payment policy, relevant restrictions and unresolved due-diligence questions still need their own assessment.