![\"\"](\"https:\/\/namescan.io\/insights\/wp-content\/uploads\/2026\/10\/AML_KYC-Identifier-Comparison-Table.jpg\")
<\/p>\nYou run a client through a PEP and sanctions check and the result comes back with a potential match. For a small firm, this is the moment where most of the uncertainty sits. Is the client a sanctioned person? Do you have to turn them away? Do you need to tell anyone?<\/p>\n
A potential match means the name you screened resembles a name on a politically exposed person (PEP) list or a sanctions list. It is a prompt to review, not a finding. Most potential matches turn out to be a different person with a similar name. The ones that are real lead to two very different outcomes: a PEP match is a risk factor you manage, while a sanctions match can mean you are legally prohibited from dealing with that person at all.<\/p>\n
This guide sets out a review routine you can follow every time, using Australian rules as the worked example. It is general information, not legal advice. Your own AML\/CTF program, and the law where you operate, set the rules your firm must follow.<\/p>\n
Screening tools compare the details you enter against list records. Because names are spelled differently across languages, documents and databases, good screening uses fuzzy matching, which deliberately returns close variations rather than exact matches only. That protects you from missing a listed person whose name has been transliterated differently, but it also means common names produce several results.<\/p>\n
The fewer details you enter, the more potential matches you get. Screening ‘Mohammed Ali’ with no date of birth or country will return far more results than the same name with a full date of birth and nationality. Entering every identifier you hold is the single easiest way to cut down review time.<\/p>\n
Do not finish onboarding or start providing the service while a potential match is unresolved. In Australia, AUSTRAC expects initial customer due diligence (CDD) to be completed before you start providing a designated service, and it expects you to establish whether the customer or their beneficial owners are PEPs as part of that process.<\/p>\n
For a possible sanctions match, the pause matters even more. Australian sanctions laws prohibit dealing with designated persons and their assets, so any money, property or service you provide while the match is open could create a problem.<\/p>\n
Do not tell the client that their name has matched a list. Ask for any missing details as part of your normal onboarding questions.<\/p>\n
Put the client’s details side by side with the list record and work through each identifier. One strong mismatch, such as a date of birth decades apart, is usually enough to rule out a match. A name match on its own is never enough to confirm one.<\/p>\n
<\/p>\n
If the record holds less information than you do, you may not be able to rule it out from the data alone. In that case, collect another identifier from the client (for example, a full date of birth or a previous name) and compare again.<\/p>\n
Every potential match should end in one of three outcomes, each with a set action.<\/p>\n
![\"\"](\"https:\/\/namescan.io\/insights\/wp-content\/uploads\/2026\/10\/Compliance-Outcomes-Comparison-Table.jpg\")
<\/p>\n
The most common failure in small firms is skipping the record for false positives. If you rule out a match, write down which identifier ruled it out. A note such as “different person” is not enough on its own to show your reasoning later.<\/p>\n
A PEP is someone entrusted with a prominent public function, along with their family members and close associates. The Financial Action Task Force (FATF) is clear that the extra measures for PEPs are preventive and should not be read as suggesting PEPs are involved in crime. A confirmed PEP match is therefore a reason to look more closely, not a reason to refuse the client.<\/p>\n
Under Australia’s reformed rules, AUSTRAC recognises foreign, domestic and international organisation PEPs. Enhanced CDD applies to a customer who is a foreign PEP, and to domestic or international organisation PEPs where the customer’s money laundering and terrorism financing risk is high. In practice, the follow-up usually involves:<\/p>\n
AUSTRAC also notes that a person stops being a PEP when they leave the position, but their former role can still affect their risk. Check your program for how it treats former PEPs.<\/p>\n
Treat a sanctions match as a legal issue first and a compliance issue second. In Australia, the Department of Foreign Affairs and Trade (DFAT) advises anyone who finds a match on its Consolidated List to seek legal advice before any further dealings with the person, entity or their assets.<\/p>\n
If you hold, or think you may hold, an asset owned or controlled by a designated person, such as client money in a trust account, you must freeze it and tell both the Australian Sanctions Office and the Australian Federal Police as soon as possible. We cover the full process in our guide to what happens when a client matches the DFAT Consolidated List.<\/p>\n
Contravening Australian sanctions laws is a serious criminal offence, and for companies it is a strict liability offence. That is why an unresolved sanctions match should never be closed on a hunch.<\/p>\n
A PEP or sanctions match does not automatically require a suspicious matter report (SMR) to AUSTRAC. An SMR is needed when you form a suspicion on reasonable grounds, for example that the client is not who they claim to be or that the service may relate to money laundering, terrorism financing or other crime. Reluctance to provide identification or vague explanations for the service can add to that picture.<\/p>\n
If you do lodge an SMR, AUSTRAC’s deadlines are 24 hours where the suspicion relates to terrorism financing and 3 business days in other cases. Be careful not to tell the client that you have reported or that you suspect them.<\/p>\n
Your record should let someone who was not involved understand what happened and why. For each potential match, keep:<\/p>\n
In Australia, CDD records generally need to be kept for 7 years after the business relationship ends. Our guide to recording screening decisions for AUSTRAC review goes into more detail on what a good record looks like.<\/p>\n
A pay-as-you-go screening check covers the screening step well: it tells you whether a name returns potential PEP, sanctions or adverse media results, and gives you a dated result to keep. It does not decide the match for you, assess the client’s overall risk or replace your AML\/CTF program. If you regularly see true matches, screen large client books or need continuous monitoring, a more structured process or platform may suit you better.<\/p>\n
Does a potential match mean my client is a criminal?<\/strong><\/p>\n No. A potential match only means the name resembles a list record. Even a confirmed PEP match is a risk factor, not evidence of wrongdoing. A confirmed sanctions match is different, because it can legally restrict what you can do.<\/p>\n Can I refuse a client because they are a PEP?<\/strong><\/p>\n You can decline a client who falls outside your firm’s risk appetite, but FATF guidance makes clear that PEP status alone does not imply criminal activity. Most firms manage PEP clients through enhanced checks and senior approval rather than automatic refusal.<\/p>\n What if I cannot rule a match in or out?<\/strong><\/p>\n Treat it as unresolved. Collect another identifier from the client, escalate to your compliance officer and do not provide the service until it is resolved.<\/p>\n Should I tell the client their name matched a list?<\/strong><\/p>\n No. Ask for the extra information as part of normal onboarding. If you have formed a suspicion or lodged an SMR, telling the client can create a tipping off problem.<\/p>\n How long should I keep records of a false positive?<\/strong><\/p>\n Keep them with the client’s CDD records. In Australia, that generally means 7 years after the business relationship ends.<\/p>\n NameScan lets small firms run PEP, sanctions and adverse media checks on individuals and businesses on a pay-as-you-go basis. In the NameScan dashboard you can review results, record whether each result is a true match, document your decision and assign a risk level, so the evidence for steps 2 to 6 sits with the check itself.<\/p>\n Start screening with NameScan<\/a><\/strong>, or try a free PEP check<\/a> to see how results are returned.<\/p>\n","protected":false},"excerpt":{"rendered":" You run a client through a PEP and sanctions check and the result comes back with a potential match. For a small firm, this is the moment where most of the uncertainty sits. Is the client a sanctioned person? Do you have to turn them away? Do you need to tell anyone? A potential match […]<\/p>\n","protected":false},"author":9,"featured_media":14477,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"potential match","_yoast_wpseo_title":"What to do with a PEP or sanctions potential match","_yoast_wpseo_metadesc":"A potential match is not a confirmed match. How small firms review PEP and sanctions results, what to record and when to escalate.","footnotes":""},"categories":[85],"tags":[],"class_list":["post-14472","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-post"],"yoast_head":"\nHow NameScan can help<\/h2>\n