The Pandora Papers brought to light how politically exposed persons move wealth through offshore shells that a basic name check never sees. Enhanced due diligence and PEP screening exist to close exactly that gap. They look past the clean identity to the source of wealth and the real beneficial owner sitting behind a structure, which is where the risk usually hides.
When the International Consortium of Investigative Journalists (ICIJ) published the leak on 3 October 2021, it ran to more than 11.9 million records naming 35 current and former world leaders and more than 330 public officials. For a compliance team, the interesting part is not the famous names. It is that many of these arrangements were legal on their face and would have cleared a standard onboarding check. The failure, where there was one, sat one layer down.
What Is the Connection Between the Pandora Papers and Due Diligence?
The connection is direct: the Pandora Papers are a catalogue of the exact structures enhanced due diligence is built to see through. Offshore companies, trusts, and nominee arrangements were used to hold assets at a distance from the people who actually controlled them, and that distance is precisely what a good due diligence process is supposed to collapse.
What the Pandora Papers Actually Revealed
The leak came from 14 offshore service providers and covered more than 27,000 companies and roughly 29,000 ultimate beneficial owners. The full ICIJ figures put the scale beyond any single institution’s book, but the pattern inside them is familiar to anyone who onboards high-net-worth customers.
The recurring shape was an asset held by a company, owned by another company, owned in turn by a trust in a low-transparency jurisdiction, with a natural person somewhere at the end who never appeared on the first document a bank would see. Nothing about that chain is automatically illegal. What it does is put daylight between the customer on the form and the person who benefits, and that daylight is where laundering, sanctions evasion, and undisclosed conflicts live.
Why This Is a Due-Diligence Problem, Not Just a News Story
A name-level check answers one question: is this person who they say they are? It does not answer the harder question of where their money came from or who ultimately owns the entity opening the account. Standard customer due diligence verifies identity and screens against watchlists, and for most customers that is proportionate.
The Pandora Papers describe the customers for whom it is not. When a politically exposed person sits behind a layered offshore structure, the identity can be genuine and the paperwork immaculate while the real risk stays invisible. That is the trigger for enhanced due diligence, the deeper level of checking reserved for higher-risk relationships. The leak is less a scandal to a compliance reader than a very large worked example of when to escalate.
What Is Enhanced Due Diligence in PEP Screening?
Enhanced due diligence in PEP screening is the set of additional checks a firm runs when a customer is, or is connected to, a politically exposed person. Beyond confirming identity, it establishes the source of wealth and source of funds, requires senior sign-off to open the relationship, and puts the account under closer ongoing monitoring.
Who Counts as a Politically Exposed Person
A politically exposed person (PEP) is someone entrusted with a prominent public function, along with their family members and close associates. The Financial Action Task Force (FATF) sets the global standard through its Recommendations 12 and 22, and national regulators implement it.
In India, the Reserve Bank of India (RBI) mirrors that standard. Its KYC Master Direction defines PEPs as individuals entrusted with prominent public functions by a foreign country, such as heads of state, senior politicians, senior government, judicial or military officers, and senior executives of state-owned corporations. The point that matters operationally is the extension to family members and close associates, because that is the relationship the Pandora Papers exposed most often: assets held not by the official but by a relative or a friend one step removed.
What EDD Adds Beyond Standard KYC for a PEP
The RBI Master Direction is specific about the added steps for a PEP. Firms must run risk management systems to determine whether a customer or beneficial owner is a PEP, take reasonable measures to establish the source of funds and wealth, obtain senior-management approval before opening the account, and subject the relationship to enhanced monitoring on an ongoing basis.
Those four steps are the difference between a routine KYC checklist and enhanced due diligence. A standard flow confirms the person and screens the name. EDD asks the customer to prove where the wealth originated, forces a human decision to accept the risk, and keeps watching after onboarding rather than treating verification as a one-time event. Get those additions right and the layered structures in the leak stop being invisible; skip them and a clean screen becomes false comfort.
Where PEP Screening Fails (and the Pandora Papers Prove It)
Most PEP screening failures are not exotic. They come from stopping at the name when the risk lives in the ownership chain and the money trail. Three patterns recur, and each maps onto something the leak put on display.
The Offshore Shell That Hides the Beneficial Owner
The first failure is treating the entity on the application as the customer. When a company is owned by another company owned by a trust, the natural person who benefits can sit three or four layers back, and a flow that never resolves the ultimate beneficial owner simply never meets them.
This is the single most common gap the Pandora Papers illustrate. Resolving ownership means following the chain to a named human being and verifying that person, not accepting the first corporate name in the file. For business relationships, that is the job of know your business checks, which sit alongside individual KYC rather than replacing it. The distinction between the two is worth being deliberate about, and it is covered in more depth in our breakdown of KYB versus KYC.
The Name That Clears but the Wealth That Doesn’t
The second failure is confusing source of funds with source of wealth. Source of funds explains where the specific money in this transaction came from; source of wealth explains how the customer accumulated their total assets in the first place. A salary slip can satisfy the first and say nothing about the second.
For a PEP, the second question is the one that matters, because the risk is that public office, not legitimate enterprise, is the origin of the wealth. A name that clears every sanctions and PEP list can still belong to someone whose fortune has no plausible lawful explanation. Verifying source of wealth is slow, document-heavy, and often the step teams quietly skip under volume pressure, which is exactly why the structures in the leak worked.
PEP-by-Association and Nominee Structures
The third failure is missing the connection. Assets in the leak were frequently held by spouses, children, or long-standing associates rather than the official directly, and nominees were used to stand in as the named owner while control rested elsewhere. A screen that only checks the applicant against a PEP list, and never asks who they are connected to, will pass all of them.
This is why the regulatory definition deliberately includes family members and close associates. Catching it in practice means screening relationships, not just individuals, and treating a nominee arrangement as a reason to look harder rather than a box that has been ticked. The three failures share a root cause, which is stopping the check one layer too early.
How Do You Build EDD and PEP Screening That Would Catch This?
A durable process is built around triggers and sequence, not effort applied evenly to everyone. The goal is to spend the heavy checks where the risk actually concentrates, and to run them in an order where each step narrows what the next one has to handle.
A Risk-Tiered EDD Trigger Matrix
The cleanest way to hold this together is a matrix that ties each risk trigger to the EDD step it demands and the evidence that closes it:
| Trigger | EDD step required | Evidence to collect |
|---|---|---|
| Confirmed PEP, or a PEP family member or close associate | Establish source of wealth and source of funds; obtain senior-management approval | Documented wealth history, income and asset records, senior sign-off note |
| Offshore entity or trust in the ownership chain | Resolve the ultimate beneficial owner behind the structure | Ownership graph tracing to a named natural person, incorporation records |
| Nexus to a high-risk or secrecy jurisdiction | Escalate verification and run adverse-media screening | Jurisdiction risk rating, adverse-media and sanctions results |
| Adverse media or a near-match on a sanctions list | Route to human adjudication before onboarding | Analyst review notes, documented disposition |
The matrix keeps the response proportionate. A low-risk retail customer never touches these rows, while a layered offshore structure with a PEP at the end triggers all of them.
Sequencing the Checks
Order matters as much as coverage. Screen the individual and any connected parties first, then resolve beneficial ownership, then verify source of wealth, then take the senior-management decision, and only then move the relationship into ongoing sanctions screening and monitoring. Each step earns the right to the next, and a failure early stops the file before effort is wasted downstream.
The mistake we see most often is treating a clean PEP screen as the end of the job. It is the start. A name can clear every list you own and the risk still lives one layer down, in who really owns the account and where the money came from. The customers who look easiest are sometimes the ones you should slow down for, because the structure was built to look easy.
Where Automation Helps and Where It Doesn’t
Automation carries the parts that are high-volume and rule-based. Screening names and connected parties against PEP, sanctions, and adverse-media data, and graphing an ownership structure to surface the natural person at the end, are tasks a machine does faster and more consistently than a queue of analysts. Building that layer well is the subject of sanctions screening best practices, and it is the backbone of a modern AML compliance program.
What does not automate cleanly is the judgment. Deciding whether a source-of-wealth explanation is plausible, and whether to accept a PEP relationship at all, is a human call that regulation deliberately keeps with senior management and a firm’s compliance function. The right design pairs automated screening and ownership resolution with human adjudication at the decision points. To see how automated PEP, sanctions, and beneficial-ownership screening work together, talk to our team.
FAQs
What is the connection between the Pandora Papers and due diligence?
The Pandora Papers documented offshore companies, trusts, and nominee arrangements used to hold assets away from the people who controlled them. These are the exact structures enhanced due diligence and PEP screening are designed to see through, which makes the leak a large real-world example of when standard identity checks are not enough.
What is enhanced due diligence in PEP screening?
Enhanced due diligence in PEP screening is the deeper set of checks applied when a customer is or is linked to a politically exposed person. It goes beyond identity verification to establish the source of wealth and funds, requires senior-management approval to open the account, and places the relationship under enhanced ongoing monitoring.
Who is considered a politically exposed person?
A politically exposed person is an individual entrusted with a prominent public function, such as a head of state, senior politician, senior government, judicial or military officer, or senior executive of a state-owned corporation. The definition also extends to their family members and close associates, who often hold assets on their behalf.
What is the difference between source of wealth and source of funds?
Source of funds explains where the specific money in a transaction or account came from, such as a salary or a sale. Source of wealth explains how the customer built their total assets over time. For a PEP, verifying source of wealth is the more important check, because it tests whether the fortune has a plausible lawful origin.
