Get it wrong, and you're not just looking at a minor administrative gap. Errors here can lead to findings during a FINTRAC examination and, depending on the circumstances, administrative monetary penalties (AMPs).
This guide breaks down what PEP and HIO actually mean under FINTRAC's framework, who qualifies, what obligations attach to that status, and how entities build a defensible determination process. We'll also cover where AlphaDelta's review and advisory work fits when entities need independent validation of their approach.
Key Takeaways
- PEP = Politically Exposed Person; HIO = Head of an International Organization
- Domestic PEPs/HIOs lose status 5 years after leaving office; foreign PEPs never do
- Treat foreign PEPs, their family, and close associates as always high risk
- Confirm PEP/HIO status at onboarding, in periodic monitoring, and when new facts emerge
What Does PEP Stand For in FINTRAC?
PEP stands for Politically Exposed Person. The obligation to identify them comes from the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), specifically section 9.3, along with the related Regulations (PCMLTFR).
FINTRAC splits the category into two distinct types:
- Domestic PEP — someone who currently holds, or held within the past five years, a specified Canadian federal, provincial, territorial, or municipal office
- Foreign PEP — someone who holds or held a specified office on behalf of any foreign state, with no expiry date on that status
HIO is a related but separate designation. It covers the primary person who heads, or headed within the last five years, an international organization established by governments, an institution of that organization, or an international sports organization.
FINTRAC groups PEP and HIO topics in guidance for operational convenience, but the definitions, high-risk conditions, and triggers stay distinct. Do not apply a generic source-of-wealth / senior-management / record-keeping visual across every category and sector as if the same measures always apply the same way.
Who Is a Politically Exposed Person Under FINTRAC?
Domestic PEP Offices
FINTRAC's list of domestic offices is specific. It includes:
- Governor General, lieutenant governor, or head of government
- Member of the Senate, House of Commons, or a provincial/territorial legislature
- Deputy minister or equivalent rank
- Ambassador, or an ambassador's attaché or counsellor
- Military officer at the rank of general or above
- President of a Crown-owned corporation
- Head of a government agency
- Judge of a provincial appellate court, the Federal Court of Appeal, or the Supreme Court of Canada
- Leader or president of a political party represented in a legislature
- Mayor, reeve, or similar municipal chief officer
Foreign PEP Offices
The foreign list mirrors the domestic categories but applies regardless of citizenship, residence, or birthplace. Covered roles include:
- Head of state or government
- Cabinet minister or equivalent
- Member of a legislature
- Senior military officer
- Judge of a court of last resort
- Head of a state-owned company or bank
Family and Close Associates
Family members are narrowly defined: spouse or common-law partner, biological or adopted child, parent, parent-in-law, and sibling. Step-relations are excluded unless legally adopted.
Close associates require more judgment. FINTRAC's examples include:
- Business partners or joint beneficial owners
- Romantic partners outside a legal spouse relationship
- Co-board members
- Prominent members of the same political party or union
- People jointly named on an insurance policy or financial product
Duration rules follow the same split for family members and close associates. Domestic PEP and HIO status ends five years after the person leaves office. Foreign PEP status never expires — including after the person's death.
Reporting Entity Obligations for PEP and HIO Determinations
FINTRAC requires a determination at three specific points:
- Entering a business relationship — account opening or, for non-account sectors, the start of the relationship
- Periodic monitoring — ongoing review of existing clients
- Detecting a fact — any information that creates reasonable grounds to suspect PEP, HIO, family, or close associate status
A name match alone generally doesn't meet the reasonable-grounds threshold. FINTRAC expects corroborating details like address, birth date, or transaction patterns before a determination is confirmed.
Once someone is identified as a PEP/HIO, measures depend on category, sector, and trigger:
- Foreign PEPs (and their family members and close associates) are treated as high risk; prescribed enhanced measures apply
- Domestic PEPs and HIOs attract enhanced measures when the entity's risk assessment finds high ML/TF risk (or when other prescribed conditions apply)
- Account-based and non-account-based sectors have different relationship and transaction triggers - do not universalize one sector's process to all reporting entities
Where prescribed enhanced measures apply, entities typically must:
- Take reasonable measures to establish source of wealth and, where applicable, source of funds
- Obtain senior management review and approval to keep the business relationship or complete the transaction, where required
- Apply enhanced ongoing monitoring where the high-risk designation requires it
A 30-day window applies in prescribed circumstances for completing certain PEP/HIO measures after determination or fact detection. It is not a universal 30-day SOW/approval/enhanced-monitoring rule for every domestic PEP, every HIO, and every sector in every case. Confirm the applicable trigger (account opening, prescribed transaction, or fact detection) for your entity type.
PEP / HIO categories and triggers (FINTRAC concepts summary)
| Category | Who is covered | Duration after leaving office | High-risk treatment | Account vs non-account triggers (illustrative) | When enhanced measures typically apply |
|---|---|---|---|---|---|
| Foreign PEP | Specified foreign officeholders | Never expires | Always high risk | Account opening / ongoing monitoring; non-account: business relationship and prescribed transactions per sector | Prescribed SOW, senior management review, enhanced monitoring as required |
| Foreign PEP family / close associates | Spouse/partner, child, parent, parent-in-law, sibling; close associates per guidance | Follows foreign PEP (never expires) | Always high risk | Same sector triggers as the related foreign PEP determination | Same suite as foreign PEP when prescribed |
| Domestic PEP | Specified Canadian federal, provincial, territorial, municipal offices | 5 years | High risk when entity risk assessment (or other prescribed conditions) so finds | Account and non-account triggers differ by reporting-entity type - do not copy one sector's process to all | SOW / senior management review / enhanced monitoring when high-risk conditions are met - not automatic for every domestic PEP |
| HIO | Head of an international organization (or institution / international sports organization as defined) | 5 years | High risk when entity risk assessment (or other prescribed conditions) so finds | Same principle: sector-specific relationship and transaction triggers | Same suite when high-risk conditions are met |
| Domestic PEP / HIO family and close associates | Family as defined; close associates per guidance | Follows the related domestic PEP or HIO clock | Follows the related person's high-risk determination | Same sector triggers as the related determination | Enhanced measures when the related person is treated as high risk / prescribed |
A 30-day determination window applies in prescribed circumstances after determination or fact detection. It is not a universal 30-day SOW/approval/enhanced-monitoring rule for every domestic PEP, every HIO, and every sector in every case.
Record-keeping follows a similar structure. Entities must document:
- Office or position held
- Organization
- Determination date
- Source-of-wealth findings
- Approving senior manager
- Approval date
These records must be retained for at least five years after account closure or the last transaction, depending on the sector.
Should PEPs and HIOs Be Treated as High-Risk Clients?
The answer depends entirely on which category you're dealing with.
- Foreign PEPs (and their family members and close associates) must always be treated as high-risk. There is no discretion—this is mandatory under FINTRAC's framework.
- Domestic PEPs and HIOs depend on your entity's own risk assessment. If your methodology finds elevated ML/TF risk based on circumstances, industry, or transaction patterns, enhanced measures apply. If not, standard due diligence may be enough—provided that conclusion is documented and defensible.
Canada's own risk data adds useful context. The 2023 National Inherent Risk Assessment rates the money-laundering threat tied to corruption, collusion, and bribery as very high, driven largely by public procurement scale and high-value contract corruption risk.
PEPs also appear qualitatively across vulnerability profiles for legal professionals, accountants, and casino VIP operations, though the assessment does not attach a specific numerical PEP corruption statistic.
The practical challenge isn't knowing the rule. It's proving their risk methodology actually applies it consistently, and that the domestic PEP/HIO risk-based decisions are documented with a clear rationale.
An independent effectiveness review is often how entities test that claim. AlphaDelta's reviews use document review, interviews, and evidence-based testing to assess whether a client's PEP/HIO risk methodology—and the controls around it—genuinely reflect FINTRAC's expectations rather than only referencing them on paper.
Scope is tailored to the entity's size, complexity, and prior findings, so the review can go as deep into PEP/HIO governance as the engagement requires.
Common Pitfalls Canadian Reporting Entities Make with PEP/HIO Compliance
A few mistakes show up repeatedly across FINTRAC examinations and internal reviews:
- Blurring domestic and foreign duration rules. Entities sometimes apply the five-year expiry to foreign PEPs, treating someone as "cleared" when foreign PEP status never lapses.
- Over-relying on name matching. A name hit closes the file without corroborating identifiers such as date of birth or address—something FINTRAC has flagged as insufficient.
- Inconsistent enhanced due diligence and senior management review. Some files get source-of-wealth documentation and sign-off; domestic PEPs that meet high-risk conditions may be skipped or delayed past applicable prescribed timelines.
These gaps rarely show up as a single dramatic failure. They accumulate as inconsistent file-by-file practice, which is exactly the kind of pattern FINTRAC examiners look for.
Fixing this pattern usually isn't about writing new policy. It's about closing the gap between what's written and what's actually done.
AlphaDelta's senior AML advisory support—retainer, defined engagement, or hourly—helps entities assess findings, separate mandatory from discretionary requirements, and make enhanced due diligence and senior management review more consistent in practice.
Frequently Asked Questions
What does PEP stand for in FINTRAC?
PEP stands for Politically Exposed Person. FINTRAC uses this designation to flag individuals whose public office or position creates elevated exposure to bribery, corruption, or influence-related money laundering risk.
Who is a politically exposed person (PEP) under FINTRAC?
A PEP is a domestic official (Canadian federal, provincial, or municipal) or a foreign official in a specified government, judicial, or military role. The designation also covers their family members and close associates.
How long does someone remain a PEP under FINTRAC rules?
Domestic PEPs lose that status five years after leaving office. Foreign PEPs remain PEPs indefinitely, with no expiry, even after death.
What is the difference between a PEP and a HIO?
PEP covers political officeholders. HIO means the head of an international organization, an institution within that organization, or an international sports body. Obligations for both are largely the same.
Do all PEPs need to be treated as high-risk clients?
Foreign PEPs and their family/close associates must always be treated as high-risk. Domestic PEPs and HIOs only require high-risk treatment if the entity's own risk assessment identifies elevated ML/TF risk.
What happens if a reporting entity fails to properly identify a PEP?
Missed or incorrect PEP determinations can trigger Administrative Monetary Penalties (AMPs) and draw scrutiny in a FINTRAC examination. Closing gaps early—through clearer determination procedures and senior review—reduces the chance they become formal findings.
