PEP Screening for Non-Profits and Charities: Donor and Beneficiary Due Diligence

Charities sit in an odd position in the financial crime system. In most countries they are not "obliged entities" under anti-money laundering law, so no regulator hands them a rulebook and tells them to screen for politically exposed persons. The expectation shows up anyway, from four directions at once. These include trustee duties under charity law, fundraising codes, the banks that hold their accounts, and the institutional funders who write the grant conditions.

A PEP is someone entrusted with a prominent public function, along with their family members and close associates. The label is not an accusation. It is a flag that says a person’s wealth and influence deserve a second look. The reason is that public office creates opportunities for bribery, embezzlement, and the laundering of proceeds through respectable channels. Philanthropy is one of those channels. Research on post-Soviet elites found that donations to universities and charities have been used to clean up reputations, often processed in secret and with flawed due diligence.

The money runs both ways, and so does the risk. On the inbound side there are donors, their source of funds and source of wealth, and the conditions attached to a gift. On the outbound side there are grantees, local partners, contractors, staff, and, in some interpretations, beneficiaries.

Three recent changes reset the ground rules. FATF amended Recommendation 8 in November 2023 to stop countries applying disproportionate measures to non-profits. The FCA published FG25/3 in July 2025, confirming that UK PEPs start from a lower-risk position. The UK’s Code of Fundraising Practice now requires appropriate due diligence, proportionate to the size and nature of the donation, before a gift is accepted.

The challenging part is calibration. Screening too little invites tainted money. Screening too much shuts out legitimate donors and, in aid settings, blocks help from reaching people who need it. The following topics are going to be covered in this article:

1. Why Charities and Non-Profits Face Unique PEP Risk

2. What Regulators Expect: FATF Recommendation 8 and the 2023 Revision

3. Screening PEP Donors: Source of Wealth Is the Core Question

4. Screening Beneficiaries, Partners, and Board Members

5. Building a Risk-Based NPO Screening Program

6. How Sanction Scanner Helps Non-Profits

1. Why Charities and Non-Profits Face Unique PEP Risk

A bank screens one customer per relationship. The exposure is bounded and sits on one side of the transaction. A charity has no such luxury. Money arrives from donors and leaves through grantees, partners, contractors and beneficiaries. A politically exposed person can appear anywhere along that chain. That is the structural difference, and it is why NPO screening is not just a smaller version of what banks do.

(a) PEP donors: The source-of-wealth question

When a PEP makes a large gift, the question is not whether they are a criminal. It is whether the money was theirs to give. FATF’s own PEP guidance flags cases where information supplied by a PEP conflicts with public records such as asset declarations and published official salaries. The practical test would be, if the size of the gift makes sense against a public servant’s declared income?

The second motive is reputational rather than financial. Chatham House found that philanthropy to UK universities and charities has been used by post-Soviet elites to clean up their reputations, with donations processed in secret and several cases pointing to flawed due diligence. A named building or an honorary fellowship is a durable asset in a defamation case or an extradition fight. The charity gets the money. It also becomes a character witness.

(b) PEP insiders and PEP-linked recipients: The diversion question

When the flow is reversed, the nature of the risk changes. A PEP on the board, or a grantee controlled by a political family, does not import dirty money. It exports clean money to the wrong place: Contracts steered to connected suppliers, grants that function as patronage, programmes timed around elections. In many countries it is entirely normal for a minister, a ruling-party figure or a president’s spouse to chair a foundation. That is not automatically corrupt, but it collapses the wall between charitable purpose and political purpose, and trustees have to manage the overlap rather than ignore it.

Four populations, one policy

Donors, board and senior staff, partners and grantees, and beneficiaries each need a different depth of checks. Beneficiary screening is the most contested of the four. In February 2023 France’s Conseil d’État overturned government guidelines that had imposed systematic screening of final beneficiaries of humanitarian aid. Screening a starving family against a PEP list is neither proportionate nor useful. Screening the local NGO that distributes the food usually is.

Where FATF Recommendation 8 actually sits

R.8 covers terrorist financing, not corruption, and since the November 2023 revisions it applies only to organisations falling within FATF’s definition of an NPO, not the whole not-for-profit sector. PEP obligations come from Recommendation 12, which binds financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs), not charities. So a charity’s PEP duty is indirect, arriving through its bank, its funders and its trustee duties.

The current Best Practices Paper (BPP) is dated 16 November 2023. What is new is that in 2025 FATF introduced a procedure allowing countries, the IMF and the World Bank to raise cases where a country’s misapplication of the standards disrupts legitimate NPO activity, and the consolidated Recommendations were reissued in June 2026.

2. What Regulators Expect: FATF Recommendation 8 and the 2023 Revision

What R.8 actually requires and from whom

R.8 speaks to governments, not charities. It requires countries to periodically identify which organisations fall inside FATF’s functional definition of an NPO, assess the terrorist financing risks those organisations face, and put focused, proportionate and risk-based measures in place. The definition is narrow and it covers bodies whose primary activity is raising or disbursing funds for charitable, religious, cultural, educational, social or fraternal purposes. The FATF excludes trade unions and organisations that primarily research or campaign on public policy without raising or disbursing funds for those causes.

The 2023 text also did something unusual for FATF. It named bad practice explicitly. Classifying every NPO as high risk without differentiation, applying identical oversight to low- and high-risk organisations, and imposing identification requirements on beneficiaries are all listed as inconsistent with R.8. The paper is blunt that many countries have wrongly legislated NPOs into reporting-entity status as though they were banks or DNFBPs, which was never the intention.

Monitoring and oversight, not supervision

FATF deliberately uses "oversight" and "monitoring" for NPOs to distinguish them from "supervision", the word reserved for financial institutions and DNFBPs. One nuance worth carrying. FATF treats oversight as the lighter of the two, with monitoring meaning proactive detection of changes in risk profile. R.8 does not intend on-site or off-site inspections of NPOs on the same terms as reporting entities.

Jurisdictional notes

United States: PATRIOT Act Section 371 is not the NGO provision. Section 371 covers bulk cash smuggling into or out of the United States. The power to designate charities linked to terrorist financing comes from Executive Order 13224, which was issued on September 23, 2001, under the International Emergency Economic Powers Act (IEEPA), along with the material support law at 18 U.S.C. §2339B. Treasury’s Anti-Terrorist Financing Guidelines for US charities remain voluntary best practice, not binding rules.

European Union: AMLD does not impose customer due diligence on NPOs, because NPOs are not obliged entities. Banks apply CDD to charity customers, and charities sit in national risk assessments. The genuinely relevant PEP mechanism arrived with the European Union’s 5th Anti-Money Laundering Directive (5AMLD), which required Member States to publish lists of prominent public functions; Article 43 of the new AML Regulation carries that forward. The regulation applies from 10 July 2027, with AMLD6 transposition due on that same day.

United Kingdom: Three bodies are involved, but none of them serve as AML supervisors for charities. The Charity Commission expects trustees to run due diligence on donors, beneficiaries and local partners. The Fundraising Regulator’s code requires proportionate due diligence on a donor before a gift is accepted. The FCA supervises the bank, not the charity.

Key message

The 2023 revision tells governments and banks to assess NPOs on evidence rather than category. R.8 does not oblige charities to screen anyone. A charity’s reason to verify donors and partners comes from charity law, funder conditions and reputational exposure. Screening under R.8 is sanctions-based and aimed at partners and staff. Beneficiaries are the group FATF explicitly warns against screening.

3. Screening PEP Donors: Source of Wealth Is the Core Question

When a PEP donates, there are two questions, and they have different answers. The legal question is whether you may accept it at all. Charity Commission guidance is clear that trustees have a legal responsibility to refuse donations they suspect come from illegal sources or carry illegal conditions. That is not a documentation exercise. The principal money laundering offences in Proceeds of Crime Act (POCA) sections 327 to 329 apply to everyone, not only to the regulated sector. As a result, a charity that accepts money it suspects is criminal property has a problem regardless of its paperwork. The second question, the judgement call, is whether accepting serves the charity’s best interests. The Commission’s starting position is that donations should be accepted unless they come from illegal sources, carry illegal conditions, or the donor lacks capacity.

The source of funds is not the same as the source of wealth

This is where most charity policies are thin. The source of funds tells you which account the money came from. The source of wealth tells you how the donor accumulated it in the first place. For a PEP, the second is the one that matters, because the corruption question is about the size of the fortune relative to a public salary, not about which bank wired the payment.

Proportionality applies here too. The FCA’s approach for lower-risk PEPs is to use information reasonably available, including public domain sources, and take less intrusive steps to establish a source of wealth. Charities are not bound by that guidance, but it is a sensible calibration. Asset declarations, company filings, published transaction records and credible reporting will resolve most cases without an intrusive request to the donor.

Timing: Before acceptance, not at the point of donation

Screen for major gifts during the cultivation phase, not when the funds are received. Reversal is legally awkward. Trustees cannot use a power to refuse or return unless satisfied it is in the charity’s best interests, and the Commission may examine that reasoning. Even the Commission’s 2024 position that trustees usually hold a general power to return has been questioned by charity lawyers, so treat acceptance as close to final.

Decision and sign-off

Record the outcome, the evidence relied on, who decided, and why. There are three outcomes. These are accept, decline, or accept with conditions (anonymity, no naming rights, staged payment, a right to return if circumstances change). Route PEP decisions to a named committee or trustee, not the fundraiser who built the relationship. The following table breaks down the donor risk signal, why it matters, screening action and the decision point:

Table 1: Donor Risk Signal and the Screening Action

Two reporting hooks sit behind the last column. Suspicion of criminal property points to a disclosure to the National Crime Agency. A suspicious donation, accepted or refused, is also reportable to the Charity Commission as a serious incident.

4. Screening Beneficiaries, Partners, and Board Members

In FATF’s glossary "beneficiaries" means the natural persons receiving assistance, not the organisations you fund. Those are partners, grantees or implementing partners. Collapsing the two is how charities end up screening refugees, which is the practice FATF and several courts have pushed back against. Keep the words separate, and the policy stays coherent.

(a) Partners and grantees: Two different tests

Sanctions and PEP screening are not the same obligation, and they do not produce the same answer. Sanctions screening is law, not best practice. OFSI’s guidance, updated in January 2026, states that charities and NGOs must comply with financial sanctions, and that breaching them is a criminal offence. It states that this requirement applies to all charities and NGOs, including individual staff members, regardless of whether they are government-funded. The ownership test goes deeper than the name on the grant agreement.You should consider whether a counterparty is owned or controlled, directly or indirectly, by a designated person. A partner NGO run by a sanctioned figure is not a diversion risk to be managed. It is a transaction you cannot make at all without a licence. OFSI can impose penalties of up to 50% of the value of the breach or £1 million, whichever is higher, and the principal offences carry up to seven years on indictment.

PEP screening of partners sits in a different box. It is not a legal requirement, and a PEP-linked grantee is not automatically disqualified. What it provides you is a governance signal. Does the local political figure who chairs this partner also control the procurement, select the recipients, or benefit from the contracts? That is a question for the grant agreement and the monitoring plan, not the sanctions log.

(b) Board members and key personnel

There are two reasons to conduct screenings at the time of appointments and periodically thereafter. First, eligibility: Designation under UK counter-terrorism sanctions is an automatic disqualification from trusteeship. The Charity Commission’s position is that a designated person cannot discharge a trustee’s duties, must not be appointed, and if designated while in post must resign or be in breach of charity law. Designation under other regimes, such as Russia or Belarus, does not disqualify automatically, but it makes the role close to unworkable, since the charity cannot make funds or economic resources available to them. Second, and more mundane, a PEP trustee will surface in your bank’s own screening. Knowing before they do, and being able to explain the appointment, is often the difference between a routine review and a frozen account.

(c) High-risk jurisdictions

FATF does not flag conflict-zone disbursement as an elevated risk in that blunt form. The Best Practices paper says financial institutions should not treat NPOs as high risk simply for operating in cash-intensive environments or in countries of great humanitarian need. The actual factor is proximity to active terrorist threats. FATF describes low-risk NPOs as those working away from active threat areas, not funded by entities near them, and not moving funds through them. Meanwhile, the UNSCR 2664 carve-out runs the other way. Its Condition A extends to employees, grantees, subsidiaries and implementing partners of eligible organisations, and Condition B turns on the provider’s belief that the activity is necessary for timely humanitarian assistance.

OFSI states that charitable activities aren’t automatically permitted, but most humanitarian work typically requires no licence. This is worth remembering when a donor or bank asks you to screen aid recipients.

Key message

Money leaving the charity carries different obligations, not simply mirrored ones. Sanctions screening of partners, contractors and payment routes is a legal duty with criminal penalties. PEP screening of partners and trustees is a governance judgement about influence and control. Screening the people you feed and shelter is neither of those things, and it is the one step regulators warn against.

5. Building a Risk-Based NPO Screening Program

Start with the right axis

The size of the donations is a useful proxy but a poor sole trigger. A £600 gift arriving from an unfamiliar overseas account through a third-party intermediary carries more risk than a £60,000 grant from a known domestic foundation with published accounts. Build the tiers from four inputs together. These inputs include amount, channel, geography, and how much you already know about the giver. A donor you have taken money from for nine years is a different proposition from a first-time major gift, whatever the numbers say.

Sanctions have no threshold

PEP screening can sit behind a threshold, but sanctions cannot. OFSI’s position is that charities and NGOs must comply with financial sanctions, that breach is a criminal offence, and that this requirement applies to all charities and NGOs and their individual staff. The asset freeze prohibition does not allow for any de minimis exceptions. In practice, small online donations are screened by your payment processor rather than by you. This is fine, but only if you know what they screen, against which lists, and how often those lists refresh. Most charities have never asked. Ask, get the answer in writing, and note the gap in your risk assessment rather than assuming your donation threshold discharges the obligation.

The three tiers

Tier 1, routine: Small recurring gifts from known individuals through screened payment channels. Identity capture and Gift Aid records. No PEP screening, no adverse media. Rely on the sanctions filtering provided by your service provider and ensure that you document this reliance.

Tier 2, elevated: Large gifts, new institutional donors, first-time major donors, and any unusual methods of donation (such as crypto, in-kind contributions, or loans) or sources. Sanctions, PEP and adverse media screening. Verify the entity through public registers. Confirm who the actual donor is when funds arrive via an intermediary.

Tier 3, enhanced: This includes confirmed PEP donors, partners in jurisdictions near active threat areas, cash-intensive programmes, and any situation where a Tier 2 check resulted in a significant finding. Source of wealth reconstruction, sign-off by a named trustee or committee, a written rationale, and a scheduled review date.

For small charities, the answer FATF provides

Resource constraint is not a defence, but it is recognised. The Best Practices Paper suggests NPOs with similar activities or locations share internal control procedures and risk management resources and points to umbrella and sector bodies as a route for smaller organisations. Pooled subscriptions to screening tools, shared policy templates and joint training are cheaper than individual licences and produce more consistent decisions.

The trap nobody mentions: Data protection

Screening generates regulated personal data. A screening result that flags sanctions or watchlist status can constitute criminal offence data under Article 10 of the UK GDPR. Without official authority, you need a specific Schedule 1 condition under the Data Protection Act (DPA) 2018, identified and documented before processing begins, alongside an Article 6 lawful basis. Several of those conditions also require an appropriate policy document setting out your compliance measures and retention periods, and consent will often be invalid as a condition because it is not freely given in this context. A charity that buys a screening tool without doing this groundwork has swapped one compliance problem for another.

Practical notes

False positives will dominate your workload. Common names, transliterations and family-member entries generate far more hits than real matches. Build a discounting procedure and record why each hit was cleared. Separate the screening decision from the relationship. The fundraiser who spent two years cultivating a donor should not be the person who signs off the risk assessment.

Checklist

☐ Risk tiers defined by amount, channel, geography and donor familiarity, not amount alone

☐ Written confirmation from your payment provider of what it screens, against which lists, and how often

☐ Sanctions screening is applied without any threshold, which includes partners, contractors, and the entire payment route.

☐ PEP and adverse media screening must be conducted for donors and institutional funders above the Tier 2 trigger

☐ Partner and payment-route screening completed before disbursement, not after

☐ Trustee and senior staff members should undergo screening at the time of appointment, whenever their role changes, and annually thereafter.

☐ Source of wealth procedure for PEP donors, distinct from source of funds

☐ Documented decisions to accept, decline, or accept with conditions must be signed off by someone outside the fundraising team.

☐ False positive discounting procedure with recorded reasoning

☐ Periodic re-screening of active donors and partners, since PEP and sanctions status changes

☐ Article 6 lawful basis, DPA 2018 Schedule 1 condition and appropriate policy document in place before any screening starts

☐ Retention schedule for screening records, including cleared hits

☐ Escalation route defined for suspected criminal property (NCA) and serious incidents (charity regulator)

6. How Sanction Scanner Helps Non-Profits

Everything covered above describes a two-sided screening problem. Money is arriving from donors, money is leaving to partners, contractors, and payment routes, plus the people sitting on the board. Sanction Scanner's AML solution for NGOs maps onto that shape rather than onto a bank's single-customer model.

Coverage on both sides. The platform screens against more than 3,000 sanctions lists, PEP lists, and watchlists across 220+ countries, with data refreshed on a 15-minute cycle and scanning at around 200 milliseconds. The same lookup works for a prospective major donor, an implementing partner, a contractor, or a trustee at appointment. Adverse media screening sits alongside it, which matters for the reputational half of the donor question that sanctions and PEP lists alone will never answer.

Ongoing monitoring solves the problem most charities miss. Section 5 made the point that a clean check today expires. Sanction Scanner runs automated daily re-screening designed to flag changes in the risk profiles of an NGO's donors or partners. This process is the only realistic way to catch a long-standing supporter who takes office or a partner whose chair is designated mid-grant.

Integration for teams without a compliance department. The developer portal provides documentation and SDKs so that AML checks can be automated into existing systems. The wider platform supports API screening, webhooks, custom internal lists, and adjustable match rates for tuning out false positives. For charities running screening off a CRM export rather than an API, batch screening is available on the platform, though it is described on the banking pages rather than the NGO page.

It's worth knowing if your budget is small. Sanction Scanner's free tools (sanction check, PEP check, adverse media check, country risk index, risk exposure calculator) require no account. For a small charity working through a first risk assessment, these are a reasonable way to test where your exposure actually sits before committing to a platform. Beyond those, the paid platform's PEP database, sanctions screening and adverse media screening cover both sides of the NPO money flow.

In conclusion, a screening tool produces a hit, not a decision. Trustees still own the accept, decline, or accept-with-conditions call, still need the source of wealth reasoning behind it, and remain the data controller for everything the screening generates. The tool removes the manual search, not the judgement.

Sources

[1] Financial Action Task Force. Protecting non-profits from abuse for terrorist financing through the risk-based implementation of revised FATF Recommendation 8. 2023.

[2] Financial Conduct Authority. FG25/3: Treatment of politically exposed persons. 2025.

[3] U.S. Department of State. Executive Order 13224. 2001.

[4] U.S. Department of the Treasury. Treasury Disrupts Sham Overseas Charity Networks Funding Hamas and the PFLP. 2025.

Judi Tero

Senior Content Writer

View full profile →