Director risk screening is the process of checking a named individual against PEP lists, sanctions registers and adverse media sources before you accept a client engagement or approve a new appointment. For accountants in Ireland and the UK, this check sits at the centre of your AML obligations under the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021 and the Money Laundering Regulations 2017.
This guide covers what PEP, sanctions and adverse media screening involves in practice, what regulators expect from your firm's records, and how to evaluate the evidence your screening process produces. The Search4less Due Diligence add-on runs checks that surface PEPs, global sanctions and adverse media hits, returning results you can save directly to the client file.
PEP screening is a check you run against global PEP databases to determine if an individual holds, or has recently held, a prominent public function. FATF Recommendation 12 sets the international standard here, and Recommendation 22 extends it to designated non-financial businesses and professions, which includes accountants.
For Irish firms, the framework is the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021, supported by the CCAB-I a for accountants. Firms acting on UK matters will be working to the Money Laundering Regulations 2017 and the associated professional body guidance.
In practice, PEP status does not mean the individual is corrupt or that you need to decline the engagement. It means the risk assessment changes, and your firm needs to apply enhanced CDD measures, including senior management approval and ongoing monitoring of the relationship.
The definition covers individuals who hold or have held high-profile political roles: heads of state, senior politicians, members of the judiciary, military officers and board members of state-owned enterprises. It also extends to immediate family members and known close associates.
For accountants running director risk checks, this means screening each director and beneficial owner, not just the primary client contact. A director who sits on a state body board, or whose spouse holds a government position, triggers PEP classification and the corresponding enhanced due diligence requirements.
Under both Irish and UK rules, a person remains classified as a PEP for at least 12 months after leaving office. In practice, many firms extend their enhanced monitoring beyond this minimum, applying a risk-based approach to determine when standard due diligence levels can resume.
That last point matters more than it sounds. A director who left a government role 18 months ago may still carry elevated risk depending on the jurisdiction and the nature of their previous position. Your firm's risk assessment needs to account for this.
Sanctions screening confirms that an individual or entity is not subject to financial restrictions imposed by the EU, UN, UK (OFSI) or US (OFAC). Unlike PEP screening, which triggers enhanced due diligence, a confirmed sanctions match stops the engagement and brings its own set of obligations.
All natural and legal persons must comply with financial sanctions. This is not optional and not limited to firms in the financial sector. If a director appears on a sanctions list, you have a legal obligation not to transfer funds or make economic resources available to that person, directly or indirectly.
For Irish firms, the relevant registers include the EU Consolidated Sanctions List and the UN Security Council Sanctions List. Firms that deal with UK-connected matters will also need to check the OFSI Consolidated List. If your clients have US business connections, the OFAC Specially Designated Nationals List is relevant too.
Running these checks manually across multiple registers takes time and introduces room for error. The Search4less Due Diligence add-on pulls from multiple sanctions databases in a single search, presenting results as potential matches for you to assess rather than as conclusions.
Screening results are presented as potential matches, not conclusions. Name matching is deliberately broad, so a report may surface someone with a similar name in another jurisdiction. That is the correct behaviour for a screening tool.
Your role is to review each potential match, compare the identifying details against what you know about the individual, and record your assessment. Recording that you reviewed a potential match and discounted it, with reasoning, is itself part of the evidence trail.
Declining the engagement is not the end of it. Where you hold funds or economic resources belonging to a designated person, you are required to freeze them and report the match to the relevant authority. In Ireland that means reporting to the competent authority named in the specific EU regulation, in most cases the Department of Finance or the Central Bank, and to An Garda Síochána. In the UK, reports go to OFSI.
Both jurisdictions also operate a licensing regime, so there are limited circumstances in which a transaction involving a designated person can be authorised in advance. If you hit a confirmed match, take advice before doing anything with client funds or files, including returning them.
Adverse media screening searches global news sources, regulatory publications and legal databases for negative coverage linked to an individual or entity. This covers fraud allegations, money laundering investigations, regulatory enforcement actions, court proceedings and similar items.
Regulators in Ireland and the UK expect firms to include adverse media checks as part of their risk assessment process. A director may pass PEP and sanctions screening but still carry elevated risk if they are the subject of ongoing criminal proceedings or recent regulatory action.
For director-level risk assessments, the relevant categories include financial crime (fraud, money laundering, tax evasion), regulatory enforcement (sanctions by a professional body or financial regulator) and legal proceedings (civil or criminal cases involving dishonesty or breach of fiduciary duty).
Not every negative article is material. The risk assessment needs to distinguish between verified regulatory or legal actions and unsubstantiated media speculation. In practice, a dated regulatory enforcement notice carries more weight than an anonymous online complaint.
PEP and sanctions screening checks fixed databases with defined update cycles. Adverse media fills the gaps between those cycles. A director may not appear on any sanctions list or PEP register yet still be the subject of an active fraud investigation reported in the press.
Running all three checks together gives you a fuller picture of director-level risk at the point of onboarding. The Search4less Due Diligence add-on surfaces PEPs, sanctions and adverse media hits in a single report, so the evidence sits in one place rather than being assembled from separate sources.
If what you find gives you a suspicion of money laundering or terrorist financing, the reporting duty is separate from your decision on whether to take the client. In Ireland, suspicious transaction reports go to FIU Ireland and to the Revenue Commissioners. In the UK, suspicious activity reports go to the National Crime Agency.
That obligation applies whether or not you proceed with the engagement, and the tipping-off restrictions mean you should not tell the client you have made a report. Your firm's MLRO should be involved before any decision is taken.
Regulators expect firms to show they have taken reasonable steps to identify and assess risk at onboarding, on a risk-based approach. For standard-risk clients, this typically means company status verification, identification and verification of the beneficial owners. For higher-risk clients, it extends to PEP screening, sanctions checks and beneficial ownership analysis.
In Ireland, the Criminal Justice Acts 2010 to 2021 place obligations on designated persons, which includes auditors, external accountants and tax advisers. You are required to carry out a client risk assessment, identify and verify the parties associated with your client, and apply the appropriate level of due diligence based on the outcome.
Customer due diligence records must be kept for five years after the client relationship ends. Training and risk assessment records follow the same five-year retention period. All records must be secure and maintained in line with data protection rules.
The point is not just carrying out the check. It is being able to produce the record afterwards, dated, for the specific client in question. A report with a clear date stamp showing what was checked and what the data returned at that moment is usable evidence. A note written from memory three months later is not.
Standard due diligence applies to clients assessed as normal risk. It covers identification and verification of the client and beneficial owners, understanding the nature and purpose of the business relationship, and ongoing monitoring on a risk-appropriate basis.
Enhanced due diligence (EDD) applies when a client or connected individual is identified as a PEP, when the client is established in a high-risk third country, or when your firm's own risk assessment identifies elevated risk factors. EDD means verifying the source of wealth and source of funds, obtaining senior management approval for the engagement, and increasing the frequency of ongoing monitoring.
The level of due diligence applied, whether simplified, standard or enhanced, determines the extent of verification required, the degree of ongoing monitoring and the need for senior management sign-off. Getting this classification right at onboarding saves rework later.
A PEP hit on any director or beneficial owner triggers EDD for the entire engagement. The same applies if a director is established in a jurisdiction listed as high-risk by the EU or FATF. Adverse media hits do not automatically trigger EDD, but they should inform your risk assessment and may tip the balance towards enhanced measures.
In practice, the decision sits with the engagement partner or compliance officer. Your screening report and risk assessment documentation should contain enough detail for a reviewer to understand why you applied standard or enhanced measures to a given client.
Director risk checks follow a consistent process, regardless of the size of your firm. The approach applies equally to a sole practitioner onboarding a new audit client and to a mid-tier firm taking on a corporate advisory engagement.
Start by identifying every director and beneficial owner associated with the client entity. For Irish companies, the company search function in Search4less gives you up-to-date CRO data on directors and shareholders. For UK entities, Companies House data is available through the UK Search add-on, included on Search4less Pro.
You are required to verify beneficial owners against the Central Register of Beneficial Ownership (RBO) before establishing a client relationship. Where you identify a discrepancy between your own records and those on the register, you must notify the Registrar.
Once you have identified the individuals, run your screening checks. For each director and beneficial owner, you need PEP screening, sanctions screening and adverse media screening. Running these separately across different services adds time and creates gaps in your evidence trail.
The Search4less Due Diligence add-on covers 14 databases, returning PEP, sanctions and adverse media results in a single output. The report carries a date stamp showing when the check was run and what the data showed at that point.
Review each result against the information you hold on the individual. A PEP match means applying enhanced due diligence, not automatically declining the client. A confirmed sanctions match means you cannot proceed, and brings the freezing and reporting obligations set out above.
For adverse media hits, assess the source, the recency of the report and the relevance to your client relationship. Record your assessment, including the reasoning behind any decision to proceed or to decline. This record is your compliance evidence.
Save the screening report and your written assessment to the client file. The report itself, showing what was checked, when, and what the results were, is your primary evidence. Your written assessment of any matches or flags completes the record.
A page reading "no sanctions found" against the date you searched is evidence, and it is stronger than a report that simply omits the section. In practice, you download the report at onboarding and save it to the client file. Reports generated in Search4less carry a timestamp and are available for download directly after the search.
Since the introduction of the Central Register of Beneficial Ownership (RBO) in Ireland, firms are required to verify beneficial owners against the register before establishing a client relationship. The register records individuals who hold more than 25% of the shares or voting rights in a company, or who otherwise exercise control.
It is worth being clear on the distinction here. Shareholder information filed with the CRO on the B1 annual return is not the same thing as the RBO filing, and it does not replace it. What the CRO data does is give you an independent view of the ownership structure, which is how most discrepancies get spotted in the first place.
Search4less gives you shareholder data alongside CRO information, and Pro subscribers also get beneficial owner details per B1 and an annual return cap table. Use that to sense-check what the client has told you, then verify against the RBO itself and notify the Registrar if the two do not line up.
If your firm acts on both Irish and UK matters, you are working across two regulatory frameworks. The Irish CJ Acts and the UK MLR 2017 overlap in most areas but differ on specifics, including some beneficial ownership reporting requirements and the way each regime approaches domestic PEPs.
Both frameworks now cover domestic PEPs as well as foreign ones. The practical difference is that FCA guidance directs UK firms to treat domestic PEPs as lower risk in the first instance, unless other factors suggest otherwise. Irish firms should not assume the same starting position applies.
Search4less Pro includes the UK Search add-on, giving you Companies House data alongside Irish CRO records. That means you can run director and company checks for both jurisdictions from a single service, with the results appearing in the same report format.
AML compliance does not end at onboarding. Your firm needs ongoing monitoring procedures that detect changes in a client's risk profile over the life of the relationship. This includes re-running PEP, sanctions and adverse media checks at intervals defined by your firm's risk-based approach.
Company-level changes are easier to keep on top of if they come to you. The Customised Watchlist on Search4less Pro lets you set alerts for changes to company records, so you are notified when new filings or status changes occur rather than finding out at the next review. Watchlist entries are charged at €1 plus VAT per company per year.
The frequency depends on the risk level. Higher-risk clients, including those with PEP connections, should be re-screened at least annually. Standard-risk clients may be re-screened less frequently, but your firm's policies and procedures need to define these intervals.
A change in circumstance, such as a director appointment, a change in beneficial ownership, or a client moving into a new business area, should trigger an ad hoc review regardless of where you are in the regular cycle.
If you are comparing due diligence services, these are the criteria that decide whether the evidence you end up with is usable.
The screening tool should cover PEPs, sanctions and adverse media in a single search. If you need to run three separate checks across three different services, you are adding time and increasing the risk of gaps in your records.
The Search4less Due Diligence add-on covers all three in one report, with results drawn from 14 databases. Each report carries the date, the search terms used and the data returned at the point of the search.
Evidence auditability is the ability to show, with a clear dated trail, exactly what checks were carried out, when they were run and what the underlying data showed at that moment. Your screening software should produce reports that can be stored and retrieved as-is, without needing to be reconstructed or annotated after the fact.
Look for date-stamped outputs that record the search parameters and the results. If the software produces a summary without showing the underlying data, the evidence may not hold up under review.
Sanctions lists and PEP databases are updated frequently. A screening tool that runs against a database snapshot from last month may miss a listing that was added yesterday. Search4less returns results at the point of search rather than from a stored snapshot, so what you see reflects the current state of the underlying registers.
For adverse media, this matters even more. A news report published last week about a director facing fraud charges will not appear in a database that was last refreshed a quarter ago.
If your firm handles dozens of client onboardings each quarter, transactional pricing for each check adds up. Search4less runs on a fixed annual subscription rather than per-search charges, and every tier includes limitless CRO filing downloads.
This matters for firms that need to re-screen existing clients periodically, not just at onboarding. A fixed annual fee removes the cost barrier to running checks as often as your risk assessment requires.
Running a company-level check without screening the individual directors and beneficial owners leaves a gap in your records. Regulators expect person-level checks, not just entity-level checks. A company may be clean on the register while one of its directors carries a PEP classification or sanctions listing.
A search that returns no matches is still evidence. A report showing "no PEPs found", "no sanctions found" and "no adverse media found" against a specific date is a record of due diligence carried out. If your screening tool does not produce a report for a clean result, the absence of evidence is a weakness in your compliance file.
Client risk profiles change. A director who passed screening two years ago may now be under investigation or may have been added to a sanctions list. If your firm's policies do not include periodic re-screening, your onboarding records become stale evidence that does not reflect the current risk position.
Director risk screening is one part of a broader AML compliance programme, but it is the part that produces the most visible evidence in a file review. Your screening records show a regulator or auditor exactly what you checked, when you checked it, and what you found.
If you are running director risk checks regularly, it is worth checking that your screening process captures PEPs, sanctions and adverse media in a single dated report. You can see the full feature breakdown on the Search4less pricing page.
PEP screening identifies individuals who hold or have held prominent public functions. Accountants need it because regulators require enhanced due diligence for clients who are PEPs or closely associated with PEPs. The Search4less Due Diligence add-on flags PEP matches automatically during director risk checks.
Irish accountants should check the EU Consolidated Sanctions List, the UN Security Council Sanctions List and, where relevant, the UK OFSI Consolidated List and the US OFAC SDN List. Search4less screens against multiple sanctions databases in a single search, covering the registers relevant to Irish and UK engagements.
Adverse media screening searches global news, regulatory publications and legal databases for negative coverage linked to a named individual. It catches risk factors that PEP and sanctions databases may not yet reflect. Adverse media checks are included in the Search4less Due Diligence add-on.
You cannot proceed with the engagement, and you may have freezing and reporting obligations depending on what you hold. Reports go to the relevant competent authority and An Garda Síochána in Ireland, or to OFSI in the UK. Take advice before returning funds or files, as that can itself be a breach.
Higher-risk clients should be re-screened at least annually. Standard-risk clients can be re-screened at longer intervals, defined by your firm's policies. Any material change in circumstance, such as a new director appointment, should trigger an immediate review.
You need to keep the screening report, your risk assessment and any written reasoning for decisions taken on the basis of the results. Records must be retained for five years after the end of the client relationship, in line with CDD requirements under both Irish and UK AML rules.
PEP status does not automatically disqualify a client. It requires your firm to apply enhanced due diligence, including source-of-wealth verification, senior management approval and more frequent ongoing monitoring. The decision to proceed is a professional judgement call for your firm's compliance team.
Due Diligence is one of three add-ons. Pro includes all three, so PEP, sanctions and adverse media screening is covered as standard. On Plus you choose one add-on, so you can select Due Diligence if that is your priority. Standard does not include it.