PEP Source of Wealth and an Approver Who Owns the Relationship
Meridian Private Bank, a US bank subsidiary, serves 340 relationships with a $5 million minimum in investable assets. Sixty clients are politically exposed persons, 22 of them connected to jurisdictions the bank's own country matrix rates high risk. Policy requires corroborated source of wealth, senior management approval, and annual review for PEPs. You review 45 files weighted toward PEPs and high-risk countries. Fourteen describe source of wealth only as business ownership or family wealth with no supporting documents; three of those were approved by the same senior manager, who also receives origination credit on the relationships. PEP screening runs at onboarding against a vendor list with no documented periodic rescreen. One file shows a client's spouse added as a joint holder in 2023 and coded standard, with no connected-party link recorded. Annual reviews for 11 PEPs are between 14 and 22 months old.
1. How would you determine whether these are isolated file errors or a systemic CDD weakness?
Read the worked answer
Start from the population rather than the sample. Query the CDD system for how many of the 340 relationships have a source-of-wealth field containing only narrative labels with no evidence attachment; how many PEP approvals carry the same approver; how many joint holders or connected parties were added after onboarding without recoding; and the aging distribution of annual reviews across the whole book.
If 14 of 45 reviewed files, about 31 percent, lack corroboration and the pattern clusters by approver or by relationship type, the weakness is systemic by design rather than individual error. The senior manager approving files on which he earns origination credit points to a segregation-of-duties flaw, not carelessness. The joint holder coded standard suggests the system does not propagate risk automatically from a connected PEP, which is a configurable rule and therefore a design gap.
Test whether the 11 stale reviews are random or concentrated in one team, and compare the book's PEP and high-risk-country concentration against the assumptions in the risk assessment. Also confirm whether the 45-file sample was representative, since it was deliberately weighted.
The evidence supports a systemic EDD deficiency in corroboration, ongoing screening, and approval independence. That shifts remediation from retraining toward redesign plus a lookback across the full PEP population.
2. Design the tests for the independence of EDD approval and for the reliability of the PEP determination process.
Read the worked answer
For approval, obtain the authority matrix and test every EDD approval in the population, not just the sample: who approved, whether the approver was independent of the relationship manager, whether seniority met policy, and whether approval was documented before onboarding or transaction activity. One individual approving and also earning origination credit on the same relationship fails segregation of duties regardless of intent.
For PEP determination, test the process end to end. Confirm which PEP and relative-and-close-associate lists are used and how often they refresh. Examine matching configuration, including fuzzy thresholds and handling of names in non-Latin scripts. Test how potential matches are cleared and by whom, and whether rescreening occurs on a defined cycle or on trigger events such as a change of role or a new designation. Re-perform screening on a sample of 20 clients against the current list to see whether matches are being missed, and inspect ten cleared false positives to confirm clearing is documented with identifiers rather than name alone.
Then test connected parties: walk a joint-holder addition through the workflow and observe whether risk rating and PEP status propagate.
Finally, look back across the senior manager's whole portfolio, since three failures already surfaced.
3. How would you characterize severity and what remediation would you prioritize and later validate?
Read the worked answer
Severity turns on whether the bank could have detected and reported suspicious activity. Uncorroborated source of wealth for PEPs tied to high-risk jurisdictions is exactly the population EDD exists to protect. Without corroboration the bank cannot demonstrate it knows the source of funds, so I would report a significant deficiency unless testing shows the documents exist elsewhere and were merely misfiled.
Prioritized recommendations: immediately look back at all 60 PEPs and the 22 high-risk-jurisdiction relationships, exiting or enhancing those whose wealth cannot be corroborated; remove origination credit from approvers and require an independent approval path; configure automatic risk propagation for joint holders and connected parties; implement periodic rescreening with a defined frequency and trigger events; and add quality control that samples EDD files monthly.
Validation should not accept training as closure. Re-test a sample after 90 days, confirm the backlog is cleared with dated evidence, and report the percentage of PEP files with corroborated wealth to the audit committee. Also confirm whether any relationship warrants a SAR or exit review before remediation finishes, since that decision cannot wait for the program fix.