Brunei's PEP guideline: foreign PEPs are automatically higher risk, domestic PEPs are assessed by risk

Implications for lenders

Lenders onboarding customers in Brunei need to screen for PEPs at onboarding and during the relationship, treating foreign PEPs as higher risk in every case. Applications from high-risk customers or PEPs call for enhanced checks, enhanced transaction monitoring and at least an annual review. CDD and EDD records, including screening results, must be kept for 7 years.

Implications

Facts

The Financial Intelligence Unit of Brunei Darussalam Central Bank (BDCB) issued Guidelines No. FIU/G-1/2025/1 on the Identification and Management of High-Risk Customers and Politically Exposed Persons on 19 December 2025. The guideline is issued under Section 30(c) of the Criminal Asset Recovery Order, 2012 (CARO) and applies to financial institutions and designated non-financial businesses and professions (DNFBPs). Terms such as PEP, family member, close associate and enhanced due diligence take their meaning from Section 2 of CARO.

Identifying high-risk customers is risk-based. A link to a high-risk jurisdiction does not on its own make a customer high risk; the guideline gives a non-exhaustive list of indicators in an appendix.

Foreign PEPs are to be treated automatically as higher risk. Domestic PEPs are treated as high risk where their activities pose a higher money-laundering or terrorist-financing risk, under a risk-based approach. Institutions are encouraged, but not required, to identify family members and close associates of PEPs and keep a record of them in a database.

The guideline sets no fixed period after which a former office holder stops being treated as a PEP. Declassification is a risk-based decision that considers the person's former rank and seniority, the time since the last prominent function, remaining formal or informal influence, and media exposure or adverse information.

Enhanced due diligence may be done manually (document requests, public records, social media and news) or with automated real-time and regular screening against identification, media and sanctions databases. Institutions should apply enhanced transaction monitoring to all transactions of high-risk customers, with automated systems encouraged for larger firms, and review high-risk customers and PEPs at least annually and when a trigger event occurs. For life insurance and takaful, senior management must be informed before a policy pays out to a high-risk beneficiary.

All CDD and EDD information and documents, including suspicious transaction reports, must be kept for 7 years under Section 14 of CARO. ¹ The guideline also calls for written procedures, independent compliance testing and staff training. Measures for customers onboarded without face-to-face contact are set out in a separate BDCB notice and guideline on non-face-to-face onboarding.

Analysis

The split between foreign and domestic PEPs follows the approach of the FATF Recommendations, which require enhanced measures for all foreign PEPs and risk-based measures for domestic ones. What the Brunei guideline leaves to institutions is notable: family members and close associates are only encouraged to be identified, and there is no fixed cooling-off period for former PEPs. Lenders therefore have to document their own risk assessment for each declassification decision.

The record-keeping period of 7 years is shorter than the at least 10 years that Cambodia's central bank requires asset management institutions to keep records of acquired non-performing loans ², though the Cambodian rule covers a different type of record. For a digital lender, the practical point is that screening results, the reasons for a risk rating and review dates all fall within the documents that must be kept.

Counterpoints and uncertainties

The guideline relies on CARO definitions that are not repeated in it, and its appendix of high-risk indicators is non-exhaustive, so institutions may interpret it differently. The guideline says the appendix of indicators will be updated periodically, and any update to the non-face-to-face onboarding notice could change how e-KYC is applied to high-risk customers.