1. PEP Regulation: A special AML tool for corruption deterrence

The manifest relationship between corruption and money laundering across diverse jurisdictions, as explained above, suggests that global AML regulation would be an effective way of controlling corruption. To prevent criminals from easily evading detection by law enforcement authorities, financial institutions are required to assist law enforcement authorities by reporting suspicious activities under global AML regulation. However, this does not explain why corruption requires special attention in relation to global AML regulation when corruption is just one of many predicate crimes.

Specifically targeting only corruption, global AML regulation embraced PEP regulation to impose a higher level of due diligence, EDD, on financial institutions against transactions made with PEPs. As AML has to go through a risk-based analysis, EDD could actually be triggered by many other risk factors, such as the client's business industry or country of origin and the destination or origin country of the transaction. However, identification of PEPs is the only factor that AML regulations explicitly require financial institutions to consider in applying EDD and that is adopted to deter one specific crime: corruption. Though equally as important as PEP, most of the risk factors are not explicitly named by AML regulations as EDD triggering factors. While AML regulations manifestly require transactions made with a correspondent account for certain foreign banks to be under EDD,Footnote ²³ similar to PEP, this is not to deter any specific crime.

This special treatment of corruption from the AML perspective is justified by the seriousness of corruption and its low detection rate. The corrosive effect of corruption on the global community across diverse sectors, not limited to the economy, is widely acknowledged. Its negative effect on economic development has been extensively proven in that corruption reduces a country's attractiveness for investment, capital accumulation, capital inflows, productivity of capital and economic welfare, all of which are interrelated.Footnote ²⁴ In addition, corruption ‘prevents people [particularly the most vulnerable and marginalized people] from fulfilling their political, civil, social, cultural and economic rights’.Footnote ²⁵ Such effects have been recognized by the international society as illustrated in the message of the former Secretary General of the United Nations, Ban Ki-moon, that ‘[c]orruption destroys opportunities and creates rampant inequalities and undermines human rights and good governance, stifles economic growth and distorts markets’.Footnote ²⁶

While society as a whole is a victim of corruption, there is no identifiable victim to report the crime. Victim reporting is a crucial source of crime detection.Footnote ²⁷ However, most acts of bribery, which is one of the most common criminal acts of corruption and is many times referred to interchangeably with corruption,Footnote ²⁸ have no identifiable victim. For instance, a car driver paying a bribe to a police officer to avoid a traffic infringement does not generate any direct victim. Even in those cases where potential or actual individual victims of bribery exist, the victims might fail to recognize the harm caused to them by the bribery. For instance, if a company has paid a bribe to a government official to win a government contract, it is difficult for other bidding competitors to know about the chain of causation between the bribe and the awarding of the contract. The same is true, though to a lesser extent, for other types of criminal acts of corruption, such as abuse of authority or embezzlement.

To complement the lower detection rate for corruption, which undoubtedly causes serious damage to society, a higher AML duty on financial institutions against PEPs is justified. In addition, the recent global trend of active and strong enforcement actions against corruption makes it particularly essential,Footnote ²⁹ as the willing corrupted officers and bribers are expected to put more efforts into laundering the illicit money to avoid such law enforcement actions. Where offenders are struggling to avoid detection and reporting victims are largely absent, the higher AML duty against PEPs imposed on financial institutions as third-party witnesses of corruption is imperative.

2. Possibilities and limitations of global AML/PEP regulations for trans-border coordination

Traditionally, administrative measures have been adopted at the domestic level solely by individual governments. As crimes are globalized, these administrative regulations, including AML/PEP regulations as an instrument to deter crimes, are increasingly made at the international level by various international actors to remove legal loopholes through strong trans-border coordination; thus, there has been a process of harmonization of domestic regulations.

To deter crimes of money laundering and corruption from moving freely across borders, a broad range of international actors have formulated their own forms of global AML/PEP standards.Footnote ³⁰ Not only government agencies vested with treaty-making authority (normally a ministry of foreign affairs) but also purely domestic administrative agencies and private financial institutions have become integrally involved with one another.

Trans-border coordination of the AML/PEP regulations is not an easy task due to discrepancies between two main global standards: the ‘United Nations Convention Against Corruption (UNCAC)’ and the ‘Financial Action Task Force (FAFT)’ recommendations. In 2003, the UNCAC introduced the concept that ‘each State Party … [shall] require banks … to conduct enhanced scrutiny of accounts sought or maintained by or on behalf of individuals who are, or have been, entrusted with prominent public functions and their family members and associates’.Footnote ³¹ The FATF soon followed by adopting a PEP standard in Recommendation 6 of the FATF's 40 Recommendations, which required financial institutions to exercise enhanced due diligence against PEPs, defined as ‘individuals who are or have been entrusted with prominent public functions in a foreign country … ‘.Footnote ³²

In addition to other discrepancies not explored in this article,Footnote ³³ the main discrepancy between the UNCAC and FATF recommendations was whether to include domestic PEPs in the PEP definition. While the UNCAC did not make a distinction between foreign and domestic PEPs, the FATF recommendations clearly limited the PEP regulation to foreign PEPs.

These discrepancies led to a low level of compliance with global PEP regulation,Footnote ³⁴ thus lowering the level of trans-border coordination. As correctly noted by the World Bank, ‘the current variations among approaches serve as both a good excuse not to act and are seen by some as a real impediment to the development and implementation of effective PEPs controls’.Footnote ³⁵ These gaps are easily abused by corrupted officers, as illustrated by the above-mentioned corruption cases.

In February 2012, this main substantive discrepancy was reconciled by the inclusion of domestic PEPs in the FATF Recommendations. The FATF revised its recommendations to require financial institutions to ‘determine whether a customer or beneficial owner is a domestic PEP … [and] to apply the [EDD] measures … [to such persons]’.Footnote ³⁶

That reconciliation is the focus of this research. It helps international society consider the reality instead of the ‘myth’ that foreign PEPs are risky but domestic PEPs are safe.Footnote ³⁷ More importantly, as domestic PEP lists consist, by their very nature, of information possessed by governments (since they mainly concern government employees), the inclusion of domestic PEPs in the FATF Recommendations provides a foundation to incorporate the public–private coordination along the second dimension, two-way information sharing. Before this reconciliation, only one-way reporting by financial institutions to a government was available, as governments were not able to provide information about foreign PEPs that was not in their possession. However, this reconciliation warrants two-way information sharing between individual governments and financial institutions: financial institutions report suspicious activities to a government, and governments provide the information in their possession—the domestic PEP list—to financial institutions to assist their duty to report suspicious activities.

1. A framework of global public–private coordination: Mutual recognition of domestic PEP lists

Domestic PEP lists made by governments are to be shared not only with domestic financial institutions but also with foreign financial institutions. This is not to say that governments should provide lists of both domestic and foreign PEPs. In regard to foreign PEPs, creating a comprehensive list would be a daunting task for governments. Incorporating a duty on governments to issue a list of foreign PEPs to share with their domestic financial institutions into the global AML/PEP regulation is neither practical nor reasonable for the following reasons.

First, a government does not possess the requisite information to issue a foreign PEP list. As foreign PEPs are the employees of foreign governments, without sharing by foreign governments of their own domestic PEP list—which is what I suggest—a government needs to rely mainly on public information, just as financial institutions do. In addition, corruption has a cultural aspect, which may not be easily understood by foreigners, and each government system is different. Thus, it is difficult for a government, as it is for financial institutions, to know in which parts of foreign governments corruption exists or in which sectors it is most prevalent and who has the authority that can be most readily abused for personal gain.

Second, although a government may have better sources of information on foreign PEPs through its agencies cooperating with foreign governments or collecting foreign intelligence when compared with financial institutions that solely rely on publicly available information, the gathering of information on senior foreign officers would still be incomplete, financially costly and sometimes politically risky. More importantly, the information secretly gathered would remain confidential, which would undermine the fundamental basis for public–private coordination.

Accordingly, it is suggested that each government should establish its own domestic PEP list and share it with domestic and foreign financial institutions that need such information to carry out their AML/PEP duties to report suspicions of corruption under the global AML/PEP regulations. With the inclusion of domestic PEPs into the FATF recommendations, there seem to be stronger justifications for such public–private coordination.

Mutual recognition should underpin this global public–private coordination, as it provides the principles governing the recognition of foreign laws, regulations, standards and certification procedures among States.Footnote ⁵⁵ The especially important aspect of mutual recognition is that it would allow us to live with our differencesFootnote ⁵⁶ but within the limits set by the international standards; this could provide great benefit for global AML/PEP regulation, as corruption is to some extent culturally specific to each society. This mutual recognition would be operationalized in a manner whereby the domestic PEP list created by each government would be recognized by foreign financial institutions and obviously by domestic financial institutions, as well.

2. Minimum requirements for a global AML/PEP regulatory body

For successful implementation of global public–private coordination based on mutual recognition of domestic PEP lists, the global AML/PEP regulatory body, whether it is the UN or the FATF, should respect three essential values: accountability of States providing the list to foreign States/financial institutions, accountability to the listed domestic PEPs and protection of the PEPs’ privacy. For each of these three values to be realized, the global AML/PEP regulatory body would need to introduce certain institutional and procedural measures into its regulations. Neglecting these values and failing to embrace the required institutional and procedural measures would result in the global AML/PEP regulatory body's failure to attain legitimacy and effectiveness. Each of the three key minimum requirements is discussed in turn below.

The first minimum requirement—accountability of States providing the list to foreign States/financial institutions—is essential, as the global public–private coordination suggested in this article is based on the assumption that all States will provide complete, authentic and reliable information of domestic PEPs without cheating others receiving the same information. To see whether and how—under which institutional and procedural manners—States would be motivated to do so, it is necessary to first consider the characteristics of the information being shared by States.

The domestic PEP list mainly consists of sensitive information in relation to which it is difficult to establish trust—the essential component of information sharing—between the States providing the information and those receiving it.Footnote ⁵⁷ This lack of trust compromises the completeness and authenticity of the shared information.

The domestic PEP list should include identifiable information about the senior government officials of each State. Though there exists a lack of harmonization in the PEP definitions of global standards, the core aspects of PEPs, which are agreed upon even among diverse definitions, is that PEPs are the senior government officials. The PEP list is the identifiable information—names, positions, dates of birth, identification numbers and photos—of those individuals so that bank tellers can use the information to discern whether the client is a PEP or not.

As national interest shapes the behaviours of States competing with each other,Footnote ⁵⁸ States are unlikely to voluntarily and unilaterally share complete, authentic and reliable information on their senior officers with other States, particularly in the field of national security (military or intelligence). States providing the domestic PEP list would be anxious about potential abuse of the shared information by foreign States receiving the information.

This raises the following questions: will there be a formalized agreement to impose a duty on States to share domestic PEP lists, and will this be incorporated into global AML/PEP regulations?

As deterrence of corruption through strong AML is a public good that benefits every constituent of this interconnected international society,Footnote ⁵⁹ States are incentivized to mutually share the requisite PEP information. However, as long as the risk of harm to their national interests by sharing exists, States will enter into such agreements only when the incentives eclipse such risk.

Furthermore, even when formalized information sharing is attained through the global AML/PEP regulatory body, upholding trust between States is not guaranteed. States may freely breach such a duty by withholding some information to pursue their own national interests,Footnote ⁶⁰ as international society lacks a supranational government with law enforcement authority. However, pursuing State self-interest would not be the only reason for such non-compliance. As domestic political interest obviates the enforcement of international law at the domestic level,Footnote ⁶¹ there exists the risk of a ruling party of the State abusing its power to prepare the domestic PEP list unfairly and partially to suppress opposition parties. This concern about possible cheating reinforces the motivation of States not to enter into a formalized information sharing agreement.

Accordingly, for the formalized information sharing agreement to be operationalized, institutional and procedural measures would have to be adopted to reduce the concerns of States: namely, the risk of harm to their national interests and potential cheating by other States.

First, to prevent States from cheating and to encourage compliance, it is essential for the global AML/PEP regulatory body to supervise State practices with ‘an auditing device that checks at an appropriate frequency the integrity of the data submitted by the participants and penalizes by an appropriate amount the cheating behaviors’.Footnote ⁶²

To check the domestic PEP list prepared by each State, the global AML/PEP regulatory body would need a centralized repository of international PEP lists managed by itself rather than decentralized international PEP data centres managed by each State. The former occurs where States proactively provide and simultaneously update the data of domestic PEP lists in the international PEPs data centre to which access by all financial institutions is allowed. The latter is where each State establishes its own international PEPs data centre utilizing the domestic PEP data shared by foreign States and allows access by its domestic financial institutions.

Checks by the global AML/PEP regulatory body under the decentralized international PEP data centres, apart from the apparent high management cost from the perspective of an international society,Footnote ⁶³ are less likely to overcome the problems of cheating by and distrust between States. A global AML/PEP regulatory body under the decentralized international PEP data centres would have to rely on the reactive information provided by States in response to periodic audit requests. This leaves room for States to cheat by providing the information detached from the actual information accessed by financial institutions. To prevent such cheating, the verification of the integrity of the reactive information would require on-site inspections. However, on-site inspections are not only expensive but also conditioned upon active cooperation from States, which is not guaranteed.

To appropriately penalize non-compliance by States, the global AML/PEP regulatory body would require the authority to impose FATF-style soft sanctions. As the stakes involved with global AML/PEP regulation are small compared to those of international laws on war crimes or territorial limits,Footnote ⁶⁴ there does not necessarily need to be a military or economic sanction but rather a soft sanction.Footnote ⁶⁵ A good example would be mutual evaluation and the ‘naming and shaming’ utilized by the FATF, one of the global AML/PEP regulatory bodies, to make Member States (and sometimes even non-Member States) comply with its recommendations.Footnote ⁶⁶ Designating ‘non-cooperative countries and territories (NCCTs)’ and requiring Member States to take FATF Recommendation 19 countermeasures against NCCTs have demonstrated effectiveness in encouraging compliance.Footnote ⁶⁷

Second, to eliminate or at least minimize the risk of harm to their national interests by such sharing, it is essential for the proposed centralized international PEP data centre to eliminate unnecessary State involvement. Financial institutions would be allowed to directly, not indirectly through their own domestic States, access and query the international PEP data centre. As it is the financial institutions, not the States, that have the responsibility to detect suspected corruption by utilizing the PEP list, there is no reason for the PEP list to be indirectly processed by the States to reach the financial institutions. This will address the concerns of States providing domestic PEP lists about possible abuse of the shared information by the receiving States. Supported by the supervisory role of the global AML/PEP regulatory body, the international PEP data centre would help achieve this objective by preventing States from cheating, such as coercing their domestic financial institutions to provide the PEP information shared by foreign States.

The next minimum requirement that must be satisfied by the proposed AML/PEP regulatory body is accountability to the listed PEPs. As illustrated in the previous section, all current privately collated PEP lists (created in-house or sourced commercially from CDPs) require procedural measures to secure accountability to innocently listed PEPs, particularly the false PEPs.Footnote ⁶⁸ There is a high possibility of financial institutions overly broadening their lists of PEPs. The public–private coordination proposed in this study would largely eliminate this possibility by decreasing compliance costs and enhancing the completeness of the PEP lists. However, the suggested public–private coordination wherein States establish a list of domestic PEPs and share it with domestic and foreign financial institutions will still be required to embrace procedural measures to secure accountability to the listed PEPs.

Accountability to the listed PEPs is required as a matter of principle in administrative law under the suggested approach of public–private coordination, unlike the former argument that accountability to the listed PEPs was desirable as a matter of policy to protect wrongly listed PEPs under the privately created PEP lists.Footnote ⁶⁹ As a part of domestic governance,Footnote ⁷⁰ discretionary decisions of administrative agencies are required as a principle of administrative law to be made ‘in a manner that is informed and responsive to the wide range of social and economic interests and values affected by their decision’.Footnote ⁷¹ Many international organizations such as the World Bank, the IMF and the OECD have emphasized that the principle of accountability is to be upheld by States.Footnote ⁷²

The suggested system of public–private coordination involves an administrative decision, which requires the exercise of discretion by an administrative agency affecting the rights and interests of the subject of the decision. In deciding who the domestic PEPs are, the administrative agency needs to exercise its discretion. This is not comparable with the list of, for example, sex offenders, whose cases have been previously decided and reviewed by the judiciary,Footnote ⁷³ or the list of stolen passports, which are objective facts reported by the victims of crime.Footnote ⁷⁴ Once someone is included in the domestic PEP list, that person will be under higher surveillance by financial institutions. In addition, though less probable under the public–private coordination than under the privately made PEP lists, there still remains a risk of PEPs being disabled from carrying out daily financial activities.

Accordingly, the suggested public–private coordination should respect the accountability principle. More importantly, such accountability measures should be embraced particularly by the global AML/PEP regulations at the international level, not simply by an individual State at the domestic level.

The domestic PEP list issued by a State under the suggested public–private coordination would not simply be a domestic administrative decision but a global administrative decision with international ramifications. All States’ decisions regarding their own domestic PEP lists would be mutually recognized by financial institutions in foreign States. Such decisions would impact not only domestic financial institutions but also foreign financial institutions, forcing them to comply with a regulatory AML duty. Therefore, their decisions would affect the rights and interests of the listed PEPs both domestically and internationally.

However, as ‘the domestic system of political and legal accountability and control … would apply to purely domestic regulatory measures,’Footnote ⁷⁵ not to the global regulatory measures, the global AML/PEP regulatory body adopting the proposed public–private coordination would need to employ measures at the international level to secure accountability by respecting the values of ‘transparency, participation, reasoned decision and decisional review’.Footnote ⁷⁶ Having learned lessons from similar types of global administrative decisions generally described as a type of GAL, the proposed global AML/PEP regulatory body should incorporate the following: procedural measures requiring States to secure accountability at the domestic level and independent international procedural measures to secure accountability at the international level.

First, embracing the procedural requirements to secure the accountability of global AML/PEP regulation is necessary for the global AML/PEP regulatory body to control the different domestic PEP list review procedures of each State. Some global regulatory bodies have already adopted administrative law decision-making and rule-making procedures with ‘which national authorit[ies] should conform in order to assure their compliance and accountability with the international regime’.Footnote ⁷⁷

Such procedural control by the global regulatory body would be essential to overcome the inherent weakness of mutual recognition, as procedural differences in list-making by States may easily lead a State to deny recognition of another State's administrative decisions. The case involving Schengen lists elucidated the importance of procedural control at the international level. In the Hamssaoui and Forabosco cases, the French Conseil d'Etat ruled against the lawfulness of the entry on the SIS made by another Member State, Germany, because Germany failed to provide sufficient information for the claimant regarding their listing in the Schengen system.Footnote ⁷⁸

As illustrated below, various specific procedures would need to be implemented by the global AML/PEP regulation, and it is worth noting that those procedural measures are feasible and practical only when States make their own domestic (but not foreign) PEP lists, as proposed in this article. Procedural safeguards to attain transparent and non-discriminatory administrative decisions, such as participation of opposing party members or civil groups in PEP list making, is practical only with domestic PEP lists. Additionally, notice to the affected individual is required to make informed and responsive administrative decisions. With regard to foreign PEP list making, it is difficult to require States to give notice to all foreign PEPs around the world. From the perspective of listed foreign PEPs, it is suggested that they should receive notice from each State and then petition for a review to each foreign State where they are listed as PEPs. By comparison, when States prepare domestic PEP lists, they are required to give notice only to their domestic personnel. It is also much easier for the listed PEPs to petition for review and hold the decision maker accountable at the domestic level.

Procedural control by the global regulatory body will fail to overcome the inherent weakness of mutual recognition if the required accountability procedures are not actually implemented by States. Thus, without monitoring the State's implementation, a global AML/PEP regulatory body will fail to achieve the contractual norm for mutual recognition.Footnote ⁷⁹ While accountability to other States requires the supervisory role of a global AML/PEP regulatory body to monitor the substance of the listed PEPs, this accountability to the listed PEPs demands the same supervisory role regarding the procedure of PEP list making.

Second, the proposed global AML/PEP regulatory body needs to establish its own independent international procedural measures to secure accountability at the international level. In contrast to the other procedures to secure accountability, such as notice and participation, which are to be properly adopted at the domestic level, the petition could be made even (or sometimes necessarily) at the international level in addition to the domestic level.

For instance, the ‘UN Security Council (SC)’ 1267 Committee has been criticized for its lack of accountability in compiling a consolidated list of terrorist individuals and entities to be sanctioned.Footnote ⁸⁰ The list is prepared and publicized by the SC 1267 Committee based on the information supplied by States, and the sanction imposed on such listed individuals and entities is carried out by the private sector, which accesses the publicized list.Footnote ⁸¹ To be delisted, individuals have to go through a complicated process at both the domestic and international levels.Footnote ⁸² Thus, to secure accountability, the committee reformed its procedure by supplying the listed individuals and entities a channel, the Office of the Ombudsperson, to make a direct petition and review request for delisting.Footnote ⁸³

The global AML/PEP regulatory body should create an international body, such as the Office of the Ombudsperson of the SC 1267 Committee, to provide listed PEPs a direct channel for petitions for review. The public–private coordination involved in a global AML/PEP regulatory body suggested in this article is similar to the SC 1267 Committee in that the list of individuals provided by States is accessed and used by the private sector in a way that negatively affects the rights and interests of the listed individuals. To overcome the analogous accountability barrier, the global AML/PEP regulatory body would need its own Office of the Ombudsperson.

The third minimum requirement—the protection of PEPs’ privacy rights—is required to overcome the expected privacy issues under the suggested global public–private coordination model. The current AML/PEP regime does not trigger privacy issues, as it is financial institutions or CDPs that prepare the PEP list. This is because the financial institutions or CDPs gather the requisite ‘personal identifiable information (PII)’ about PEPs from public sources. Financial institutions allow their employees to access the information in identifying clients as PEPs, and higher due diligence is applied in carrying out their AML duties to detect corruption. They do not publicize the information but protect it as a business secret. However, even if they do publicize it, no invasion of privacy will occur, since it is based on already publicly available information.

In contrast, the suggested global AML/PEP regulatory body, which would facilitate the sharing of States’ PEP lists with financial institutions, could raise privacy concerns. While the PEP list would be more complete, since it would contain information about their own employees, the information possessed and disclosed by States would not be limited to information that is already in the public domain. To clarify the position, it is necessary to determine whether the PII about PEPs should be protected from disclosure or disclosed to financial institutions in the public interest as an exception.

The protection of PII from disclosure is limited rather than absolute. Although Article 17 of the ICCPR does not contain a permissible limitation clause, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression recognizes permissible limitations on the right to privacy, subject to necessary, legitimate and proportionate restrictions.Footnote ⁸⁴ EU General Data Protection Regulation also authorizes Member States to adopt legislative measures restricting privacy rights as long as those measures are necessary and proportional to safeguard ‘the prevention, investigation, detection or prosecution of criminal offences’.Footnote ⁸⁵ Data controllers under the jurisdiction of EU General Data Protection Regulation are endorsed to carry out data processing necessary to comply with such legal obligations.Footnote ⁸⁶

Domestic courts have discussed legitimacy, necessity and proportionality, the three conditions stipulated in the ICCPR and EU General Data Protection Regulation. In the US, particularly in relation to exposing the records of public officers, the courts have interpreted the three conditions as follows:

As regards the first element, as public officials, PEPs have lower levels of legitimate privacy expectation than other people. Thus, the suggested global AML/PEP regulatory body could more justifiably share information about PEPs.

Generally, a person's name, date of birth, identification numbers, address, phone number and financial status, etc, are considered protected PII, the access to and disclosure of which are strictly limited, even though the privacy laws of each State differ in the scope and level of privacy protection.Footnote ⁸⁸ Ordinarily, people have a legitimate expectation that their PII will not be disclosed. However, publication of such information about public officials can be legitimate. For instance, the laws of many States require public officials to declare their assets, including information concerning their name, address, account number and location of assets, and to allow public access to such information, though to different degrees due to privacy concerns.Footnote ⁸⁹ Similarly, federal and some state laws in the US expressly permit public inspection of information about state employees, including their names and position titles, their current and prior positions, dates of appointment and resignation, etc.Footnote ⁹⁰ Even information regarding a public employee's home/work address or the income of their family can be accessible, denying reasonable privacy expectations of public employees.Footnote ⁹¹

Even where there is a legitimate expectation of non-disclosure, such as information concerning race, full birth dates or phone numbers,Footnote ⁹² disclosure could be justified on the basis of there being a compelling State interest if the means employed are the least intrusive measures necessary.

This part focuses on this third element—the least intrusive measure—since the second element (a compelling interest in disclosing the information about PEPs, namely, deterrence of corruption and money laundering) is fully discussed throughout this article.Footnote ⁹³ The measures that are the least intrusive to the privacy of PEPs would be employed, with appropriate procedures in place to control to whom and how the disclosure should be made.

As regards whom, disclosure should be limited to the fewest parties required to achieve the compelling interest of corruption deterrence. The best possible procedural measure would be to allow disclosure to financial institutions through the global AML/PEP regulatory body working as a centralized repository of an international PEP list.

Ideally, the privacy of PEPs would be best protected by there being a decentralized domestic PEP data centre with each State establishing its domestic PEP list and allowing it to be directly accessed by both domestic and foreign financial institutions.Footnote ⁹⁴ This direct sharing would not involve unnecessary additional intermediaries, such as the global AML/PEP regulatory body, and would be limited to the ultimate users of the information.

However, in addition to a lack of accountability to other States,Footnote ⁹⁵ the use of decentralized domestic PEP data centres does not seem plausible. If each State maintained its own domestic PEP data centre, there would be very high and redundant management costs,Footnote ⁹⁶ which could be eliminated by having just one centralized international PEP data centre.Footnote ⁹⁷

Accordingly, indirect sharing through the proposed global AML/PEP regulatory body acting as an international PEP data centre offers the best practical protection to the privacy of PEPs by minimizing the involvement of intermediaries. Although other types of indirect sharing could be achieved through foreign States or public means (ie, by each State establishing its domestic PEP list and providing the list to foreign States whose financial institutions have authorized access or publicizing the list so financial institutions could access it), both involve expansive disclosure of PEPs’ personal information and are thus more invasive to the privacy of PEPs.

More importantly, in the matter of how, it should be emphasized that the concern about the privacy rights of PEPs could be significantly addressed by controlling the manner of access by financial institutions to PEP data.

Therefore, it is proposed that disclosure to financial institutions should be made via a case-specific reactive query matched against the information already in their possession so that the extent of the protected PII of PEPs disclosed to the institutions can be minimized or even eliminated. This contrasts with the expansive invasion of PEPs’ privacy potentially caused by financial institutions having access to the PII of PEPs as a whole.

Under the case-specific reactive query match, to identify whether certain clients are PEPs or not, financial institutions would access the PEP data centre by submitting PII information of the client (eg, names, date of birth, identification numbers, address and phone numbers) in their possession presented voluntarily by the client to open an account. The PEP data centre would then provide those financial institutions with the result of their specific query. If there is a match against the query, the result would include only the information about the current and prior positions, the dates of appointment and separation, etc, of a specific PEP, which is generally not regarded as information in relation to which public officers have a legitimate expectation of privacy.