Anti-Bribery Compliance: Third Parties, Gifts, and What the Doj Finds

The UK Bribery Act 2010 Section 7 imposes strict liability on a commercial organization when a person associated with it bribes another person intending to obtain or retain business for the organization, with a complete defense available only when the organization can demonstrate that it had in place adequate procedures designed to prevent persons associated with it from committing bribery.

The UK Ministry of Justice's guidance on adequate procedures identifies six principles: proportionate procedures calibrated to the organization's bribery risk; top-level commitment from senior management; risk assessment of the organization's actual bribery exposure across its operations; due diligence on persons who will perform services on the organization's behalf; communication and training that makes the procedures known to all relevant personnel; and monitoring and review of the procedures to ensure their continued effectiveness. An organization that can satisfy all six principles has a complete defense regardless of whether a bribery occurred, while an organization that cannot demonstrate proportionate adherence to all six principles has no defense even if only a single incident occurred.

The adequate procedures standard is more demanding than the FCPA's implicit compliance program credit, which rewards programs that are reasonable under the circumstances rather than requiring affirmative proof of adequate procedures as a defense. A multinational company subject to both the FCPA and the UK Bribery Act should design its anti-bribery compliance program to the higher adequate procedures standard, because a program that satisfies the UK Bribery Act defense will also satisfy the FCPA's compliance program expectations in any subsequent U.S. .nforcement review. An attorney who handles global anti-corruption and multi-jurisdiction compliance matters can evaluate whether the current program satisfies the adequate procedures standard across every jurisdiction where the company operates.

Successor liability is among the most significant risks in international M&A transactions, because the DOJ and SEC have consistently held that a company that acquires a business subject to FCPA jurisdiction assumes legal responsibility for the pre-acquisition bribery of the acquired entity, regardless of whether the acquirer knew of the bribery at the time of closing.

The DOJ's approach to successor liability creates a direct compliance imperative for pre-acquisition due diligence: a company that conducts thorough anti-bribery due diligence before closing, discovers and discloses pre-existing FCPA violations to the DOJ, and promptly remediates the violations after closing is positioned to negotiate the most favorable resolution of the inherited liability. A company that closes an acquisition without adequate anti-bribery due diligence, discovers pre-closing bribery after the fact, and must then decide whether to self-disclose violations it did not create is in a significantly worse position than the company that identified the problem before committing to the transaction.

Post-acquisition integration requires the acquired entity's compliance program to be elevated to the acquirer's standards within the timeframes the DOJ considers reasonable, typically twelve months for initial integration and eighteen months for full program integration. A company that acquires a business in a high-risk market and then allows the acquired entity to continue operating under its pre-acquisition compliance framework for two years without integration has not satisfied the post-acquisition remediation expectation that the DOJ and SEC express in their corporate enforcement guidance. An attorney who handles anti-corruption investigations and M&A compliance matters can structure the pre-acquisition anti-bribery due diligence protocol and post-closing integration timeline.

Facilitation payments, small payments made to low-level government officials to expedite routine administrative actions to which the company is already entitled, are permitted under a narrow FCPA exception but are categorically prohibited under the UK Bribery Act. A company that permits facilitation payments under an FCPA compliance framework while also operating in UK Bribery Act jurisdiction has created a policy conflict that exposes the company to UK prosecution for payments it believes are legally protected. The compliance program must address this conflict explicitly, and the practical answer for most multinationals is a global facilitation payment prohibition that eliminates the policy inconsistency, even in jurisdictions where a legal defense technically exists.

When anti-bribery compliance monitoring or a whistleblower report identifies a potential FCPA violation, the response protocol determines whether the company's subsequent voluntary disclosure and cooperation will receive maximum credit or will be viewed as a delayed and incomplete response.

An effective internal investigation response requires promptly securing the relevant documents and data before evidence is altered or destroyed, identifying and interviewing the witnesses while their recollections are fresh and before they have coordinated their accounts, and segregating the internal investigation from the business personnel responsible for the underlying transactions to prevent the appearance of a managed investigation. The investigation must be conducted by outside counsel reporting directly to the audit committee rather than to management, because management may be among the subjects of the investigation, and the outside counsel's independence is a prerequisite for the DOJ to credit the investigation's findings as reliable.

The internal investigation's scope must be broad enough to identify systemic compliance failures rather than only the specific transactions that triggered the initial concern, because a narrow investigation that resolves the known issue while leaving related conduct unaddressed creates a future disclosure problem when the related conduct is later discovered. An attorney who handles government and internal investigations and internal investigation services matters can design the investigation protocol that satisfies the DOJ's requirements for a reliable internal investigation and maximizes the cooperation credit available.

Anti-bribery compliance is the set of policies, procedures, controls, training, and monitoring mechanisms a company maintains to prevent, detect, and respond to bribery in its operations and through its third-party relationships. A global program must address the FCPA's prohibition on payments to foreign government officials by U.S. .ssuers, domestic concerns, and their agents; the UK Bribery Act's broader prohibition on all bribery including commercial bribery with its Section 7 corporate liability and adequate procedures defense; applicable local anti-bribery laws in each country of operation; and the OECD Convention's requirements for companies headquartered in signatory countries. The UK Bribery Act applies to any company with a UK nexus regardless of where the bribery occurs, making it the most broadly applicable statute for multinationals.

Third-party anti-bribery compliance requires risk-based due diligence at onboarding calibrated to the third party's country risk, industry risk, level of government interaction, and compensation structure; periodic re-screening to update the due diligence as the third party's activities and the risk landscape change; contractual representations and warranties requiring the third party to comply with applicable anti-bribery laws; audit rights that allow the company to review the third party's books when red flags are identified; training specific to the third party's role and the bribery risks it faces; and monitoring of third-party payment patterns that identifies transactions inconsistent with contracted services. A due diligence process that completes a questionnaire at onboarding and does nothing more does not satisfy the proportionate procedures standard.

The UK Bribery Act Section 7 imposes corporate liability when a person associated with the company commits bribery intending to benefit the company, with no requirement to prove corporate knowledge or intent. The adequate procedures defense under Section 9 requires the company to demonstrate that it had in place procedures proportionate to the bribery risk it faced, that were supported by top-level commitment, based on a documented risk assessment, applied through due diligence on associated persons, communicated through training and internal messaging, and monitored and reviewed for ongoing effectiveness. The defense requires proving all six components, and a program that satisfies five of six does not qualify. This makes the UK Bribery Act standard more demanding than the FCPA's compliance program credit, because the UK defense is binary rather than a factor in mitigation.

A company should evaluate voluntary self-disclosure when an internal investigation identifies conduct that appears to satisfy the FCPA's elements, when the DOJ or SEC is likely to discover the conduct through an independent source, and when the company can demonstrate an effective pre-existing compliance program and genuine willingness to cooperate fully with the government's investigation. The DOJ's Corporate Enforcement Policy creates a presumption of declination for companies that voluntarily and timely self-disclose, fully cooperate, and timely remediate, making disclosure the path most likely to avoid a criminal conviction and compliance monitor. A company that self-discloses a violation before it is discovered and then cooperates fully with the investigation is in a fundamentally different position than a company that waits for the DOJ to arrive.

Successor liability under the FCPA means that an acquirer inherits legal responsibility for the pre-acquisition bribery of the target company, regardless of whether the acquirer knew of the bribery at closing. The DOJ and SEC have brought FCPA enforcement actions against acquirers for pre-acquisition conduct of acquired companies when the acquirer failed to conduct adequate anti-bribery due diligence, failed to disclose pre-acquisition violations it discovered, or failed to remediate the violations promptly after closing. Pre-acquisition due diligence for FCPA risk should review the target's third-party agent relationships, books and records for unusual payment patterns, prior FCPA-related internal investigations, and the adequacy of the target's anti-bribery compliance program. An attorney who handles anti-corruption litigation and M&A anti-bribery due diligence matters can design the pre-acquisition protocol that identifies violations before the liability transfers.

ISO 37001 is an international standard for anti-bribery management systems that specifies the requirements for implementing, maintaining, and improving an anti-bribery compliance program, providing a framework that aligns with the DOJ/SEC's guidance on effective compliance programs and the UK Bribery Act's adequate procedures principles. Certification under ISO 37001 by an accredited third-party auditor provides an objective assessment of whether the organization's anti-bribery program satisfies internationally recognized standards, which can be relevant evidence in enforcement proceedings that the program was genuine and effective rather than merely paper-based. Certification does not guarantee protection from enforcement when violations occur, but it demonstrates that the organization invested in an externally validated program that meets international benchmarks. An attorney who handles investigations, compliance and ethics and anti-bribery certification matters can evaluate whether ISO 37001 certification is appropriate for the company's risk profile.