Foreign Corrupt Practices Act Consulting

The exposure is rarely the bribe. It is the third party who paid it.

US enforcement of the Foreign Corrupt Practices Act has narrowed since 2025, but the statute is unchanged. Third-party relationships can create exposure, making it important to establish who is acting on your behalf in a difficult market and what that person is being paid for.

What the Act actually reaches

The FCPA’s anti-bribery provisions prohibit covered persons and entities from corruptly offering, promising or giving anything of value to a foreign official to obtain or retain business or direct business to another person. Two features make it wider than most people expect. Third-party payments can create liability where the required knowledge is established, including conscious avoidance. Agency rules also matter when attributing an agent’s acts and knowledge to an organization. Its accounting provisions — which apply to issuers with securities registered under Section 12 of the Securities Exchange Act or reporting obligations under Section 15(d), and require books that accurately reflect transactions, and adequate internal controls — are enforced independently and can support enforcement even where an anti-bribery charge is not brought.

Our work is the investigative half of managing that: establishing who your intermediaries are, what stands behind them, and whether your program does anything when it is tested.

What the work covers

Third-party relationships can present warning signs that require investigation: an agent who secures a permit unusually fast, a distributor whose margin is unexplained, a consultant retained shortly before an award, a joint-venture partner whose ownership includes someone’s relative. Third-party liability depends on the relevant statutory and agency requirements; conscious avoidance can satisfy the knowledge requirement, but negligence alone does not.

We work on the parts of that problem that are established by investigation rather than by policy: who your intermediaries actually are, what they were paid and for what, whether the ownership behind them includes a government official or their family, and whether the books reflect the transaction accurately. The accounting provisions of the FCPA are enforced independently of the anti-bribery provisions and can support enforcement even where an anti-bribery charge is not brought.

We also test whether an existing program works in the field. A compliance program is evidenced by what a regional sales manager under quota pressure actually does, rather than by what its manual says when a local partner asks for an unusual payment, and whether anyone would hear about it if they agreed.

What we are not. We are not your counsel and we do not give legal opinions on the Act. Where a matter looks like it may require disclosure, the right next call is to your lawyers, and we work alongside them — often through litigation support — rather than in place of them.

How the engagement runs

Four stages, scoped to the markets and relationships that actually carry risk.

1. Mapping the third parties

We build the actual list of agents, distributors, consultants, customs brokers, freight forwarders and joint-venture partners acting for you in higher-risk markets. This list is almost always longer than the one procurement holds, because relationships get added locally and never travel back to head office.

2. Testing the ones that matter

Risk is not evenly spread, so neither is the work. We take the relationships where the combination of jurisdiction, government touchpoint and payment pattern is most exposed, and establish beneficial ownership, political connections, and whether the commercial rationale holds. This is due diligence applied to a specific statutory risk.

3. Assessing the program as it operates

We test the program against practice: whether training reaches the people who face the decision, whether the reporting channel is trusted enough to be used, whether gifts and hospitality approvals are real controls or a formality, and whether anyone has ever been told no.

4. Remediation, documented

Findings become a prioritized list with owners and dates, and the work of closing them is recorded. That record is the asset. It is what turns “we take compliance seriously” into something you can hand to a regulator.

When to commission one

US enforcement of the Act has narrowed since 2025, but the statute is unchanged, and the pattern of when organizations wish they had looked earlier is consistent:

• Before entering a market where government contact is unavoidable — licensing, customs, utilities, public procurement.
• Before an acquisition. Successor liability is real: where the target was already subject to the FCPA you can inherit conduct that predates your ownership, although an acquisition does not create liability that never existed. That is why this work sits close to mergers and acquisitions support.
• When an intermediary relationship has grown materially without anyone re-examining it.
• On a whistleblower report, an internal audit finding, or an unexplained payment — where the priority is establishing scope quickly and preserving evidence properly.
• When a counterparty, lender or insurer asks for evidence of your program and you do not have a current answer.

What you get

A written report your counsel and your board can both use:

• The full third-party population, risk-ranked, with the basis for each ranking.
• Findings on the relationships examined — ownership, political exposure, payment rationale.
• An assessment of the compliance program as it operates, not as written.
• A remediation plan with owners and dates.
• A clear separation of what is established, what is indicative, and what could not be resolved.

Straight answers

What is our FCPA exposure?
It is largely a function of three things: how many intermediaries act for you, how often your business requires a government decision, and how well you can evidence what those intermediaries were paid for. Most organizations can answer the first two and not the third.

Does the Act apply to us if we are not a US company?
Frequently, yes. Its reach extends beyond US issuers, and other regimes — notably the UK Bribery Act — impose comparable or broader obligations. The practical answer is that if you are asking, the mapping exercise is worth doing regardless of which statute ultimately bites. Which one applies is a question for your lawyers.

Do our programs prove effective in the field?
That is testable and rarely tested. The gap between a program that exists and one that operates is where enforcement risk lives.

How do we document and report non-compliance?
Carefully, early, and with counsel involved from the start — because how a finding is recorded affects privilege and what disclosure obligations attach. Get the lawyers in before the internal email chain has been written.

Will an investigation make things worse if we find something?
This is the real question behind most hesitation. Finding a problem yourself, scoping it properly and remediating it is a materially better position than having it found for you. What is unhelpful is a half-scoped internal look that surfaces enough to establish knowledge and not enough to define the extent.