Anti-Bribery and Corruption Policy

An Anti-Bribery and Corruption Policy in the United States sets out the rules and standards the organisation expects those it covers to follow.

The FCPA was enacted in 1977 following the Watergate-era disclosures that over 400 U.S. companies had made questionable or illegal payments exceeding $300 million to foreign government officials, politicians, and political parties. The FCPA contains two distinct sets of provisions: the anti-bribery provisions (15 U.S.C. 78dd-1 through 78dd-3), which prohibit the offer, promise, or payment of anything of value to a foreign government official for the purpose of obtaining or retaining business or securing an improper advantage; and the books-and-records provisions (15 U.S.C. 78m(b)), which require issuers of securities to maintain accurate financial records and a system of adequate internal accounting controls. The DOJ Criminal Division's Fraud Section and the SEC Enforcement Division jointly enforce the FCPA.

The Sarbanes-Oxley Act of 2002 (SOX) strengthened the internal controls framework applicable to public companies by imposing requirements for CEO and CFO certification of financial statements under SOX Section 302, mandating independent audit committee oversight under Section 301, and establishing whistleblower protections under Section 806 (18 U.S.C. 1514A). SOX Section 404 requires management and external auditors to assess and report on the effectiveness of internal controls over financial reporting, which includes anti-bribery controls for companies with foreign operations. The Public Company Accounting Oversight Board (PCAOB) sets the auditing standards for these assessments.

Domestic bribery is addressed separately by 18 U.S.C. 201, which prohibits offering, giving, soliciting, or receiving anything of value to influence the official acts of federal public officials. The Travel Act (18 U.S.C. 1952) extends federal jurisdiction to bribery schemes that use interstate or foreign commerce, allowing federal prosecution of bribery that violates state law when the mails, telephone, or internet are used. Commercial bribery between private parties is addressed by state commercial bribery statutes, including New York Penal Law Section 180.00 and California Penal Code Section 641.3, and may also give rise to wire fraud charges under 18 U.S.C. 1343.

The DOJ and SEC published the FCPA Resource Guide in 2012 (updated 2020), which provides detailed guidance on the statute's application, the elements of an effective compliance program, and the factors the DOJ considers in making charging decisions. The DOJ's Evaluation of Corporate Compliance Programs, most recently updated in 2023, provides the specific framework prosecutors use to assess whether a company's anti-bribery compliance program is well designed, adequately resourced, and effective in practice.

An Anti-Bribery and Corruption Policy is needed in the United States by every organization that operates internationally or interacts with government officials at the federal, state, or local level, regardless of size or industry.

Publicly traded companies registered with the SEC are subject to both the anti-bribery provisions and the books-and-records provisions of the FCPA. The SEC actively enforces the books-and-records provisions under 15 U.S.C. 78m(b) even in cases where no bribe was proven, if the company's internal controls were inadequate. SEC enforcement actions against companies including Walmart (2019, $282 million resolution), Ericsson (2019, $1 billion resolution), and Goldman Sachs (2020, $2.9 billion resolution in the 1MDB matter) demonstrate the scale of penalties for FCPA violations.

Private companies are subject to the FCPA anti-bribery provisions if they qualify as domestic concerns under 15 U.S.C. 78dd-2 — meaning any U.S. citizen, national, resident, or business organized under U.S. law — or if they commit any act in furtherance of a corrupt payment while in the territory of the United States under 15 U.S.C. 78dd-3. Private equity firms and their portfolio companies face particular risk because the DOJ has increased scrutiny of PE-backed companies operating in high-risk jurisdictions.

Government contractors at the federal, state, and local level need anti-bribery policies because the Federal Acquisition Regulation (FAR) 52.203-13 requires contractors with contracts over $5 million and performance periods exceeding 120 days to maintain a written code of business ethics and conduct, including anti-bribery provisions. Contractors convicted of FCPA violations face mandatory debarment under FAR 9.406-2.

Organizations entering new international markets — particularly in countries ranked as high-risk by Transparency International's Corruption Perceptions Index, such as operations in parts of Africa, Asia, Latin America, and the Middle East — should establish or update their anti-bribery policy before commencing operations. Companies engaging third-party agents, consultants, distributors, or joint venture partners in foreign markets face heightened FCPA risk because over 90 percent of FCPA enforcement actions involve payments made through intermediaries.

Companies undergoing mergers or acquisitions should conduct anti-bribery due diligence on target companies, as the DOJ has stated in Opinion Procedure Release 08-02 and subsequent guidance that acquiring companies may inherit FCPA liability for the target's pre-acquisition conduct. Organizations that also operate in the United Kingdom or other OECD jurisdictions should align their policy with the UK Bribery Act 2010, which has broader reach than the FCPA and no facilitation payments exception.

An Anti-Bribery and Corruption Policy for the United States must address the following elements to satisfy the requirements of the FCPA, the DOJ Evaluation of Corporate Compliance Programs (2023), and the U.S. Sentencing Guidelines Section 8B2.1.

The policy statement must clearly articulate the organization's zero-tolerance approach to bribery and corruption. The DOJ Evaluation specifically asks whether senior management has demonstrated commitment to the compliance program through actions and statements, creating what prosecutors call the "tone at the top." The policy should be signed by the CEO or board chair and distributed to all employees, contractors, and third-party intermediaries.

The legal framework section should identify all applicable anti-bribery statutes, including the FCPA anti-bribery provisions (15 U.S.C. 78dd-1 through 78dd-3), the FCPA books-and-records provisions (15 U.S.C. 78m(b)), the domestic bribery statute (18 U.S.C. 201), the Travel Act (18 U.S.C. 1952), mail and wire fraud statutes (18 U.S.C. 1341, 1343), and applicable state commercial bribery laws. Organizations with international operations should also reference the UK Bribery Act 2010 and the OECD Anti-Bribery Convention.

The prohibited conduct section should define bribery broadly to include payments to foreign government officials, domestic public officials, and private commercial counterparties. The definition of "foreign official" under the FCPA is expansive, covering employees of government agencies, state-owned enterprises, public international organizations, and political parties. The policy should address both direct payments and payments made through third-party intermediaries, and should cover offers, promises, and authorizations of payments — not merely actual payments.

Gifts and hospitality provisions must establish clear monetary thresholds for pre-approval, impose categorical prohibitions for interactions with government officials above specified amounts, and require contemporaneous documentation. The forms-legal.com Anti-Bribery Policy template includes a structured gifts-and-hospitality section covering approval workflows, documentation requirements, and escalation procedures aligned with DOJ expectations for risk-based controls.

Third-party due diligence procedures should address agents, consultants, distributors, customs brokers, logistics providers, joint venture partners, and any other intermediary who may interact with government officials on the organization's behalf. The DOJ expects risk-based, tiered due diligence that includes sanctions screening through OFAC's Specially Designated Nationals (SDN) list, adverse media searches, country risk assessment using Transparency International or World Bank indicators, reference checks, and contractual anti-corruption representations and audit rights.

The books-and-records section must reflect the FCPA requirement under 15 U.S.C. 78m(b)(2) for issuers to maintain records that accurately and fairly reflect transactions and dispositions of assets and to maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are executed in accordance with management's authorization. Record retention periods should comply with SEC Rule 17a-4 and applicable state record retention laws.

The reporting and whistleblower protection section should describe confidential and anonymous reporting channels, including hotlines and web-based reporting platforms, and reference the anti-retaliation protections available under the Dodd-Frank Act's SEC Whistleblower Program (15 U.S.C. 78u-6) and SOX Section 806 (18 U.S.C. 1514A). Organizations should also reference the DOJ Corporate Enforcement Policy, which provides incentives for voluntary self-disclosure of FCPA violations.

Training requirements should specify annual training for all employees, enhanced training for high-risk functions (sales, procurement, government affairs, finance), and specialized training for third-party intermediaries. The DOJ evaluates whether training is risk-based, periodically updated, tested for effectiveness, and documented with attendance records.