Checklist · Commercial

Building an Anti-Corruption Compliance Program: A Practical Checklist

15 U.S.C. § 78

Type: Checklist
Jurisdiction: National
Date: 2025-05-13
Topic: Commercial

A build-and-operate checklist for an anti-corruption program that would survive scrutiny under both the FCPA hallmarks and the UK Bribery Act adequate procedures defense. Phases one through three establish the foundation: governance and the compliance function's authority and resources, the documented risk assessment that drives where resources go, and the policy set with the facilitation payment decision made explicitly. Phases four through eight cover the domains where cases actually arise: the third-party lifecycle from diligence through payment approval and ongoing monitoring, gifts and travel and entertainment with the controls that prevent drift, charitable contributions and sponsorships, hiring and referrals including candidates connected to government customers, and the books-and-records and internal controls obligations that generate more enforcement than bribery does. Phases nine through twelve cover transactions and structures: payment and cash controls, merger and acquisition diligence and post-closing integration, joint venture governance, and training targeted by role and risk. Phases thirteen through eighteen cover operation: reporting channels and investigation protocol, discipline and incentives, testing and audit, mapping the program against the UK six principles, cross-border data and privilege constraints, and disclosure readiness. A worked example runs a fictional multinational through a first-year build.

Building an Anti-Corruption Compliance Program: A Practical Checklist

Commercial > Anti-Corruption | Published 13 May 2025 - Updated 27 June 2026 | UpLaw - uplaw.us

Enforcement agencies ask three questions of any compliance program. Is it well designed? Is it adequately resourced and empowered? Does it work in practice? The third question is the one most programs fail, and it is answered only by evidence — testing performed, investigations conducted, discipline actually imposed, and changes made in response to findings. A binder full of policies nobody has tested answers the first question and none of the others.

Keywords: risk assessment, third-party diligence, red flags, GTE policy, charitable contributions, hiring, books and records, payment controls, M&A diligence, JV governance, training, hotline, discipline, testing, adequate procedures

Work this as a program build, then operate it on the cycle in Phases 15–18. The doctrinal treatment is in The Foreign Corrupt Practices Act: A Comprehensive Guide to Anti-Bribery, Books and Records, and Global Enforcement. The narrative overview is Grease, Gifts, and Third Parties: Where FCPA Cases Actually Come From.

Our running example. Verdant Terminals, Inc. (fictional), a U.S.-listed logistics company with port operations in three Southeast Asian countries, 40 third-party agents and brokers, one minority joint venture, and a pending acquisition of Halcyon Renewables plc (fictional), a UK company.

Phase 1 — Governance and authority

[ ] Obtain a board-level resolution adopting the program and assigning oversight to a named committee.
[ ] Appoint a Chief Compliance Officer with direct reporting access to the board or audit committee, independent of the business units monitored.
[ ] Document the compliance function's budget, headcount, and authority — including authority to stop a transaction.
[ ] Establish a compliance committee with cross-functional membership (legal, finance, internal audit, HR, procurement, business).
[ ] Document tone at the top in a way that is evidence: leadership communications, resourcing decisions, and at least one instance where compliance's position prevailed over commercial preference.
[ ] Establish reporting to the board on a fixed cadence, with metrics.
[ ] Confirm the CCO's removal requires board involvement.

Why it matters, and the traps. "Adequately resourced and empowered" is assessed on evidence, not organizational charts. The single most persuasive fact is a documented instance where the business wanted to proceed and compliance said no and was sustained. Most programs cannot produce one.

Phase 2 — Risk assessment

[ ] Inventory countries of operation, sale, sourcing, and transit, and score against recognized corruption indices.
[ ] Inventory government touchpoints: customs, licensing, permitting, inspections, tax, procurement, utilities, immigration, and any state-owned counterparty.
[ ] Identify counterparties that may be instrumentalities under the Esquenazi factors — state-owned enterprises, public hospitals, national carriers, sovereign funds, public universities.
[ ] Inventory third parties by type, country, spend, and government interface.
[ ] Inventory transaction types with elevated risk: bidding for government contracts, obtaining licenses, clearing customs, resolving disputes with regulators.
[ ] Score inherent risk, evaluate existing controls, and identify residual risk.
[ ] Document the assessment, the methodology, and the resulting resource allocation.
[ ] Refresh annually, and on any material change — new market, new acquisition, new business line.

Why it matters, and the traps. The risk assessment is the document that justifies every other choice in the program. A program that spends equally on low-risk and high-risk markets is not risk-based and will be criticized as such.

Do not outsource the country risk judgment to an index alone. A low-risk country with a state-owned customer and a percentage-fee agent is a higher-risk engagement than a high-risk country with direct sales to private buyers.

Phase 3 — Policies

[ ] Adopt a code of conduct and a standalone anti-corruption policy, translated into the working languages of every operating location.
[ ] Make the facilitation payment decision explicitly: prohibit them, with a narrow, documented exception only for payments under duress where health or safety is at risk, requiring immediate reporting and accurate recording.
[ ] State that the policy applies to third parties acting on the company's behalf.
[ ] Adopt the gifts, travel, and entertainment policy (Phase 5).
[ ] Adopt the charitable and political contribution policy (Phase 6).
[ ] Adopt the third-party engagement policy (Phase 4).
[ ] Adopt a books and records policy stating that every payment must be recorded accurately in reasonable detail.
[ ] State the consequences for violation, including termination and referral.
[ ] Establish a documented exception and escalation process — policies without one are ignored rather than followed.
[ ] Obtain annual certifications from employees in covered roles.

Why it matters, and the traps. Prohibiting facilitation payments is the right answer even though the FCPA permits them, because the UK Bribery Act does not, local law never does, and companies that permit them do not record them accurately — which converts a lawful payment into an accounting violation. Make the decision deliberately and write down the reasoning.

Phase 4 — The third-party lifecycle

This is where most cases come from. Build it as a lifecycle, not a form.

Engagement

[ ] Require a documented business justification for every intermediary: what service, why an intermediary is needed, and who else was considered.
[ ] Require an approved requester in the business, not the intermediary's advocate.
[ ] Apply risk-tiered diligence: questionnaire and screening for all; enhanced diligence including ownership tracing, reference checks, and local counsel input for high-risk.
[ ] Screen for government ownership or officials among beneficial owners, directors, and family.
[ ] Screen against sanctions, debarment, and adverse media databases.
[ ] Benchmark the fee against market rates for the service.
[ ] Document the resolution of every red flag — the failure mode is diligence performed and findings unresolved.

Red flags requiring resolution before engagement

[ ] The intermediary was recommended or required by the government customer.
[ ] The fee is disproportionate or structured as a percentage of contract value for a service normally billed hourly.
[ ] The intermediary is a shell with no offices, staff, or verifiable track record.
[ ] The intermediary requests offshore payment, payment to a third party, or payment in cash.
[ ] The intermediary refuses to sign anti-corruption representations or grant audit rights.
[ ] The intermediary has family or business ties to officials with decision authority.
[ ] The relationship is proposed immediately before a major award.
[ ] There is no clear answer to "what exactly will they do?"

Contracting

[ ] Anti-corruption representations and warranties and ongoing covenants.
[ ] Audit and inspection rights over books relating to the engagement.
[ ] Termination right for violation or credible suspicion, without penalty.
[ ] Right to withhold payment pending investigation.
[ ] Prohibition on subcontracting without approval.
[ ] Requirement to certify compliance periodically and to complete training.
[ ] Fee terms tied to defined, documentable deliverables.
[ ] Payment only to the contracting entity, in the country of performance, to a bank account in the entity's own name.

Operation

[ ] Require evidence of services performed before payment — reports, correspondence, deliverables.
[ ] Require invoice detail sufficient to identify the work.
[ ] Apply a payment approval control independent of the requesting business unit.
[ ] Monitor spend against the approved scope and investigate variances.
[ ] Re-diligence on a risk-based cycle and on any change in ownership or scope.
[ ] Exercise audit rights on a sample basis — a right never exercised is worth little.
[ ] Maintain a central third-party register with status, risk tier, diligence date, and spend.

Offboarding

[ ] Terminate promptly on unresolved concerns and document the reason.
[ ] Preserve records for the applicable limitations period plus a margin.

Phase 5 — Gifts, travel, and entertainment

[ ] Set monetary thresholds by recipient type, with pre-approval above them.
[ ] Prohibit cash and cash equivalents, including gift cards.
[ ] For travel: pay the government entity, not the individual; pay vendors directly; no per diem in cash.
[ ] Exclude family members and non-business components.
[ ] Require a documented itinerary with substantive business content on each day.
[ ] Require modest, business-appropriate accommodations and transport.
[ ] Require written confirmation that acceptance is permitted under the recipient's own rules where obtainable.
[ ] Track cumulative value per recipient per year, not only per-event value.
[ ] Require accurate recording with recipient, purpose, and amount.
[ ] Prohibit anything given while a decision affecting the company is pending.

Why it matters, and the traps. The failure pattern is drift. Each step is individually defensible: a plant tour, then a weekend, then a spouse, then a shopping allowance. The record that defeats the drift is the cumulative tracking — and almost no company does it.

Phase 6 — Charitable contributions, sponsorships, and political activity

[ ] Require compliance approval for any charitable contribution or sponsorship in a country with government touchpoints.
[ ] Perform diligence on the beneficiary: ownership, leadership, and connections to officials with decision authority over the company.
[ ] Require a documented business rationale unconnected to any pending matter.
[ ] Require a written agreement restricting use of funds, with reporting and audit rights.
[ ] Prohibit contributions requested by an official or made at an official's suggestion, absent specific senior approval and documentation.
[ ] Address political contributions — prohibit, or centralize approval with a local law analysis for each.
[ ] Record accurately in the books.

Phase 7 — Hiring and referrals

[ ] Require compliance review for any candidate connected to a government customer, regulator, or state-owned counterparty.
[ ] Document the merit-based selection process for such candidates on the same terms as any other.
[ ] Do not maintain any system that tracks candidates by government referral source in a way that ties hires to business.
[ ] Prohibit creating positions for referred candidates.
[ ] Apply the same controls to internships and to third parties' hiring at the company's request.
[ ] Train HR on the issue — it will not be obvious to them.

Why it matters, and the traps. Multiple substantial enforcement actions have rested on referral-hiring programs. The evidence was internal: spreadsheets correlating hires with business awarded, and emails discussing a candidate's sponsor rather than qualifications. The candidate's competence is not a defense.

Phase 8 — Books, records, and internal controls

[ ] Confirm that every payment is recorded accurately and in reasonable detail under 15 U.S.C. § 78m(b)(2)(A) — note this is not a financial-statement materiality standard.
[ ] Prohibit generic account codes ("consulting," "marketing," "miscellaneous") for third-party spend without descriptive detail.
[ ] Maintain internal accounting controls under § 78m(b)(2)(B): authorization, recording, asset access, and periodic comparison.
[ ] Map controls over third-party engagement, payment approval, GTE spend, petty cash, and journal entries.
[ ] Establish segregation of duties in every location, including small ones — this is where controls fail.
[ ] Prohibit off-books accounts and unrecorded funds absolutely.
[ ] Apply the same standards to consolidated subsidiaries; for entities 50% or less owned, document the good faith influence effort required by § 78m(b)(6).
[ ] Test journal entries for round numbers, unusual descriptions, and manual entries near period end.

Phase 9 — Payment and cash controls

[ ] Prohibit payment to a third country or to an account not in the counterparty's name.
[ ] Prohibit cash payments above a low threshold, with documented exceptions.
[ ] Require dual approval for payments above thresholds, with one approver outside the requesting unit.
[ ] Impose local petty cash limits with receipt requirements and independent reconciliation.
[ ] Require official fees be paid directly to the government entity with an official receipt.
[ ] Screen customs and freight forwarder invoices for line items that do not correspond to published tariffs or fees.
[ ] Apply automated screening for payments to high-risk countries, new payees, and round amounts.
[ ] Reconcile expense reports in high-risk locations on a sample basis with receipt review.

Phase 10 — Mergers and acquisitions

Pre-signing

[ ] Perform risk-based anti-corruption diligence scaled to the target's countries, government touchpoints, and third parties.
[ ] Review the target's third-party register, agent agreements, and commission structures.
[ ] Review government contracts, licenses, and permits and how they were obtained.
[ ] Review prior investigations, hotline reports, and audit findings.
[ ] Interview the target's compliance and finance leadership.
[ ] Test a sample of payments in high-risk locations.

Transaction documents

[ ] Specific anti-corruption representations and warranties.
[ ] Indemnity covering pre-closing conduct, with an appropriate survival period and no basket for this category.
[ ] Covenants requiring pre-closing remediation where feasible.
[ ] Closing condition tied to diligence completion where the risk warrants.
[ ] Escrow or holdback sized to the identified risk.

Post-closing

[ ] Integrate the acquirer's code, policies, and payment controls on day one.
[ ] Suspend or re-diligence every third party.
[ ] Deliver training within a defined period.
[ ] Conduct a post-closing audit within a defined period.
[ ] Disclose promptly what is found, remediate, and document both.

Why it matters, and the traps. Department policy has consistently indicated that an acquirer that conducts diligence, promptly discloses conduct discovered at or after closing, and remediates will not be charged for pre-acquisition conduct. That benefit is real and it is the reason acquirers disclose. It requires the diligence to have happened.

See Conducting Merger and Acquisition Due Diligence: A Practical Checklist.

Phase 11 — Joint ventures and minority positions

[ ] Perform full partner diligence including beneficial ownership and government connections.
[ ] Negotiate governance rights proportionate to the risk, not only to the equity.
[ ] Obtain audit rights over the venture's books.
[ ] Obtain compliance covenants, training obligations, and a right to require investigation.
[ ] Obtain a right to withhold funding and to exit on a violation.
[ ] For positions of 50% or less, document the good faith influence effort required by § 78m(b)(6) — board proposals made, policies offered, training funded.
[ ] Place a company-nominated director and require compliance reporting to them.
[ ] Reassess on any change in the partner's ownership or management.

Phase 12 — Training and communication

[ ] Deliver role-based training: general awareness for all, enhanced for sales, procurement, finance, logistics, and anyone with government contact.
[ ] Train in local languages with local scenarios — a case study about a U.S. procurement officer does not transfer.
[ ] Train third parties with material government interface, and document attendance.
[ ] Deliver board and executive training separately.
[ ] Provide a documented channel for asking questions in advance, and track what is asked — the questions are a risk assessment input.
[ ] Measure completion and comprehension, not attendance alone.
[ ] Refresh annually and after any incident.

Phase 13 — Reporting channels and investigation protocol

[ ] Provide multiple channels, including one outside the direct reporting line and one available anonymously where local law permits.
[ ] Publish a stated and enforced non-retaliation policy.
[ ] Acknowledge every report within a defined period.
[ ] Apply documented triage criteria and assign an owner.
[ ] Document the resolution of every report, including a documented decision not to act, with reasons.
[ ] Escalate defined categories to the board committee.
[ ] Report metrics to the board: volume, category, time to resolution, substantiation rate, and actions taken.
[ ] Conduct an annual look-back asking whether closed reports should have been.

Why it matters, and the traps. A logged complaint that was never resolved is the most damaging document a company can produce — it proves knowledge without action. That is true under the FCPA and, after United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023), it is true under the False Claims Act as well. See The Whistleblower and Retaliation Toolkit.

Phase 14 — Discipline and incentives

[ ] Apply discipline consistently across levels and geographies — inconsistency is the criticism that lands hardest.
[ ] Discipline supervisors who failed to detect or who created the pressure.
[ ] Document every disciplinary decision and its rationale.
[ ] Review compensation structures for incentives that reward results without regard to how they were obtained.
[ ] Include compliance objectives in performance reviews for managers.
[ ] Consider clawback provisions for misconduct.
[ ] Communicate — anonymized — that discipline occurred. Employees believe the program when they see consequences.

Phase 15 — Testing and audit

[ ] Include anti-corruption in the internal audit plan with a defined scope and cycle.
[ ] Perform transaction testing in high-risk locations: third-party payments, GTE, petty cash, journal entries.
[ ] Perform control testing: does the payment approval control actually operate?
[ ] Exercise third-party audit rights on a sample basis annually.
[ ] Conduct forensic data analytics on payment patterns.
[ ] Perform an independent program effectiveness review periodically.
[ ] Document every finding and track remediation to closure.
[ ] Report results to the board committee.

Why it matters, and the traps. "Does it work in practice?" is answered here and nowhere else. A program that has never tested a control has no evidence of effectiveness, and at resolution that is the difference between a monitor and no monitor.

Phase 16 — Map to the UK adequate procedures defense

[ ] Determine whether the company carries on a business, or part of a business, in the UK — which triggers UK Bribery Act s. 7 regardless of where conduct occurs.
[ ] Map the program against the six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication including training, and monitoring and review.
[ ] Confirm the program covers commercial bribery, not only bribery of officials — s. 7 does.
[ ] Confirm no facilitation payments are permitted anywhere.
[ ] Confirm the program covers associated persons — agents, subsidiaries, and joint venture partners performing services for the organization.
[ ] Document the mapping, because s. 7 makes the program the only defense.
[ ] Map similarly against Sapin II's eight required measures if there is a French nexus, and Brazil's Clean Company Act if there is a Brazilian one.

Phase 17 — Cross-border investigation readiness

[ ] Identify privilege recognition in each operating jurisdiction, noting that several do not recognize privilege for in-house counsel.
[ ] Identify blocking statutes that criminalize producing evidence for foreign proceedings.
[ ] Identify data localization and cross-border transfer constraints, and pre-plan a lawful transfer mechanism.
[ ] Identify works council consultation and employee interview rights.
[ ] Pre-select local counsel and forensic vendors in high-risk jurisdictions.
[ ] Establish a template litigation hold covering foreign systems and custodians.
[ ] Establish Upjohn warning scripts in local languages. Upjohn Co. v. United States, 449 U.S. 383 (1981).

See Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments.

Phase 18 — Disclosure readiness

[ ] Establish a decision framework and a decision-maker for voluntary self-disclosure.
[ ] Identify the current Justice Manual policy and its requirements for disclosure, cooperation, and remediation credit.
[ ] Assess likelihood of independent discovery — whistleblowers, foreign regulators, JV partners, media.
[ ] Map all authorities with jurisdiction and pre-plan the sequencing of any disclosure.
[ ] Identify collateral consequences: debarment, multilateral development bank cross-debarment, licensing, export privileges, and derivative litigation.
[ ] Pre-assess the remediation the company could demonstrate — this is what determines whether a monitor is imposed.
[ ] Maintain the evidence of program effectiveness from Phase 15 in a form that can be presented.

Worked example — Verdant's first year

Q1. Board resolution; CCO appointed with audit committee reporting; compliance committee stood up. Risk assessment identifies three markets with state-owned port authorities as customers and 40 third parties, of which 11 are customs brokers with direct official contact.

Q2. Policy set adopted in four languages. Facilitation payments prohibited outright, with a documented duress exception. Third-party register built; all 40 intermediaries re-papered with anti-corruption terms, audit rights, and payment restrictions. Enhanced diligence on the 11 brokers finds one — PT Sumber Mitra — with a 4% ad valorem fee, no deliverables on file, and a director who is the brother-in-law of a customs official. Engagement suspended pending investigation.

Q3. GTE policy implemented with cumulative per-recipient tracking. Payment controls tightened: no third-country payments, no accounts not in the counterparty's name, dual approval above threshold. Journal entry testing in the three markets finds $340,000 of "customs consulting" with no supporting documentation over four years.

Q4. Privileged investigation completed. Disclosure decision made with the board. Halcyon acquisition diligence completed pre-signing, indemnity and holdback negotiated, day-one integration plan approved. Program mapped against the UK six principles because the Halcyon acquisition brings Verdant within s. 7. Internal audit performs the first transaction testing cycle; findings tracked to closure and reported to the board.

What Verdant can now say that it could not a year earlier: it knows what each of its 40 intermediaries does, it can produce evidence of services for each payment, it has tested the controls rather than merely written them, and it found and stopped the one relationship that was the actual problem.

Building an Anti-Corruption Compliance Program: A Practical Checklist

Phase 1 — Governance and authority

Phase 2 — Risk assessment

Phase 3 — Policies

Phase 4 — The third-party lifecycle

Phase 5 — Gifts, travel, and entertainment

Phase 6 — Charitable contributions, sponsorships, and political activity

Phase 7 — Hiring and referrals

Phase 8 — Books, records, and internal controls

Phase 9 — Payment and cash controls

Phase 10 — Mergers and acquisitions

Phase 11 — Joint ventures and minority positions

Phase 12 — Training and communication

Phase 13 — Reporting channels and investigation protocol

Phase 14 — Discipline and incentives

Phase 15 — Testing and audit

Phase 16 — Map to the UK adequate procedures defense

Phase 17 — Cross-border investigation readiness

Phase 18 — Disclosure readiness

Worked example — Verdant's first year

Related Documents