How small U.S. firms can meet FCPA anti-bribery rules

What to take away

FCPA anti-bribery provisions explained for smaller U.S. companies

The Foreign Corrupt Practices Act has two halves, and small firms usually know only the first. The anti-bribery provisions make it a crime to corruptly offer, promise or give anything of value to a foreign official to obtain or keep business.

The accounting provisions, covered in the next section, require issuers to keep accurate books and a system of internal controls.

You do not have to be a public company to face anti-bribery exposure. The statute reaches U.S. companies and U.S. persons, and it reaches foreign firms that take any act in furtherance of a bribe while in U.S. territory.

A wire transfer routed through a New York bank can be enough. So can a single email sent from a Texas office.

The definition of foreign official is broader than most owners assume. It covers employees of state-owned enterprises, which in practice means the staff at a national oil company, a state utility or a government-controlled hospital. Paying a mid-level procurement clerk at a state-owned port authority is paying a foreign official.

Anything of value is equally broad. Cash is obvious. So are travel, meals, internships for a relative, charitable donations steered at an official's request, and discounts on products the official resells. There is no minimum dollar threshold in the statute.

The narrow exceptions matter for small exporters. Facilitation payments to speed up routine government action, such as processing a visa or clearing a shipment, are permitted under the FCPA but illegal in most countries where they occur. Promotional expenses are defensible only when they are reasonable, bona fide and tied to demonstrating a product.

Affirmative defenses exist, and they reward paperwork. A payment is defensible if it was lawful under the written laws of the host country, or if it was a reasonable and bona fide expenditure directly related to product promotion or contract performance. Both defenses require records you can produce years later.

Criminal penalties fall on individuals as well as companies. Officers and directors can be prosecuted personally, and the DOJ has been explicit that it wants accountability from decision makers. That exposure is why Compliance Officer Personal Liability is a live question even at firms with ten employees.

Accounting and internal controls requirements under the FCPA

Issuers, meaning companies with securities registered in the United States, must keep books and records that accurately reflect transactions. They also must maintain a system of internal accounting controls sufficient to give reasonable assurance that assets are protected and transactions are authorized.

This is where small public companies get caught without any bribe changing hands. A payment recorded as a consulting fee when it was a payment to an official violates the books and records provision. So does an off-books slush fund, a vague petty cash ledger or a distributor rebate with no supporting invoice.

The controls standard is reasonableness, not perfection. Prosecutors ask whether the control environment fits the company's size and risk. A twelve-person manufacturer is not expected to run the control stack of a multinational bank, but it is expected to know where its money goes.

Subsidiaries and joint ventures are consolidated for accounting purposes, which means their books become your books. A minority stake can still create exposure if you control the entity's operations or have the ability to direct its payments. Know what your foreign partners are booking.

Delaware, New York and California are home to a large share of small U.S. issuers, and their corporate governance expectations reinforce the federal baseline. The Delaware Court of Chancery has repeatedly allowed oversight claims to proceed where directors ignored red flags. Sarbanes-Oxley certification obligations push the same direction for public filers.

DOJ FCPA Unit enforcement trends and what triggers investigations

The Fraud Section of the DOJ Criminal Division houses the FCPA Unit, which brings the department's foreign bribery cases alongside the SEC. Its official anti-bribery framework and its list of resolved cases are both public.

Voluntary self-disclosure is the single largest lever a small firm controls. Companies that disclose, cooperate and remediate generally avoid a criminal resolution or receive a declination. Companies that wait for a subpoena rarely get the same treatment. Timing is most of the value.

Red flags that draw scrutiny are behavioral, not exotic. An agent with no office and no staff. A commission far above market. A request to pay into a third country. A refusal to sign an anti-bribery representation. An invoice described only as services rendered. Any one of these can justify a closer look.

DOJ has said publicly that it does not want compliance programs designed for appearance. Prosecutors test whether the program is resourced, whether it has authority inside the company, and whether it produced real consequences when someone broke the rules. A policy nobody enforces counts against you.

Recent resolutions have involved companies well under a few hundred employees. Size affects the shape of the program expected, not whether one is expected at all.

The department's Evaluation of Corporate Compliance Programs states the baseline it applies to firms of every size.

The White Collar and Corporate Enforcement section coordinates much of this work across the Criminal Division, which is why bribery, fraud and sanctions issues often arrive together in one investigation. A single problematic payment can trigger parallel inquiries.

Third-party and agent risk when there is no dedicated ethics staff

Most FCPA enforcement actions involve an intermediary, not a direct payment by an executive. Agents, distributors, freight forwarders, customs brokers, local law firms and marketing consultants all sit between your money and a foreign official. That distance is exactly what makes them dangerous.

Without a compliance officer, the risk concentrates in whoever owns the relationship. Usually that is a sales director or a country manager whose compensation depends on the deal closing. The person with the least incentive to slow a payment is often the only person reviewing it.

Successor liability is a quiet trap. Buying a small competitor that used agents in Brazil or Vietnam means inheriting their conduct. Due diligence before closing is far cheaper than remediation after. Post-closing integration of the target's third parties should be a condition of the deal.

Payments to intermediaries are the highest-risk category, but gifts, travel and hospitality run close behind. Sponsoring a government customer's site visit is normal business. Paying for the official's spouse to come along, or routing the trip through a resort with no business content, changes the character of the expense.

Supplier conduct raises related questions about labor, environmental and human rights practices that can surface in the same diligence file. A practical set of supplier ethics pointers helps small teams ask consistent questions instead of reinventing them per deal.

Where you have no ethics staff, name a single accountable person anyway. It can be the CFO, the general counsel, or an outside adviser on retainer. What matters is that someone owns the third-party register and can say no to a payment.

Practical compliance steps: due diligence, training and expense controls

A small firm can build a defensible program in weeks, not years. The sequence below is ordered by risk reduction per hour spent.

A right-sized program has five working parts: written policy, risk-based third-party due diligence, training, expense and gift controls, and a documented response when something goes wrong. The steps below build all five in order.

Typical build effort for a firm under 200 employees is 40 to 80 internal hours in the first year, plus an outside adviser on retainer. The retainer depends on how many third parties you have, how many countries you sell into, and whether documents need translation. None of it requires a full-time hire.

Training deserves more than a compliance checkbox. Scenario work beats policy recitation, and short sessions repeated annually beat one long onboarding session. For a small firm, ethics training programs that use real deal situations from your own pipeline will hold attention and produce useful questions.

Expense controls are the cheapest control you will ever install. Every gift, meal and trip involving a government customer should have a named recipient, a business purpose, an approver and a receipt. If a receipt cannot be produced, the expense should not be reimbursed.

A written code of conduct is the backbone that holds these pieces together. It should be short enough to read in one sitting and specific enough that an employee in a foreign sales office knows what to do when a customs officer asks for cash.

A 40-person equipment maker in Illinois wants a contract with a state-owned utility. It hires a local agent on a 12 percent commission, payable to an account in a neighboring country. The compliance lead runs enhanced diligence, finds the agent shares an address with a utility procurement manager, stops the engagement, and documents the decision.

The contract is lost. The investigation never starts.

Using the FCPA Resource Guide to build a right-sized program

The FCPA Resource Guide is a joint publication of the DOJ and the SEC, and it is the closest thing to an official instruction manual. It walks through the anti-bribery provisions, the accounting provisions, the affirmative defenses and the hallmarks of an effective compliance program.

For a small firm, the guide's most useful chapters are the ones on third parties and on program design. It states directly that small and medium-sized enterprises can use a streamlined program proportionate to their risk. That sentence is worth reading twice before you copy a multinational's manual.

DOJ's Evaluation of Corporate Compliance Programs is the other document to keep on the shelf. It sets out the questions prosecutors ask: Is the program well designed? Is it applied in good faith? Does it work in practice? Those three questions are the whole test.

The guide also explains the DOJ's declination framework, which rewards voluntary disclosure, cooperation and timely remediation. For a company with no compliance department, that framework is the practical reason to write things down as you go rather than reconstruct them later.

The Department of Labor publishes small business compliance assistance that shows how to read federal expectations without a lawyer on staff, and the same habit applies here.

Two companion resources round out a starter library. A Codes of conduct checklist helps you confirm your written standards cover the topics prosecutors look for, and the DOJ's public FCPA materials show how the unit has treated comparable conduct in past resolutions.

Checklist for small firms meeting FCPA anti-bribery rules

Use this as a working list. Items can be completed in any order, but the first four carry most of the risk reduction.

Common questions