How the FCPA Shapes Global Business Compliance

The US Foreign Corrupt Practices Act (FCPA) is one of the most influential anti-bribery laws in international commerce. Although it is a United States statute, its reach extends well beyond American companies. A non-US business can face investigation, prosecution, financial penalties and reputational damage when its conduct has a sufficient connection to the US market or financial system.

This matters to Australian companies operating across Asia, the Middle East, Africa, Europe and the Americas. An ASX-listed mining group in Perth, an engineering contractor in Brisbane or a technology company headquartered in Sydney may deal with US investors, dollar-denominated payments, American subsidiaries or business partners subject to US jurisdiction.

The law addresses two connected areas. Its anti-bribery provisions prohibit corrupt payments to foreign public officials, while its accounting provisions require certain companies to keep accurate books and maintain effective internal controls. A payment does not need to be large to create risk, and a company may be exposed because of conduct by an employee, distributor, consultant or joint venture partner.

Understanding the FCPA therefore requires more than memorising prohibited payments. Companies need to assess jurisdiction, identify public-sector touchpoints, scrutinise intermediaries, document legitimate business expenditure and create reporting systems that work in the markets where they operate.

Why The FCPA Matters Beyond US Borders

The FCPA has two principal enforcement bodies. The US Department of Justice generally handles criminal cases and some civil matters, while the Securities and Exchange Commission investigates civil violations involving issuers and reporting companies. Their combined approach has made the statute a central feature of multinational compliance programmes.

The law is also influential because US authorities frequently cooperate with regulators in other countries. A bribery investigation involving an Australian company may involve the Australian Federal Police, the Commonwealth Director of Public Prosecutions, the UK Serious Fraud Office and authorities in the country where the alleged payment occurred. Information sharing can turn a local concern into a coordinated cross-border investigation.

A useful way to monitor international developments is to review specialised compliance resources, including country risk information and guidance on due diligence. These tools help businesses understand that corruption risk varies between jurisdictions, sectors and types of public interaction.

The statute has shaped corporate expectations globally. Even where local law is less prescriptive, international lenders, insurers, investors and procurement customers may expect FCPA-style controls, documented approvals and prompt escalation of suspected misconduct.

Who Can Face Liability

US companies, US citizens and residents can fall within the FCPA’s scope, as can companies whose securities are registered in the United States or that must file reports with the SEC. These reporting companies are commonly called issuers. Their subsidiaries and controlled affiliates may create exposure, particularly where the parent company directed, approved or failed to supervise risky activity.

The statute can also apply to foreign individuals and companies classified as “domestic concerns” or acting within US territory. A non-US business does not automatically avoid liability simply because it is incorporated in Australia, Singapore, Germany or another country. A relevant email sent through the United States, a meeting in New York, a payment routed through a US bank or conduct by a US-based employee may become important jurisdictional facts.

The anti-bribery provisions can apply when an act occurs in the US, even if the company has no wider American operations. For some categories of covered person, prosecutors may also rely on interstate commerce or other statutory connections. The precise analysis is fact-specific, so companies should obtain legal advice before assuming that a small US contact is irrelevant.

Corporate groups should map their ownership and reporting arrangements. A parent may be investigated for authorising a payment, ignoring warning signs or benefiting from a subsidiary’s misconduct. Acquiring a business with unresolved corruption issues can also create successor liability, making pre-acquisition due diligence essential.

What Conduct Creates Exposure

The FCPA prohibits offering, promising, authorising or giving anything of value to a foreign official for the purpose of obtaining or retaining business or securing an improper business advantage. “Anything of value” can include cash, commissions, travel, entertainment, employment opportunities, charitable donations, loans, luxury goods or benefits provided to a relative.

Foreign officials include government employees, political candidates and officials of political parties. The definition may also cover staff of state-owned or state-controlled enterprises. This is particularly significant in infrastructure, energy, mining, telecommunications, health care and transport, where a commercial counterparty may have government ownership or control.

A payment does not need to be handed directly to an official. A company can face risk where a consultant, customs broker, sales agent or local partner makes the payment on its behalf. Knowledge may include conscious disregard and deliberate avoidance. “I did not ask” is unlikely to protect a business that ignored obvious warning signs.

Australian companies should take care with everyday commercial practices. A modest meal during a legitimate tender meeting may be acceptable, while an expensive weekend in Sydney timed before a government procurement decision could appear improper. Travel to a Melbourne conference, hospitality at a Perth resources event or gifts delivered during an official inspection should be assessed for purpose, timing, value and transparency.

Accounting Rules And Internal Controls

The accounting provisions apply primarily to issuers and require accurate books and records. Transactions must be recorded with enough detail to reflect their true nature. A payment described as “consulting services” when it was actually a bribe can create a books-and-records violation even if prosecutors cannot prove every element of an anti-bribery offence.

Issuers must also maintain a system of internal accounting controls designed to provide reasonable assurance that transactions are properly authorised, recorded and reviewed. This does not demand perfect prevention. It does require controls that are proportionate to the company’s size, risk profile and operating environment, followed in practice rather than merely described in a policy.

Common weaknesses include vague invoices, cash payments, split purchase orders, off-book accounts, excessive commissions and missing evidence of services. Weak controls around petty cash can be especially problematic in locations where unofficial payments are normalised. A local custom does not change the legal character of a payment.

The accounting rules can therefore affect a company even where an improper payment was made without senior management’s knowledge. A pattern of inadequate due diligence, unexplained discounts or approvals outside delegated authority may demonstrate that the company’s compliance system was ineffective.

Third Parties And Local Partners

Third-party intermediaries create some of the greatest FCPA risks. Agents often interact with licensing authorities, customs officials, state-owned customers and public procurement bodies. A company may rely on the intermediary’s local knowledge while lacking visibility over how commissions are calculated or spent.

Risk-based due diligence should examine ownership, qualifications, reputation, government connections, beneficial owners, compensation and the services actually required. The review should be refreshed when the relationship changes, such as when a partner requests a new bank account, raises its commission or proposes a subcontractor.

Contracts should describe the services, require compliance with applicable anti-corruption laws, permit audit rights and prohibit unauthorised subcontracting. Payments should be made to an account held in the contractor’s name and supported by credible evidence of work. Requests for cash, offshore accounts, vague “success fees” or payment to a politically connected nominee deserve careful scrutiny.

Joint ventures require particular attention because control may be shared. A company should understand who appoints management, how books are maintained, whether the venture deals with government entities and how compliance concerns are escalated. In Australia’s resources sector, where projects may involve complex consortia and overseas permits, these questions should be addressed before commercial commitments are made.

Enforcement, Cooperation And Remediation

FCPA enforcement can result in substantial criminal fines, civil penalties, disgorgement of profits, prejudgment interest and compliance monitors. Companies may also lose access to public contracts, face restrictions from lenders and suffer damage to investor confidence. Individuals can face imprisonment, fines and professional consequences.

Authorities commonly consider the quality of a company’s compliance programme, the timing of its response, the extent of cooperation and the quality of remediation. Voluntary disclosure may receive credit in appropriate circumstances, but it does not erase the underlying conduct. A company should avoid delaying action while trying to establish every fact internally.

An effective response usually begins with preserving documents, stopping questionable payments, protecting whistleblowers and appointing an appropriately independent investigation team. The business should identify whether the issue is isolated or systemic, assess possible legal obligations in each affected country and consider whether regulators or business partners must be notified.

Australian companies should also account for local reporting and enforcement realities. The Australian Federal Police may investigate foreign bribery under the Criminal Code Act 1995, while Australian corporate and securities obligations can raise separate disclosure and governance issues. A matter involving an ASX-listed company may therefore carry consequences under both US and Australian frameworks.

Current enforcement developments and regulatory reporting can change quickly, so businesses should monitor reliable compliance news rather than rely on outdated summaries. A recent regulatory update can be useful as one input into a broader review of legal and operational risks.

Practical Controls For Australian Companies

A strong compliance programme should reflect the company’s actual operations. A Sydney-based software provider selling to hospitals may face different risks from a Perth mining contractor dealing with licensing officials, or a Melbourne manufacturer using customs agents throughout Southeast Asia. Generic training is valuable, but risk-based procedures are more likely to influence daily decisions.

Key measures include:

• Map US connections, including securities listings, subsidiaries, employees, bank accounts, investors and transactions involving US territory.
• Classify government touchpoints, state-owned enterprises, public tenders, customs interactions and regulated approvals by country and business unit.
• Apply proportionate due diligence to agents, distributors, consultants, joint venture partners and acquisition targets.
• Require documented approval for gifts, hospitality, travel, donations, sponsorships, discounts and commissions involving public-sector contacts.
• Test books, invoices, payment records and third-party files through internal audits, monitoring and confidential reporting channels.

Training should use realistic examples from the company’s market. A procurement team in Brisbane may need guidance on infrastructure tenders, while a resources team in Perth may need controls for remote-site contractors and government permits. Staff should understand how to ask questions without creating an assumption that every local intermediary is corrupt.

Whistleblower systems should be accessible to employees, contractors and suppliers, with clear protection against retaliation. Reports involving senior executives, politically exposed persons or unexplained payments should be escalated independently. Management should track allegations, response times and recurring themes rather than treating each report as an isolated incident.

The board and senior leadership have a practical role in setting expectations. They should receive information about high-risk markets, overdue due diligence, exceptions to approval rules and significant third-party relationships. Compliance is more credible when commercial targets do not quietly reward employees for bypassing controls.

Building A Defensible Compliance Culture

A defensible programme is measured by how the company behaves under pressure. Policies should be easy to locate, written in understandable language and supported by procedures that employees can use when a deal is moving quickly. A control that requires six approvals for a low-risk expense may be ignored, while a carefully calibrated approval process can focus attention on genuinely risky situations.

Risk assessments should be updated after acquisitions, market entry, regulatory changes, major tenders and reports of misconduct. Country risk is relevant, but it should not be the only measure. A low-risk country can contain a high-risk transaction, and a challenging jurisdiction may be managed effectively through strong local oversight.

Records matter. A company that can show why it selected an intermediary, how it checked beneficial ownership, what services were delivered and who approved payment is better positioned than one relying on informal assurances. Documentation should be accurate, contemporaneous and retained under a consistent policy.

The FCPA’s influence will continue to shape expectations for companies operating from Australia. Businesses that understand their US touchpoints, control third parties, maintain reliable records and respond promptly to warning signs are better placed to manage enforcement risk across multiple legal systems.

The central lesson is simple: incorporation outside the United States does not remove exposure. Australian companies should treat anti-bribery compliance as a business control tied to payments, people, contracts and decisions, remembering that a small connection to the US can bring a much larger international operation within the FCPA’s reach.