Anti-Corruption: FCPA, Bribery Laws, and Enforcement

U.S. anti-bribery law rests on the Foreign Corrupt Practices Act, which makes it a federal crime to pay a foreign government official to win or keep business, and on the newer Foreign Extortion Prevention Act, which now criminalizes the foreign officials who demand those payments. Individuals convicted under the FCPA’s anti-bribery provisions face up to five years in prison and fines of up to $100,000; companies face criminal fines of up to $2 million per violation. Those are the statutory ceilings. Actual resolutions in major cases routinely reach the hundreds of millions or billions once civil disgorgement and the Alternative Fines Act are factored in, with the largest FCPA-related corporate penalty to date exceeding $3.5 billion.¹

Who the FCPA Applies To

The FCPA, codified at 15 U.S.C. §§ 78dd-1 through 78dd-3, reaches three categories of people and entities. “Issuers” are companies with securities registered on a U.S. exchange or that file reports with the SEC. “Domestic concerns” include U.S. citizens, permanent residents, and businesses organized under U.S. law. A third category sweeps in any person, including foreign nationals and foreign companies, who takes any act in furtherance of a corrupt payment while in U.S. territory.²

Reach extends well beyond U.S. borders. Under the 1998 amendments, foreign firms and individuals can be prosecuted for causing a corrupt payment to take place, even indirectly, within U.S. territory. Using the U.S. banking system, routing a dollar-denominated wire transfer, or sending an email through a U.S.-based server can each create the territorial hook.²

What Counts as a Bribe

The statute prohibits offering, paying, or promising “anything of value” to a foreign official to secure an improper business advantage.³ Enforcement actions have swept in far more than cash. Travel and entertainment, expensive gifts, charitable donations directed to an official’s preferred organization, and jobs or internships offered to relatives of decision-makers have all supported charges. The question is whether the transfer was intended to influence an official act.

The Facilitation Payments Exception

There is a narrow carve-out for small payments made to speed up routine government tasks the official is already required to perform. Processing visas or work permits, scheduling inspections tied to an existing contract, providing utility connections, and delivering mail are the kinds of things the statute contemplates.³ The exception never covers payments meant to influence a decision about whether to award or continue business with a particular company. Because the line between “routine” and “discretionary” is easy to cross, and because other regimes such as the UK Bribery Act do not recognize the exception at all, many companies have moved away from facilitation payments entirely.

Affirmative Defenses

Two affirmative defenses exist. The “local law” defense applies if the payment was lawful under the written laws of the foreign official’s country; silence in the foreign country’s law does not qualify, because the law must affirmatively permit the payment. The “reasonable and bona fide business expenditure” defense covers expenses directly tied to promoting products or services or performing a contract. A factory tour and modest meals for visiting officials reviewing a bid can qualify. A luxury vacation for those same officials will not.

FCPA Penalties on Paper and in Practice

The statute has two penalty tracks, and the difference matters.

Anti-bribery violations expose a company to fines of up to $2 million per violation. A willful individual violator faces up to $100,000 in fines, up to five years in prison, or both.⁴ Companies are prohibited from paying fines imposed on their officers or employees, so personal liability cannot be shifted back to the organization.⁵

Accounting violations carry steeper maximums. A willful individual violator can be fined up to $5 million and imprisoned for up to 20 years. The maximum criminal fine for an entity rises to $25 million.⁴

In corporate cases those caps rarely tell the whole story. The Alternative Fines Act allows courts to impose fines of up to twice the gross gain or loss from the offense, which is how total sanctions in the largest matters reach ten figures. The SEC layers on civil disgorgement, prejudgment interest, and civil monetary penalties in parallel with any DOJ criminal fine.¹

Books, Records, and Internal Controls

The FCPA’s accounting provisions operate independently of the anti-bribery rules, and this is where a great many companies get caught. Under 15 U.S.C. § 78m(b)(2), every issuer with SEC-registered securities must keep books and records that accurately reflect its transactions and asset movements, and must maintain internal accounting controls that ensure transactions happen only with management authorization and that recorded assets are periodically compared against what actually exists.⁶

The SEC can bring civil actions for books-and-records failures even when no bribe is ever proven. Disguising a suspicious payment as a “consulting fee” in the ledger violates the accounting provisions on its own terms, regardless of whether the underlying payment is later shown to be corrupt. Vague entries such as “miscellaneous” or “local facilitation costs” in high-risk regions draw particular scrutiny.¹

The Foreign Extortion Prevention Act

Until late 2023, U.S. law reached only the supply side of foreign bribery. The Foreign Extortion Prevention Act, codified at 18 U.S.C. § 1352, closes that gap by criminalizing foreign officials who demand, seek, or accept bribes from people or entities connected to U.S. commerce.⁷

FEPA’s definition of “foreign official” covers government employees at any level, employees of public international organizations, and anyone acting in an official capacity for a foreign government. Penalties are harsher than the FCPA’s anti-bribery track: up to 15 years in prison and a fine of up to $250,000 or three times the monetary value of whatever the official demanded, whichever is greater.² Jurisdiction exists when the official uses U.S. mail or interstate commerce, or when the demand targets a U.S. issuer, domestic concern, or any person within U.S. territory.

How Enforcement Works

DOJ and SEC Roles

The Department of Justice handles criminal FCPA prosecutions, which produce prison sentences for individuals and criminal fines for companies. The SEC pursues civil enforcement, typically for books-and-records and internal-controls violations, seeking disgorgement of profits, prejudgment interest, and civil penalties.¹ In the largest matters, both agencies bring parallel actions against the same company, and the total penalty is the sum.

Deferred and Non-Prosecution Agreements

Corporate FCPA cases frequently resolve without trial. Under a Deferred Prosecution Agreement, the government files criminal charges but agrees to dismiss them after a set period if the company pays fines, cooperates with the investigation, implements compliance reforms, and, in many cases, accepts an independent compliance monitor. A Non-Prosecution Agreement is similar, but the charges are never formally filed.

Voluntary Self-Disclosure

The DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy creates a strong incentive to surface problems internally. A company that voluntarily discloses misconduct, cooperates fully, and remediates in a timely way will presumptively receive a declination, although it must still pay disgorgement and restitution. When aggravating circumstances block a full declination, the DOJ will generally offer a Non-Prosecution Agreement with a 75% reduction off the low end of the Sentencing Guidelines range and no compliance monitor. Companies that cooperate without self-disclosing can still earn up to a 50% reduction but lose the more favorable terms.⁸

Statute of Limitations

Criminal FCPA cases are subject to the general federal five-year statute of limitations.⁹ Two rules stretch that window in practice. When the DOJ charges a conspiracy, the clock does not start until the last act in furtherance of it, which in a long-running scheme can push the deadline well out. The government can also ask a court to toll the period while gathering evidence located in a foreign country. Legislation introduced in early 2026 would double the criminal limitations period to ten years but has not been enacted as of this writing.

Successor Liability When You Acquire a Company

An acquirer can inherit FCPA liability for the target’s pre-acquisition corruption. The DOJ operates a safe harbor to encourage buyers to surface and report problems rather than bury them. To qualify, the acquirer must disclose any criminal misconduct discovered at the acquired company within six months of closing, cooperate with any resulting investigation, and fully remediate the misconduct within one year of closing. If those conditions are met, the DOJ will presumptively decline to prosecute the acquirer for the inherited conduct, even where aggravating circumstances existed at the target. Conduct disclosed under this policy will not count against the acquirer as a prior offense in any future enforcement action.

The six-month clock runs from closing, not from the day someone happens to find the problem, which makes pre-closing anti-corruption due diligence a practical necessity rather than a formality.

Whistleblower Reports and Awards

Anyone with information about an FCPA violation can submit a tip to the SEC through its online Tips, Complaints, and Referrals portal or by mailing a Form TCR to the Office of the Whistleblower. Tips can be submitted anonymously, but an anonymous whistleblower must be represented by an attorney to remain eligible for an award.¹⁰

Under the Dodd-Frank Act, when a whistleblower’s information leads to a successful enforcement action with monetary sanctions exceeding $1 million, the SEC must pay an award of between 10 and 30 percent of the amount collected. The percentage depends on how significant the information was and how much assistance the whistleblower provided.¹¹

Both the Dodd-Frank Act and the Sarbanes-Oxley Act prohibit employers from retaliating against whistleblowers. Protected employees cannot be fired, demoted, suspended, threatened, or harassed for reporting suspected violations.¹² The SEC can bring enforcement actions against retaliators, and whistleblower identities receive confidentiality protections.¹³

Related Statutes Worth Knowing

The FCPA targets bribery of foreign officials, so it does not reach purely private-sector or purely domestic bribery on its own. The Travel Act fills part of that gap. Under 18 U.S.C. § 1952, anyone who travels in interstate or foreign commerce or uses a facility of interstate commerce to promote or carry on bribery that violates state or federal law faces up to five years in prison.¹⁴

Companies operating internationally should also be aware that the OECD Convention on Combating Bribery of Foreign Public Officials commits member countries to criminalize foreign bribery under broadly consistent definitions and runs a peer-monitoring system among members,¹⁵ and that the UK Bribery Act 2010 imposes stricter obligations than the FCPA, including a corporate offense of failing to prevent bribery by an associated person, no facilitation payments exception, and application to private-sector bribery.¹⁶ A single payment can trigger prosecution under more than one of these regimes.

1
U.S. Securities and Exchange Commission. SEC Enforcement Actions – FCPA Cases
2
U.S. Department of Justice. Foreign Corrupt Practices Act Unit
3
Office of the Law Revision Counsel. 15 US Code 78dd-1 – Prohibited Foreign Trade Practices by Issuers
4
Office of the Law Revision Counsel. 15 US Code 78ff – Penalties
5
GovInfo. 15 US Code 78dd-2 – Prohibited Foreign Trade Practices by Domestic Concerns
6
Office of the Law Revision Counsel. 15 US Code 78m – Periodical and Other Reports
7
Office of the Law Revision Counsel. 18 US Code 1352 – Demands by Foreign Officials for Bribes
8
U.S. Department of Justice. Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy
9
Office of the Law Revision Counsel. 18 US Code 3282 – Statute of Limitations
10
U.S. Securities and Exchange Commission. Information About Submitting a Whistleblower Tip
11
Office of the Law Revision Counsel. 15 US Code 78u-6 – Securities Whistleblower Incentives and Protection
12
Whistleblower Protection Program. 18 US Code 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
13
U.S. Securities and Exchange Commission. Whistleblower Protections
14
Office of the Law Revision Counsel. 18 US Code 1952 – Interstate and Foreign Travel or Transportation in Aid of Racketeering Enterprises
15
OECD. Convention on Combating Bribery of Foreign Public Officials in International Business Transactions
16
GOV.UK. Bribery Act 2010 Guidance