Scope
This guide focuses on Foreign Corrupt Practices Act (FCPA) compliance as it relates to security engineering, particularly in managing third-party vendors, payment monitoring, and disclosure protocols. If you're tasked with implementing technical controls for export compliance, sanctions screening, or vendor management platforms, you'll need to translate FCPA requirements into system specifications.
This isn't a legal primer. It's a practical guide for engineers building systems to help compliance teams detect potential violations early.
Key Concepts and Definitions
FCPA jurisdiction: This law prohibits bribing foreign government officials. It applies to US companies, foreign companies with US securities listings, and anyone acting within US territory. Your systems may need to flag transactions involving foreign government entities.
Third-party intermediaries: These include customs brokers, freight forwarders, distributors, sales agents, and consultants who interact with foreign officials on your company's behalf. They pose high compliance risks because they operate outside your direct oversight but can still trigger corporate liability.
Voluntary self-disclosure: Under the DOJ's March 2026 corporate enforcement policy (CEP), companies that report misconduct before the government discovers it can receive declinations or reduced penalties. Disclosure must occur within a "reasonably prompt time" after discovery, with a 120-day safe harbor for whistleblower reports.
Deferred prosecution agreement (DPA): This is a negotiated resolution where the DOJ agrees not to prosecute if the company meets specified compliance obligations over a monitoring period, typically three years.
Entity list: The Commerce Department's Bureau of Industry and Security (BIS) maintains this list of parties restricted from receiving US-origin items without an export license. Your sanctions screening system must check against this list.
Requirements Breakdown
Detection Capabilities Your Systems Need
Invoice anomaly detection: Flag payments with vague descriptions. The Scoular case involved bribes disguised as "reinspection" charges invoiced by customs brokers. Your accounts payable system should automatically escalate invoices containing terms like:
- Reinspection
- Facilitation
- Handling
- Expediting
- Administrative fees
- Special fees
Round-number charges ($100, $250, $500) without detailed line items also warrant review.
Cross-reference validation: Compare vendor invoices against:
- Customs records (where accessible via API)
- Government fee schedules
- Proof of payment documentation
- Historical pricing patterns for similar services
Build automated checks that surface discrepancies for manual review. Flag them for your compliance team.
Geographic risk scoring: Your vendor management platform should automatically assign risk levels based on where third parties operate and which government agencies they regularly contact. Customs brokers at the US-Mexico border carry different risk profiles than software consultants in Canada.
Third-Party Monitoring Requirements
Continuous due diligence: Initial vendor onboarding checks aren't enough. Your system needs to support ongoing monitoring with risk-based refresh cycles. High-risk vendors (those interacting with foreign officials) should trigger annual re-screening at minimum.
Contractual data capture: When legal teams negotiate vendor contracts, your system should capture and index specific clauses:
- Audit rights
- Termination triggers for compliance violations
- Requirements to follow Anti-Bribery and Corruption, sanctions, and export control laws
- Activity reporting obligations
These aren't just legal documents; they're operational controls your system needs to enforce through workflow automation.
Payment testing workflows: Build periodic audits into your payment processing system. Sample vendor payments quarterly and require supporting documentation that matches invoice descriptions. Route exceptions to compliance for investigation.
Disclosure Protocol Automation
120-day whistleblower clock: If your ethics hotline receives an internal report, your case management system must automatically flag the matter for legal review and track the 120-day disclosure window. Under the CEP, companies can still qualify for declinations if they self-report within 120 days of receiving an internal whistleblower report, even if the whistleblower also contacted the DOJ.
Evidence preservation triggers: When potential violations surface, your system needs to immediately preserve relevant data: emails, payment records, contracts, and communication logs. Build automated legal holds into your incident response workflow.
Parallel regulatory exposure tracking: FCPA violations often overlap with sanctions (OFAC), export controls (BIS), and customs issues. Your compliance case management system should prompt reviewers to assess all four areas simultaneously, not just the most obvious violation.
Implementation Guidance
Start with Payment Monitoring
You don't need a comprehensive GRC platform to address FCPA risk. Begin with your accounts payable system. Add keyword filters and round-number detection to your existing invoice review process. Route flagged invoices to a compliance queue for manual review. This catches the "reinspection" and "facilitation" charges that frequently disguise improper payments.
Integrate Sanctions Screening into Vendor Onboarding
Your vendor management system should automatically check new third parties against OFAC's Specially Designated Nationals list and BIS's entity list before contracts are signed. Don't rely on manual lookups; these lists update frequently, and human review introduces delays and errors.
Build Disclosure Decision Trees
When your compliance team identifies potential misconduct, they need a structured process to evaluate whether voluntary disclosure makes sense. Your case management system should prompt them to assess:
- Whether the DOJ already knows (or will imminently discover) the conduct
- Presence of aggravating factors (concealment, obstruction, cartel involvement)
- Parallel regulatory exposure requiring coordination across agencies
- Timeline since internal discovery
Don't automate the disclosure decision itself, but structure the analysis so your legal team can move quickly.
Configure Risk-Based Monitoring Cadences
Not all vendors require the same oversight frequency. Your system should automatically schedule re-screening based on:
- Geographic risk (operating in high-corruption jurisdictions)
- Government interaction frequency (daily contact with customs officials vs. occasional)
- Transaction volume and payment patterns
- Past compliance issues or audit findings
Common Pitfalls
Treating due diligence as a one-time event: Your vendor onboarding checklist isn't sufficient. Companies that only screen vendors at contract signing miss changes in ownership, business relationships, and risk profiles. Build periodic re-screening into your vendor management workflow, not as a manual reminder but as an automated system requirement.
Ignoring low-value, high-frequency payments: Small "facilitation" charges add up. In the Scoular matter, individual bribes were relatively modest, but the scheme involved more than $400,000 over six years. Your payment monitoring system should flag patterns, not just large individual transactions.
Separating Anti-Bribery and Corruption from export and sanctions controls: These risks cluster around the same third parties. A customs broker who creates FCPA exposure also handles export documentation and cross-border payments subject to sanctions rules. Don't build separate compliance systems for each regulatory area; integrate them so your team sees the full risk picture.
Delaying disclosure decisions: The CEP rewards speed. If your internal investigation drags on for months while you gather every detail, you'll lose voluntary disclosure benefits. Your case management system should escalate potential violations to legal counsel within days, not weeks, so disclosure decisions happen while the 120-day window is still open.
Assuming fewer enforcement actions mean lower risk: The DOJ brought only one corporate FCPA enforcement action in 2026, but BIS and OFAC remain active. Your compliance systems need to address the full spectrum of cross-border risk, not just the statute getting the most press attention.
Quick Reference Table
| System Component | FCPA Control Requirement | Implementation Priority |
|---|---|---|
| Accounts Payable | Keyword filtering for vague charges (reinspection, facilitation, handling) | High |
| Accounts Payable | Round-number payment flagging | High |
| Vendor Management | Automated sanctions screening (OFAC, BIS entity list) | Critical |
| Vendor Management | Risk-based re-screening schedules | Medium |
| Contract Repository | Audit rights and termination clause indexing | Medium |
| Payment Processing | Quarterly payment testing workflows | Medium |
| Ethics Hotline | 120-day disclosure window tracking for whistleblower reports | High |
| Incident Response | Automated legal hold triggers for potential violations | High |
| Case Management | Multi-agency exposure assessment prompts (FCPA, OFAC, BIS, Customs) | Medium |
| Vendor Onboarding | Geographic risk scoring based on jurisdiction and government interaction | High |
Bookmark this reference when you're scoping vendor management platforms, configuring payment monitoring rules, or designing compliance workflows. The technical controls you build today determine whether your compliance team can detect and disclose violations before the DOJ does.
