Foreign Bribery Risk: How the FCPA and FEPA Work and What They Mean for Companies and Governments

An envelope of U.S. currency passed between two people — Foreign bribery rarely looks this obvious; most cases run through intermediaries. Photo: Envato.

Foreign bribery law began as a foreign-policy repair job. In the mid-1970s, Senate and SEC investigations showed that American companies had been paying foreign officials on a large scale, and a 1977 Senate report warned that “Foreign governments friendly to the United States in Japan, Italy, and the Netherlands have come under intense pressure” as a result (Senate Report 95-114). The Foreign Corrupt Practices Act (FCPA) that followed now reaches foreign companies listed in New York, foreign nationals who act on U.S. soil, and agents paid in third countries. In 2025 the Justice Department tied its enforcement priorities explicitly to cartels, national security, and the competitiveness of U.S. companies. Bribery risk is therefore both a compliance problem and an intelligence problem: who is likely to be investigated, by whom, and why.

This page explains how the FCPA and its newer companion, the Foreign Extortion Prevention Act (FEPA), work, what major cases teach, and what executives and the officials who advise exporters should do. It is part of a series on enforcement risk; sanctions, export controls, investment screening, foreign agent registration, forced-labor import bans, and data security have their own pages. This is a general overview of public law and agency records, not legal advice. Anyone facing a specific question should talk to anti-corruption counsel.

Foreign bribery law at a glance

Legal basis: the FCPA of 1977, amended in 1988 and 1998, codified in the Securities Exchange Act of 1934 at 15 U.S.C. §§ 78dd-1 to 78dd-3 (anti-bribery) and 78m(b) (accounting). FEPA, enacted in December 2023, is now at 18 U.S.C. § 1352.
Who enforces: the Justice Department brings criminal cases; the Securities and Exchange Commission brings civil cases against issuers. Their joint FCPA Resource Guide (2020) sets out both agencies’ views.
The core prohibition: it is unlawful to act “corruptly in furtherance of an offer, payment, promise to pay, or authorization of the payment of any money,” or anything of value, to a foreign official to obtain or retain business (§ 78dd-1(a)). Payments through intermediaries are covered when the payer knows, or is aware of a high probability, that money will pass to an official.
Who it reaches: issuers, meaning “any company with a class of securities listed on a national securities exchange in the United States,” including many foreign companies; domestic concerns, meaning U.S. citizens, residents, and businesses; and foreign persons who act in furtherance of a corrupt payment while in U.S. territory (FCPA Resource Guide).
Accounting provisions: issuers must make and keep books and records that “in reasonable detail, accurately and fairly reflect” their transactions and must maintain a system of internal accounting controls (15 U.S.C. § 78m(b)). These apply whether or not a bribe is proven.
The exception and defenses: the anti-bribery provisions “shall not apply to any facilitating or expediting payment” to secure “routine governmental action,” such as “processing governmental papers, such as visas and work orders.” Affirmative defenses cover payments that were “lawful under the written laws and regulations” of the foreign country and “reasonable and bona fide” expenditures tied to product promotion or contract performance (§ 78dd-1(b), (c), (f)). The exception is narrow, and U.K. law has none.
Criminal penalties: for anti-bribery violations, a company “shall be fined not more than $2,000,000” per violation, and an individual “not more than $100,000, or imprisoned not more than 5 years, or both”; willful accounting violations carry up to $25 million for companies and $5 million and 20 years for individuals (15 U.S.C. § 78ff). Under the Alternative Fines Act, fines can instead reach twice the gain or loss (18 U.S.C. § 3571(d)).
Civil penalties and time limits: the SEC can seek inflation-adjusted civil penalties (the statute sets $10,000 per anti-bribery violation) plus disgorgement (§ 78ff(c)). Criminal bribery charges are generally subject to a five-year statute of limitations. A bill introduced on March 9, 2026, would extend it to 10 years; it had not passed as of this writing (Miller & Chevalier).
The demand side (FEPA): FEPA makes it a crime for a foreign official to “corruptly demand, seek, receive, accept, or agree to receive or accept” a bribe from an issuer, a domestic concern, or a person in U.S. territory, punishable by a fine of up to $250,000 or three times the bribe, and up to 15 years in prison (18 U.S.C. § 1352).
Disclosure route: under the Justice Department’s March 10, 2026, department-wide Corporate Enforcement Policy, a company that voluntarily self-discloses, fully cooperates, remediates, and has no aggravating circumstances will receive a declination, though it still pays disgorgement (Justice Department; A&O Shearman).

How foreign bribery law became a strategic instrument

Foreign Bribery Enforcement, 1976–2026: timeline chart of key laws, rules, and cases — Foreign Bribery Enforcement, 1976–2026. Chart: Competitive Futures.

The law grew out of the Watergate era. After its May 1976 report on questionable payments, the SEC “discovered that more than 400 U.S. companies had paid hundreds of millions of dollars in bribes” (FCPA Resource Guide). The best-known case was Lockheed: in February 1976 Senator Frank Church’s subcommittee revealed that the aircraft maker had channeled more than 3 billion yen into covert payments in Japan to sell its TriStar airliner, and former Prime Minister Kakuei Tanaka was arrested that July (Asia Times). A 1977 House report concluded of corporate bribery, “not only is it unethical, it is bad business as well,” and Congress passed the FCPA that December (FCPA Resource Guide).

Congress added the two affirmative defenses in 1988. The OECD Anti-Bribery Convention followed, signed on December 17, 1997, and in force since February 15, 1999 (New Zealand treaty record). Congress amended the FCPA in 1998 “to conform to the requirements of the Anti-Bribery Convention,” adding jurisdiction over foreign persons acting in U.S. territory (FCPA Resource Guide; Pub. L. 105-366). Croatia became its 46th Party in January 2024 (Croatian government).

In 2020 the OECD Working Group on Bribery “applauded the United States for its sustained and outstanding commitment,” reporting that U.S. authorities had “convicted or sanctioned 174 companies and 115 individuals” over the review period (Justice Department). FEPA, signed on December 22, 2023, in the 2024 National Defense Authorization Act, closed the demand-side gap; before it, prosecutors pursuing bribe-taking officials relied on money laundering laws (Miller & Chevalier; Pub. L. 118-78).

Priorities shifted in 2025. Executive Order 14209 of February 10, 2025, found that FCPA enforcement had been “stretched beyond proper bounds” and “actively harms American economic competitiveness and, therefore, national security.” It directed the Attorney General, for 180 days, to “cease initiation of any new FCPA investigations or enforcement actions” absent an exception, review existing matters, and issue new guidelines (Federal Register). On June 9, 2025, the Deputy Attorney General issued Guidelines for Investigations and Enforcement of the FCPA. They set four priorities: misconduct “associated with the criminal operations of a Cartel or TCO” (transnational criminal organization); misconduct that “deprived specific and identifiable U.S. entities of fair access to compete”; “the most urgent threats to U.S. national security”; and “serious misconduct” bearing “strong indicia of corrupt intent.” Enforcement “shall not focus on alleged misconduct involving routine business practices” or on anyone “on the basis of their nationality.” About half of open investigations had been closed by mid-June 2025 (Paul, Weiss).

Activity is lower but not zero. The Justice Department announced two corporate FCPA resolutions in 2025, totaling about $123 million, against nine in 2024 totaling about $1.1 billion; the SEC brought no FCPA actions in 2025 (Paul, Weiss). In March 2026 the department declined to prosecute the French medical device maker Balt after a self-disclosure, with about $1.2 million in disgorgement and a parallel French settlement (Justice Department), and resolved the Scoular matter in July (below). Practitioners describe a “noticeable increase” in activity since the pause (Hogan Lovells). No FEPA charges had been made public as of early 2026 (Miller & Chevalier).

What the risk looks like in practice

The cases below run in date order. Each was a negotiated resolution, a guilty plea or a deferred prosecution agreement (DPA), often alongside an SEC settlement. Almost all involve non-U.S. companies or subsidiaries, and almost all involve intermediaries.

Siemens (2008): the bribe budget is the evidence

The German conglomerate and three subsidiaries pleaded guilty in December 2008. After its 2001 New York listing, Siemens made about $805.5 million in payments intended in whole or part for officials, including in Argentina, Venezuela, Bangladesh, and Iraq’s Oil-for-Food program. It paid $450 million in criminal fines and $350 million in SEC disgorgement, more than $1.6 billion in all with German settlements, and accepted a four-year monitor. The Justice Department said “bribery was nothing less than standard operating procedure for Siemens” (Justice Department). Lesson: a U.S. listing brings a foreign company’s worldwide books under U.S. law, and off-book accounts are themselves the violation.

Odebrecht and Braskem (2016): when bribery is a department

The Brazilian construction group and its petrochemical affiliate pleaded guilty in December 2016 in “the largest-ever global foreign bribery resolution,” with at least $3.5 billion in penalties shared among the United States, Brazil, and Switzerland. Odebrecht paid about $788 million in bribes through a “Division of Structured Operations” that “effectively functioned as a stand-alone bribe department,” with off-book communications and offshore entities. Braskem’s share was about $957 million, including $325 million in SEC disgorgement (Justice Department). Lesson: coordinated multinational cases now divide penalties among countries, and conduct in Latin America can be charged in New York.

Ericsson (2019 and 2023): a deferred prosecution can be undeferred

In December 2019 the Swedish telecom company entered a DPA and paid more than $1 billion, including a $520,650,432 criminal penalty and about $540 million to the SEC, over schemes in Djibouti, China, Vietnam, Indonesia, and Kuwait in which it “used third party agents and consultants to make bribe payments to government officials and/or to manage off-the-books slush funds” (Justice Department). In March 2023, after prosecutors found it had breached the agreement by failing to disclose evidence fully, Ericsson pleaded guilty, paid an additional $206,728,848, and accepted a one-year monitor extension (Justice Department). Lesson: sham consulting contracts are the classic red flag, and cooperation obligations last as long as the agreement does.

Airbus (2020): the global settlement

The European aerospace group agreed in January 2020 to combined penalties of more than $3.9 billion with the United States, France, and the United Kingdom. The Justice Department said Airbus used third-party business partners to bribe officials and airline executives in several countries, including China. Airbus entered a DPA in the United States and paid $527 million there for FCPA and export-control violations, while France’s Parquet National Financier received more than €2 billion and the U.K. Serious Fraud Office about €990 million (Justice Department). Lesson: European prosecutors can lead, and the United States took the smallest share.

Glencore (2022): intermediaries as a business model

Glencore entities pleaded guilty in May 2022 to bribery and market-manipulation charges, agreeing to pay more than $1.1 billion to U.S. authorities. Glencore International admitted conspiring to pay more than $100 million to intermediaries, intending that a significant portion go to officials in Nigeria, Cameroon, Ivory Coast, Equatorial Guinea, Brazil, Venezuela, and the Democratic Republic of the Congo, using sham consulting agreements and inflated invoices. The bribery plea carried a $428,521,173 fine, $272,185,792 in forfeiture, and a three-year monitorship (Justice Department). The monitorship was ended early in 2025 (Paul, Weiss). Lesson: commodity traders’ reliance on agents in resource-rich states is exactly where prosecutors look.

TIGO Guatemala (2025): the first resolution under the new priorities

Comunicaciones Celulares S.A., a Millicom subsidiary operating as TIGO Guatemala, paid more than $118 million in November 2025 under a two-year DPA, including a $60 million criminal penalty. The Justice Department said it paid monthly cash bribes to members of Guatemala’s Congress from 2012 to 2018 for favorable legislation, and that “Some of the cash that TIGO Guatemala used to pay bribes were the laundered proceeds of narcotrafficking.” Millicom had self-reported in 2015 (Justice Department). Lesson: old conduct does not expire on its own, and a narcotics connection places a matter squarely within current priorities.

Scoular (2026): small bribes, cartel exposure

On July 17, 2026, the Nebraska agricultural company entered a three-year DPA and agreed to pay more than $10 million, including a $9,769,521 criminal penalty. From 2013 to 2019, customs brokers at employees’ direction paid Mexican officials roughly $2,000 per train to avoid reinspections, billing the bribes back as fee reimbursements. The department said that “unbeknownst to the company or its employees,” part of the money benefited people tied to a cartel’s border operations, and it weighed that finding in the resolution (Justice Department). Scoular did not self-disclose and received no monitor (Hogan Lovells). Lesson: routine-looking border payments made through brokers can carry cartel exposure that the company never saw.

What it means for companies

The cases share a pattern: the bribe almost never moved directly. It went through an agent, consultant, broker, or partner, under an ordinary-looking contract and an invoice that described something else.

Construction cranes on an infrastructure project, a common setting for foreign bribery risk — Public contracts, licenses, and permits are where foreign bribery risk concentrates. Photo: Envato.

Treat intermediaries as the core risk. Know who owns each agent, who introduced it, what it actually does, and whether its fee matches the work. Use contracts with audit and termination rights, and pay only for documented services into accounts in the agent’s own name and country.
Test the labels in the books. “Consulting,” “marketing,” and fee reimbursements were the cover in these cases. For issuers, the accounting provisions apply even when no bribe is proven.
Do not rely on the facilitation exception. It is narrow under U.S. law and absent under U.K. law; many global programs ban such payments outright.
Screen for criminal-organization links. Under the June 2025 guidelines, a cartel or TCO connection is a priority factor. Logistics and customs-heavy businesses in affected regions need diligence on who ultimately receives payments.
Plan for overlapping jurisdictions. Airbus, Odebrecht, and Balt were coordinated with foreign prosecutors. Decide early, with counsel in each country, where to disclose and in what order.
Disclose early to the right office. The March 2026 policy requires disclosure to an appropriate Justice Department criminal component; “near miss” companies that cooperate but miss a full declination can get a non-prosecution agreement of under three years, no monitor, and a 50 to 75 percent reduction off the low end of the fine range (A&O Shearman). Liberty Mutual, which disclosed bribery at its Indian subsidiary in March 2024 before finishing its internal investigation, received a declination under the prior policy in August 2025, with $4.7 million in disgorgement (Paul, Weiss).
Understand monitors. A May 2025 Criminal Division memorandum says monitors should never be punitive and must be narrowly tailored (Paul, Weiss). A tested compliance program is the best argument against one.
Use FEPA defensively. A demand from an official is now itself a U.S. crime when it targets a covered company. Record and escalate solicitations.

Forecasting foreign bribery risk

Enforcement priorities are visible before cases are. The June 2025 guidelines name the categories that will draw attention; cartel and TCO designations signal which regions and sectors are in scope. Other signposts include allied investigations, which can lead to U.S. ones; media investigations in host countries; multilateral development bank debarments; and changes of government that expose a predecessor’s contracts. Conduct from several years ago remains live. A disciplined program maps each high-risk market and intermediary against these indicators and states in advance what would change its assessment. Competitive intelligence also matters when a rival appears to win business corruptly: the guidelines treat harm to “specific and identifiable U.S. entities” as a priority factor.

What it means for governments advising their companies

Trade ministries, export-promotion agencies, and embassy commercial sections hear a common question: did the 2025 shift change U.S. bribery law for our companies? The short answer is that the statute has not changed, priorities have, and other countries’ laws still apply.

Trucks lined up at a border crossing, where customs payments can create foreign bribery risk — Customs and border payments, as in the 2026 Scoular resolution, are a classic foreign bribery exposure. Photo: Envato.

U.S. reach is wide. A non-U.S. company is covered if it has securities listed in the United States, if its people take an act in furtherance of a bribe while in U.S. territory, or if it conspires with a covered person. The June 2025 guidelines note that “The most blatant bribery schemes have historically been committed by foreign companies” (Justice Department).

The OECD framework still binds the Parties. The OECD Working Group on Bribery is “responsible for monitoring the implementation and enforcement of the OECD Anti-Bribery Convention” through public peer reviews (OECD).

Home-country laws differ, sometimes sharply. The U.K. Bribery Act 2010 makes it an offense for a commercial organization to fail to prevent bribery by an “associated person,” with a defense of adequate procedures (section 7), explained in six principles in the official guidance. U.K. law treats facilitation payments as bribes (National Crime Agency). A separate offense of failure to prevent fraud, created by the Economic Crime and Corporate Transparency Act 2023, came into force on September 1, 2025, for large organizations (gov.uk). In May 2026 the Serious Fraud Office concluded a DPA with defense supplier Ultra Electronics over failure to prevent bribery in Algeria and Oman, with a penalty of about £10 million plus costs (SFO; Alston & Bird). France’s Sapin II law of 2016 created the anti-corruption agency AFA, requires compliance programs at companies with at least 500 employees and €100 million in turnover, and introduced the CJIP corporate settlement used in Airbus and Balt (Morgan Lewis). Brazil’s Clean Company Act (Law 12,846 of 2013) imposes strict civil and administrative liability on companies, with fines of 0.1 to 20 percent of gross revenue (Jones Day); new leniency rules adopted in December 2025 allow up to a two-thirds reduction for disclosure within 12 months (Miller & Chevalier). An EU anti-corruption directive adopted in April 2026 harmonizes offenses and penalties across member states (Arnold & Porter).

Other prosecutors are coordinating. On March 20, 2025, the U.K. Serious Fraud Office, France’s Parquet National Financier, and the Office of the Attorney General of Switzerland formed an International Anti-Corruption Prosecutorial Taskforce to deepen joint work on cases (gov.uk). The SFO’s director said it was “in no way a reaction” to the U.S. pause (Skadden).

How good briefings work. Useful advice to exporters is concrete: which U.S. nexus points apply; how home-country law differs on facilitation payments and failure-to-prevent offenses; how to vet agents in high-risk markets; where to report solicitations, including to the embassy; and that a resolution in one country does not settle exposure in another. That service is useful whatever view a government takes of any country’s enforcement choices.

Frequently asked questions

Can a non-U.S. company be prosecuted under the FCPA?

Yes, if it has securities listed on a U.S. exchange or if acts in furtherance of a bribe take place in U.S. territory. Siemens, Odebrecht, Ericsson, Airbus, and Glencore were all non-U.S. companies.

Did the 2025 executive order end FCPA enforcement?

No. Executive Order 14209 paused new investigations for review, and the June 9, 2025, guidelines restarted enforcement around four priorities. Corporate resolutions in 2025 and 2026 and continuing trials show the law is enforced, at lower volume.

What is FEPA?

A December 2023 law making it a U.S. crime for a foreign official to demand or accept a bribe from a U.S. company, an issuer, or a person in U.S. territory. The FCPA covers only the payer. No FEPA charges had been made public as of early 2026.

Is a company responsible for bribes paid by its agent?

Yes, if it knew or was aware of a high probability that the payment would reach an official; deliberate blindness does not help. Under the U.K. Bribery Act, a company can be liable for failing to prevent bribery by an associated person regardless of knowledge.

Does self-reporting help?

Yes. Under the March 2026 Justice Department policy, voluntary disclosure, full cooperation, remediation, and no aggravating factors lead to a declination with disgorgement, as Balt received in 2026 (and Liberty Mutual under the earlier policy in 2025). Foreign authorities have their own processes.