ICG AC (CGCAT) cheat sheet

Bribery: offering, promising, giving, requesting, agreeing to receive, or accepting an undue advantage (financial or non-financial) to induce improper performance of a function or breach of trust.

Key distinction: bribery targets a specific improper act by an official or private person; a facilitation payment buys only faster routine performance of a duty the payer is already owed.

Active vs passive bribery: active = the offeror/supplier side; passive = the recipient/official side who requests or accepts. Both are criminalised under UNCAC and the UK Bribery Act.

Public-sector vs private/commercial bribery: the UK Bribery Act covers both; the FCPA's anti-bribery provisions reach foreign officials only, with commercial bribery handled by other statutes.

Kickback: a portion of a contract value or payment returned secretly to the person who influenced the award; a form of bribery usually paired with false invoicing.

Extortion differs from bribery: in extortion the payer is coerced by a threat; in bribery the payer initiates or consents to the exchange of advantage for improper action.

Corruption risk typologies: sector (construction, extractives, defence, health procurement), geography (CPI score, control-of-corruption index), transaction (agents, customs, licensing), and relationship (state-owned counterparties).

'Undue advantage' is not limited to cash: shares, jobs for relatives, scholarships, travel, sponsorship, and sexual favours can all constitute the benefit element.

FCPA anti-bribery provisions (15 U.S.C. §§78dd-1 to -3) apply to issuers, domestic concerns, and any person acting in U.S. territory; they prohibit corrupt payments to foreign officials to obtain or retain business.

FCPA accounting provisions require issuers to keep books and records that accurately reflect transactions and to maintain a system of internal accounting controls; these apply regardless of whether a bribe occurred.

UK Bribery Act 2010 creates four offences: bribing another person (s.1), receiving a bribe (s.2), bribing a foreign public official (s.6), and failure of a commercial organisation to prevent bribery (s.7).

Section 7 is a strict-liability corporate offence; the only statutory defence is 'adequate procedures' (six principles in Ministry of Justice guidance: proportionality, top-level commitment, risk assessment, due diligence, communication/training, monitoring/review).

UK Bribery Act has extraterritorial reach: it covers UK nationals and residents, UK-incorporated bodies, and any organisation carrying on business in the UK, regardless of where the conduct occurs.

OECD Anti-Bribery Convention (1997) requires signatories to criminalise bribery of foreign public officials in international business transactions; peer reviews by the OECD Working Group on Bribery monitor implementation.

UNCAC (2003) is the only legally binding universal anti-corruption instrument: it covers preventive measures, criminalisation, asset recovery, international cooperation, and technical assistance.

FCPA exception: 'grease payments' to expedite routine governmental action are permitted under the FCPA but are NOT permitted under the UK Bribery Act, which has no facilitation-payment exception.

Third-party risk tiers typically combine country risk, sector risk, interaction risk (government touchpoints), and payment risk (commissions, success fees, offshore accounts) into low/medium/high ratings.

Enhanced due diligence triggers: state-owned counterparties, PEP connections, opaque ownership, cash or third-country payments, unusually high commissions, and reluctance to accept anti-bribery clauses.

Beneficial ownership verification should identify natural persons owning or controlling ≥25% (or the applicable threshold) and confirm they are not sanctioned or politically exposed.

Red flags in due diligence: shell-company addresses, no verifiable operating history, refusal to disclose principals, requests for payments to unrelated entities, and use of intermediaries in high-risk jurisdictions.

Due diligence is continuous, not one-off: re-screen on contract renewal, ownership change, adverse media, or sanctions-list updates.

Contractual controls: anti-bribery representations, audit rights, termination for breach, no-subcontracting without consent, and certification of compliance with applicable laws.

Risk assessment methodology: likelihood × impact scoring, documented in a risk register that drives resource allocation and control design.

Agent commission benchmarking: compare proposed fees against market norms; unexplained premiums above typical 2–10% ranges warrant escalation and documented justification.

Programme pillars: tone at the top, risk assessment, policies and procedures, training and communication, due diligence, monitoring and auditing, and remediation.

Governance structure: board-level oversight (often an audit or compliance committee), a designated compliance officer with independence and reporting lines to the board, and defined accountability across business units.

Policies should address gifts and hospitality, facilitation payments, political contributions, charitable donations, sponsorships, third-party intermediaries, and conflicts of interest.

'Adequate procedures' under the UK Bribery Act and 'reasonable assurance' under the FCPA both emphasise proportionality to risk - small, low-risk firms need simpler controls.

Training should be role-based: higher frequency and depth for sales, procurement, government-facing, and third-party-management staff.

Monitoring metrics: number of third parties screened, gifts approved/declined, whistleblowing reports, investigations opened/closed, and training completion rates.

Certification and attestation: annual compliance certifications from business unit leaders and high-risk third parties strengthen accountability.

Programme review should be periodic and triggered by incidents, regulatory changes, mergers, or entry into new markets.

Definition: a small payment made to a low-level official to expedite or secure performance of a routine, non-discretionary governmental action the payer is already entitled to.

FCPA 'grease payment' exception covers only routine governmental action - permits, licences, visas, customs clearance, police protection, mail, and utility services - not decisions to award business.

UK Bribery Act has no facilitation-payment exception; such payments can constitute bribery under sections 1, 2, or 6.

OECD Convention requires parties to criminalise bribery of foreign officials without a facilitation-payment exception; several signatories have narrowed or eliminated their exceptions.

Routine governmental action does not include decisions on new business, contract awards, or terms of a contract.

Risk indicators: small cash payments, undocumented 'processing fees', payments to individual officials rather than agencies, and recurring payments at border or customs points.

Controls: prohibit facilitation payments in policy, require pre-approval and documentation of any exception, and require reporting of demands to management and, where appropriate, authorities.

Extortion defence: payments made under genuine duress (threat to life or liberty) should be reported and documented; they are not a routine facilitation payment.

Gifts and hospitality are not prohibited per se; the test is whether they are intended to influence improperly or could reasonably be perceived as doing so.

Common thresholds: nominal-value limits (e.g., USD 50–250), aggregate annual caps per recipient, and pre-approval requirements above a set value.

Prohibited categories: cash or cash equivalents, gifts to government officials during pending decisions or tenders, and hospitality lacking a legitimate business purpose.

Hospitality should have a clear business rationale, be reasonable in value, be provided openly (not concealed), and not involve prohibited recipients or timing.

Conflicts of interest: a personal interest that could improperly influence professional judgement; must be disclosed, recorded, and managed (recusal, divestment, or reassignment).

Conflict types: financial, familial, outside employment, board seats, gifts, and post-employment/revolving-door arrangements.

Disclosure registers should be maintained and reviewed periodically; high-risk roles (procurement, sales, government relations) warrant annual attestation.

Red flags: gifts around contract award dates, hospitality to officials with decision authority, undisclosed family relationships with suppliers, and lavish travel disproportionate to business need.

FCPA books-and-records provision requires that transactions be recorded accurately and in reasonable detail; off-book or 'slush fund' accounts violate it even absent a bribe.

Internal accounting controls must provide reasonable assurance that transactions are authorised, recorded, and reported in accordance with management's authorization.

Segregation of duties: separate initiation, approval, recording, and reconciliation functions to reduce fraud and concealment risk.

Red flags in financial records: round-number payments, unexplained consulting fees, payments to offshore accounts, duplicate invoices, and unusual journal entries near period end.

Third-party payment red flags: commissions paid before contract signature, payments to accounts in a different country from the vendor, and cash payments.

Petty cash and expense controls: receipts required, limits enforced, and unusual patterns reviewed; cash payments to officials should be prohibited.

Audit trail: documentation should link each payment to a legitimate business purpose, contract, and approval.

Whistleblower and internal audit channels should be able to detect and escalate anomalies in books and records.

Investigation triggers: whistleblower reports, internal audit findings, due diligence red flags, media reports, or regulator inquiries.

Investigation steps: intake and triage, scoping, preservation of evidence (legal hold), interviews, forensic review, and reporting to the board or committee.

Privilege considerations: investigations conducted through counsel may attract legal privilege; scope and documentation should be carefully managed.

Whistleblowing channels should be confidential, accessible, non-retaliatory, and available to third parties where appropriate; EU Whistleblower Directive (2019/1937) sets minimum standards for covered entities.

Remediation: root-cause analysis, disciplinary action, control enhancements, training refresh, and, where appropriate, self-disclosure to authorities.

Documentation of remediation demonstrates good faith and can mitigate penalties in enforcement actions.

Lessons-learned reviews should feed back into risk assessment and control design.

Cooperation credit: voluntary self-disclosure, full cooperation, and timely remediation are recognised mitigating factors under U.S. DOJ and SEC enforcement policies.

U.S. enforcement: DOJ handles criminal FCPA cases; SEC handles civil cases against issuers; penalties include fines, disgorgement, monitorships, and imprisonment.

U.S. Sentencing Guidelines fine calculation: base fine multiplied by culpability score (derived from aggravating and mitigating factors) to determine the fine range.

UK enforcement: Serious Fraud Office (SFO) prosecutes; Deferred Prosecution Agreements (DPAs) are available under the Crime and Courts Act 2013 for organisations.

Sanctions: OFAC and UK/UN/EU sanctions regimes prohibit dealings with designated persons and entities; payments to sanctioned officials or entities may breach sanctions independently of bribery law.

Sanctions screening should cover counterparties, beneficial owners, and payment routes; strict liability applies to many sanctions regimes.

Cooperation: DOJ Criminal Division Evaluation of Corporate Compliance Programs and FCPA Corporate Enforcement Policy reward voluntary disclosure, cooperation, and remediation.

Whistleblower rewards: SEC and CFTC programmes pay awards to eligible whistleblowers who provide original information leading to successful enforcement.

Multi-jurisdictional enforcement: the same conduct may be prosecuted by multiple authorities; coordination and global settlements are increasingly common.