The Joint Venture Partner Nobody Vetted
Solterra, a renewable developer listed in Madrid, takes a 51% stake in a joint venture to build a 200 MW solar plant in a country where grid-connection and land-conversion permits are routinely contested. The 49% partner, Kestel Holdings, appoints the JV's general manager and handles all permitting and local-content matters. Solterra's due diligence file contains a credit report and a reference from Kestel's own bank. Beneficial ownership runs through three offshore companies; one director appears in a 2019 local press article about a tender scandal under a near-identical spelling of his name. Kestel declines to sign Solterra's anti-bribery declaration, offering instead to sign 'the JV's own local code', and says its permit team will not share subcontractor records for confidentiality reasons. Solterra's investment committee approved the deal in six weeks to meet a feed-in-tariff deadline. The JV will be fully consolidated in Solterra's accounts and construction starts in nine weeks.
1. Do Solterra's due diligence and control obligations extend to Kestel and the JV, given that Solterra does not control the permitting workstream?
Read the worked answer
Yes. The due diligence duty attaches to associated persons, not to entities the organisation controls.
ISO 37001 recognises that bribery is frequently channelled through intermediaries, and defines associated persons broadly: anyone with whom the organisation has, or plans, a business relationship - agents, consultants, subcontractors, subsidiaries and joint venture partners. Due diligence must be proportionate to risk and includes diligence on transactions such as mergers, acquisitions and joint ventures.
Control changes the method of managing the risk, not whether it must be managed. Where Solterra controls the JV (51%, consolidation), it can impose controls directly. Where Kestel controls a workstream, Solterra cannot manage that risk directly and must manage it through the relationship: contractual commitments, approval rights, monitoring and audit access. Where control is genuinely absent and controls cannot be made effective, the question becomes whether to proceed at all.
Two distinctions are worth keeping sharp:
- Consolidation is an accounting concept, not an anti-bribery one. Full consolidation does not give Solterra control over how permits are obtained.
- A minority partner is not a shield. A 49% partner with operational control of the highest-risk activity is the associated person that matters most.
The obligations are therefore fully engaged, and the diligence performed is plainly inadequate for this risk profile.
2. Evaluate the due diligence actually performed against the understand, evaluate and monitor requirements of clause 8.2.
Read the worked answer
The file fails every strand.
- Understand (8.2.2). Solterra should have established beneficial ownership, the partner's business model, reputation, key individuals and why Kestel was needed. A credit report answers solvency, not integrity. The three-layer offshore ownership was never unwound, and the near-identical name in a 2019 tender scandal was never resolved - an unresolved adverse-media match calls for further investigation, not a note in the file.
- Evaluate (8.2.3). The bribery risk must be assessed against the value and nature of the relationship. A 200 MW project in a contested-permit jurisdiction, with the partner running permitting, is high risk, and the diligence should have been deepened accordingly. Two red flags - refusal to sign the anti-bribery declaration and refusal to share subcontractor records for 'confidentiality' - were treated as administrative friction rather than as evidence.
- Monitor (8.2.4). Due diligence is not a closing condition. It continues through the relationship, especially when the partner's role or personnel change.
Aggravating factors: the bank reference came from an interested party rather than an independent source; a six-week timetable created pressure to accept the file as it stood; and the feed-in-tariff deadline is a commercial justification, which ISO 37001 never accepts as a reason to lower diligence.
3. What should Solterra do in the nine weeks before construction, and what happens if Kestel continues to refuse?
Read the worked answer
The decision must be escalated and made explicit, with controls or exit as the outcome.
Clause 8.2.3 requires that where due diligence reveals significant risk, the matter is escalated to the appropriate management level and the organisation proceeds only if it can implement effective controls.
Sequence before construction:
- Enhanced due diligence by an independent party: beneficial ownership to natural persons, PEP and sanctions screening, resolution of the 2019 press match, interviews with Kestel's permit team, and disclosure of the permit consultants and success fees it intends to use.
- Contractual controls in the shareholders' agreement: an anti-bribery programme aligned with ISO 37001, a commitment from Kestel, prior approval of permit consultants and their fee structures, audit and step-in rights, suspension on a red flag, and termination for breach.
- JV governance: an anti-bribery committee at JV level, a compliance liaison with a reporting line to Solterra, and training for all JV staff including those employed by Kestel.
- Monitoring: transaction testing on permitting spend, with specific attention to cash and success fees.
On the refusal to sign: 'the JV's local code' is acceptable only if it is assessed and found equivalent, and a signature alone proves nothing. The material question is whether Kestel will accept verifiable controls.
If it will not, the correct outcome is not to proceed, or to restructure so permitting sits with a party Solterra controls. The decision, rationale and approving level should be documented.