Successor Liability in an Acquisition with Legacy Payments
A European manufacturer plans to acquire 100% of a target company in a high-risk country for $120 million. During limited due diligence, the buyer's finance team finds $1.2 million in ledger entries labelled 'government liaison' over three years, with no contracts or deliverables. The target's CFO says the payments were to 'local consultants' for 'market intelligence' and cannot provide reports. The seller offers a warranty that the target has complied with all anti-bribery laws and wants signing in three weeks. The deal team argues the warranty and indemnity are sufficient protection and asks the compliance lead to sign off quickly. The compliance lead knows the target's largest customer is a state-owned entity and that the target's sales director is a former official. The board wants the deal but is concerned about reputational and legal risk.
1. What does the 2025 expansion of due diligence for transactions require the buyer to do before signing?
Read the worked answer
The 2025 revision expands due diligence beyond third parties to transactions such as mergers, acquisitions, joint ventures, and investments. The buyer must conduct a risk-based assessment of the target's bribery risks, including its history, third-party payments, government interactions, internal controls, and culture. The $1.2 million in unexplained 'government liaison' payments is a direct red flag, especially because the target's largest customer is state-owned and the sales director is a former official. Limited diligence is not enough when these facts are known.
The buyer should extend diligence to the target's agents, consultants, and other intermediaries; review contracts, invoices, bank records, and approvals; verify beneficial ownership and government connections; and interview finance and compliance staff. A forensic review may be needed to determine whether the payments were legitimate. Transaction due diligence should be proportionate to risk but cannot be reduced to a warranty. The purpose is to decide whether the risk can be priced, remediated, or is a deal-breaker. The compliance lead should not sign off merely because the deal team is under time pressure.
2. Evaluate the seller's warranty as a risk mitigation and recommend pre-signing conditions.
Read the worked answer
A warranty allocates some financial risk after the fact, but it does not prevent successor liability, reputational damage, debarment, or criminal exposure. The seller may have limited ability to pay, warranties may be capped or time-limited, and a breach may be difficult to prove. The buyer could inherit the target's conduct and be expected to remediate it. Relying on the warranty alone would be a weak control.
Pre-signing conditions should include a forensic review of the 'government liaison' payments, identification of the recipients and their government connections, verification of whether any services were delivered, and a legal assessment of exposure. The buyer should require a remediation plan before closing, specific indemnities and an escrow or holdback, full disclosure of the findings, and board approval of the residual risk. If the payments cannot be explained or remediated, the buyer should consider walking away or restructuring the deal. The compliance lead should document the recommendation and escalate to the board rather than absorb the risk into the transaction team's timetable.
3. Outline the post-closing integration and monitoring actions needed to extend the ABMS to the target.
Read the worked answer
Post-closing, the buyer should extend its ABMS to the target promptly. This means appointing a compliance responsible person, conducting a fresh bribery risk assessment, mapping all third parties, and prioritising enhanced due diligence on agents and consultants. High-risk relationships, especially any connected to the unexplained payments, should be suspended or terminated unless they can be justified. The target's policies, payment controls, gift and hospitality rules, and whistleblowing channel should be aligned with the buyer's programme. Staff should be trained, and the sales director's former-official status should be reviewed for conflicts.
The buyer should monitor integration through compliance reviews, internal audit, payment testing, and periodic reporting to the board. Any evidence of continuing improper payments should trigger investigation and legal advice. The integration file should record decisions, remediation, training, and monitoring results so that the transition to ISO 37001:2025 can demonstrate that transaction risk was assessed and controlled, not ignored.