Compliance Program Design
Risk-based FCPA and anti-bribery compliance programs, with policies, controls over gifts, travel, and hospitality, training, and reporting channels that fit the company's actual footprint.
Anti-corruption counsel for companies operating across borders, from the compliance programs, due diligence, and internal investigations that keep exposure from forming to defense in matters before the DOJ and SEC.
The Foreign Corrupt Practices Act has two halves, and the quieter one does most of the work. The anti-bribery provisions require proof of a corrupt payment to a foreign official. The accounting provisions require only that an issuer's books describe a payment inaccurately or that its controls failed to catch it, with no materiality threshold, which is why most corporate resolutions rest on them.
Exposure travels through intermediaries: a distributor's margin is the company's payment if the company knew, or consciously avoided knowing, where it went. The Department of Justice paused enforcement in February 2025 and resumed it in June under guidelines that favor cartel-linked and competitively harmful conduct over routine hospitality. The statute was not amended, the SEC still polices issuers' books, and a company doing business in the United Kingdom sits within the Bribery Act's failure-to-prevent offense, which needs no proof of intent.
We advise companies, boards and individuals, and we have represented clients before the SEC. Where a payment has crossed a border, we work with locally admitted counsel and plan document collection around the data-protection and blocking statutes of the countries where the evidence sits.
Risk-based FCPA and anti-bribery compliance programs, with policies, controls over gifts, travel, and hospitality, training, and reporting channels that fit the company's actual footprint.
Diligence on distributors, agents, joint-venture partners, and acquisition targets, the intermediaries and transactions through which anti-corruption exposure most often enters a company.
Scoped, privilege-aware investigations into allegations of corruption or books-and-records problems, with document review, witness interviews, and findings the board and management can act on.
Representation in anti-corruption matters before the Department of Justice and the Securities and Exchange Commission, including voluntary disclosures, subpoena and information requests, and resolution discussions.
Post-incident remediation, controls enhancement, and support for any reporting obligation or monitor relationship, so a finding ends in a stronger compliance program.
Anti-bribery counsel where a matter touches multiple regimes, coordinating with specialist or locally admitted counsel where required so the response is consistent across jurisdictions.
Issuers with securities registered in the United States, including foreign companies with listed depositary receipts, domestic concerns, and anyone who acts in furtherance of a bribe while in US territory are covered. The government has treated a dollar wire clearing through New York as such an act, which makes many foreign payments American cases.
The knowledge standard reaches conscious disregard: a success fee out of proportion to the work, a request to pay into a third country, or an agent related to the official is a fact the company is taken to know. The intermediary's diligence file is the Department's first read; its absence is read too.
A willful books-and-records or internal-controls violation carries up to twenty years and a $5 million fine for an individual, and $25 million for an entity, against five years and $2 million on an anti-bribery count. The SEC enforces the accounting provisions civilly against issuers without proving that any bribe was intended.
The Department's compliance guidance, as updated in 2024, asks whether a program is well designed, whether it is applied in good faith, and whether it works in practice. The evidence is operational: a hospitality policy with a number in it, third-party payments checked against the diligence file, and hotline reports that reach the audit committee.
Under the Department's Corporate Enforcement Policy, revised in May 2025, a company that self-discloses, cooperates fully and remediates in time is presumptively declined absent aggravating factors. A disclosure made within 120 days of an internal whistleblower report can still qualify even after the whistleblower has gone to the Department. The clock starts at the hotline.
A buyer inherits the target's liability at closing. Under the Department's 2023 merger safe-harbor policy, an acquirer that discloses misconduct found at the target within six months of closing and remediates within a year is presumed eligible for a declination. Diligence therefore concentrates on government-facing revenue and third-party agents, and the integration plan carries dates.
A hotline report, audit flag, or third-party red flag lands. Within days we scope the allegation, issue litigation holds across the jurisdictions touched, and structure the inquiry under privilege, with counsel directing the work, so the company owns the facts before anyone else does.
Documents are collected under local data-protection and blocking-statute constraints, payments are traced through the intermediary chain, and witnesses are interviewed with Upjohn warnings given and recorded. The board or audit committee gets findings it can act on rather than a narrative it has to defend.
With the facts in hand, the company faces its hardest call. It can self-disclose to DOJ and SEC under the Corporate Enforcement Policy, remediate quietly, or prepare for the knock. We model each path, including cooperation credit, successor liability, and parallel foreign regimes, before anything is said to a regulator.
If the government engages, the matter runs through subpoenas, proffers, and resolution discussions toward a declination, an NPA, a DPA, or a negotiated settlement, while the compliance program is rebuilt and tested so the same payment can never move the same way twice.
The company that finds the payment first gets to explain it.
The Foreign Corrupt Practices Act, or FCPA, is the principal US anti-bribery law. Its anti-bribery provisions prohibit offering or giving anything of value to foreign officials to obtain or retain business, and its accounting provisions require issuers to keep accurate books and records and maintain adequate internal controls. The DOJ and SEC share enforcement authority, and exposure can reach conduct that occurs entirely outside the United States.
Often, yes. The statute reaches US issuers and domestic concerns, their officers, employees, and agents, and in many cases foreign companies and persons whose conduct touches US commerce. Third parties such as distributors, agents, joint-venture partners, and intermediaries can create liability for the company that engages them. We assess where a particular structure and footprint create exposure and build the controls to manage it.
The Department of Justice judges a program by three questions: is it well designed for the company's actual risks, is it applied earnestly and in good faith with the resources and authority to work, and does it work in practice. A program that answers them has a written policy with a hospitality threshold in it, and it keeps a diligence file on every intermediary. Third-party payments are routed past someone who has read that file. Training reaches the sales force in the market where the risk sits, reports from the hotline reach the audit committee, and periodic testing ends in fixes rather than findings. For a company carrying on business in the United Kingdom the same program is the adequate-procedures defense to the Bribery Act's failure-to-prevent offense, so it is built once to serve both.
When a credible allegation, audit finding, or whistleblower report suggests possible corruption or books-and-records problems, an internal investigation lets the company learn the facts before a regulator does. We scope the inquiry, preserve privilege where it applies, gather and review documents and interview witnesses, and advise the board and management on remediation and any disclosure decision. Acting early preserves options that disappear once an enforcement matter is underway.
Yes. We represent companies and individuals in anti-corruption matters before the Department of Justice and the Securities and Exchange Commission, including voluntary disclosures, subpoena and information requests, and resolution discussions. We do not speak for the agencies, only for the clients in front of them, and where a matter requires specialist or locally admitted counsel in another jurisdiction we coordinate that representation.
A buyer takes the target's history with the shares, and in a merger it takes the liability outright. Diligence therefore starts with where the target's revenue depends on government customers or licenses, which intermediaries sit between the target and those officials, and whether the books describe their payments honestly. Representations and a specific indemnity price what is found; they do not cure it. What cures it is the Department's 2023 merger safe-harbor policy, under which an acquirer that discloses misconduct found at the target within six months of closing, cooperates, and remediates within a year is presumed eligible for a declination. Those two dates go into the integration plan before signing.
Defense and counsel in False Claims Act and qui tam matters, covering whistleblower allegations, government-facing investigations, and the exposure that follows federal funds.
Explore →Representation in securities enforcement and SEC inquiries, in the disclosure, accounting, and trading matters where a regulator is at the table.
Explore →Trial advocacy for complex business disputes, contract breaches, and commercial conflicts in state and federal courts, from first assessment to judgment and appeal.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.