FCPA and UK Bribery Act compliance consulting for anti-bribery procedures you can show, not just state.

What it is

What are the FCPA and the UK Bribery Act?

The Foreign Corrupt Practices Act of 1977, as amended, is the United States law against paying foreign officials to win or keep business. Beside its anti-bribery provisions sit accounting provisions that oblige companies with US-listed securities to keep accurate books and records and an adequate system of internal accounting controls. The Department of Justice enforces it criminally, the SEC civilly.

The Bribery Act 2010 is broader in one direction: it covers bribing and being bribed in business generally, not only dealings with public officials, and it adds a separate offence for bribing a foreign public official. For companies, its best-known feature is section 7, under which a commercial organisation commits an offence when a person associated with it pays a bribe to gain business or an advantage for it, unless the organisation proves it had adequate procedures in place to prevent that conduct.

Current position. Both statutes are in force. The Ministry of Justice guidance on adequate procedures, issued under section 9 of the Bribery Act, was last updated on 22 January 2025. In the US, the DOJ and SEC Resource Guide was last updated on 16 December 2024, and the DOJ's Evaluation of Corporate Compliance Programs was last updated in September 2024. On 10 February 2025 Executive Order 14209 paused FCPA enforcement, and on 9 June 2025 the Deputy Attorney General issued new Guidelines for Investigations and Enforcement of the FCPA, setting priorities for new and existing investigations. The statute itself was not amended.

Who it is for

Who needs FCPA and UK Bribery Act compliance?

Reach, not headquarters, decides. The UK Act's corporate offence applies to bodies incorporated in the UK wherever they trade, and to any other company or partnership that carries on business, or part of a business, in the UK. The FCPA reaches US persons, issuers of US-listed securities and foreign firms that act within US territory. Four triggers bring organisations to Sterling:

• A customer's supplier questionnaire asks about your anti-bribery controls. Multinational buyers expect a policy, due diligence and training records, not just a signed declaration.
• A tender or financing condition names anti-corruption compliance. Public buyers, development lenders and investors ask how you prevent bribery by agents, distributors and joint-venture partners.
• An enforcement authority's expectations are now your board's question. An incident or a whistleblower report prompts directors to ask whether your procedures would stand up to scrutiny.
• Your group parent requires it. A US-listed or UK-headquartered parent extends its programme to subsidiaries and acquisitions, and each entity has to show local evidence.

Requirements

What are the main FCPA and UK Bribery Act requirements?

Neither law lists controls item by item. The obligations are prohibitions, one corporate defence and, for US issuers, accounting duties; the official guidance explains what a credible programme looks like. At title level, the structure your programme answers to is this:

• UK Act, sections 1 and 2 (general bribery offences): offences of bribing another person and of being bribed, in the public and private sectors.
• UK Act, section 6: bribery of foreign public officials.
• UK Act, sections 7 to 9: failure of commercial organisations to prevent bribery, the meaning of associated person, and the guidance the Secretary of State publishes on preventing bribery.
• Ministry of Justice six principles: proportionality, top-level commitment, risk assessment, due diligence, communication including training, and monitoring and review.
• FCPA anti-bribery provisions: no corrupt offer, payment or promise of anything of value to a foreign official to obtain or retain business.
• FCPA accounting provisions: books and records that fairly reflect transactions, and an adequate system of internal accounting controls, for companies with US-listed securities.
• DOJ Evaluation of Corporate Compliance Programs: three questions (is the programme well designed, adequately resourced and applied in good faith, and does it work in practice) across risk assessment, policies, training, reporting and investigation, third parties, acquisitions, management commitment, incentives and testing.

Compliance route

How do you become FCPA and UK Bribery Act compliant?

There is no audit to pass and no certificate to receive. Compliance is shown by procedures that exist, operate and leave a trail. Sterling builds and tests that programme with you; your legal advisers interpret how each law applies to your facts.

1. 01
   Map the exposure.Where you sell and source, which intermediaries act for you, where your people meet public officials, and which entities have a US or UK connection, confirmed with your legal advisers.
2. 02
   Gap analysis: compare current controls with the six principles and the DOJ questions.What already works is kept; missing or paper-only controls get owners, dates and resources.
3. 03
   Build proportionate procedures.Policy, risk-based third-party due diligence, gifts and hospitality rules, payment and accounting controls, contract clauses, training by role and a confidential reporting route.
4. 04
   Operate, test and report to the board.Controls run on live transactions; internal audit and a management review test them, and the findings are closed with evidence.
5. 05
   Monitor, review and, if you choose, seek independent assurance.Risk reassessed as markets, partners and acquisitions change; some organisations add ISO 37001 certification from an accredited body as external evidence.

Check the route before you sign. Nobody can issue a valid FCPA or Bribery Act certificate, so treat any such offer with suspicion. If you want independent assurance, ask for ISO 37001 certification by a body whose accreditation, recognised under the Global ACI arrangement, covers anti-bribery management systems, and verify it with the accreditation body. ISO 37001 certification · The certification buyer's checklist

Cost

How much does FCPA and UK Bribery Act compliance cost?

Cost follows exposure: a distributor in two low-risk markets needs far less than a contractor using agents in many countries. Our pricing stays constant: every component listed, one all-inclusive proposal.

Timeline

How long does it take to build an FCPA and UK Bribery Act compliance programme?

Writing a policy takes days; showing that it operates takes months. Due diligence has to reach the higher-risk third parties, training has to be delivered and a review has to test the controls. As an estimate, a proportionate programme typically takes three to six months to design and put into operation, depending on your exposure.

If a customer, lender or acquirer has set a date, tell us at the start and we will say what can credibly be in place by then.

Your engagement

What your FCPA and UK Bribery Act engagement includes

Sterling does not certify, attest or validate compliance with either law; whether procedures were adequate is ultimately judged by prosecutors and courts. What we deliver is the working programme and its evidence, organised on Sterling OS™. With Design™, our consultants guide your team, who build and run the controls; with Drive™, we take on most of the build as a managed service. You choose one, not both. Once the programme operates, Sustain™ keeps due diligence, training and reviews on schedule, and Automate™ is Effivity, where the registers and records live.

• Exposure map, gap analysis and plan

  Entities, markets, intermediaries and priorities agreed before work begins.

• Policy and procedures

  Anti-bribery policy, due diligence, gifts and hospitality, payments and reporting, written for how you trade.

• Effivity ISO & GRC software

  Registers, due diligence files and training records in one place, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  A test of whether the controls operate, with findings closed with evidence.

• Board reporting

  A concise report the governing body can act on, prepared with your compliance lead.

Legal interpretation remains with your legal advisers; enforcement decisions remain with the authorities.

Often combined with

Standards organisations pair with FCPA and UK Bribery Act

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.
• ISO 22316ISO 22316 implementation for organisational resilience: gap analysis against the principles and attributes, board evaluation, Effivity.