FCPA compliance matters to more than large multinational corporations. A small business can create Foreign Corrupt Practices Act risk when it sells overseas, uses foreign agents or distributors, bids on government-linked work, pays consultants to open doors, reimburses travel or hospitality, or records questionable third-party payments without enough documentation.
Net Profits Compliance & Internal Controls Guide
FCPA Compliance for Small Business: 2026 Anti-Bribery Guide
Use third-party due diligence, payment controls, accurate records, approval rules, training, and escalation procedures to reduce foreign-bribery risk.
Last reviewed: September 8, 2026 | Author: Cornelius Frazier, MBA
The Net Profits Bottom Line
The most dangerous anti-bribery risk often begins with an ordinary business request: “Pay this consultant,” “call it marketing,” “the agent knows the officials,” or “this is just how business is done here.” A practical control system is identify the government connection → vet the third party → document the business purpose → approve the payment → record it accurately → monitor the relationship → escalate red flags.
What Does the FCPA Cover?
The U.S. Foreign Corrupt Practices Act has two core areas that business owners should understand:
- Anti-bribery provisions: restrictions on corruptly offering, promising, authorizing, or providing anything of value to certain foreign officials for an improper business advantage.
- Accounting provisions: requirements that apply to issuers involving accurate books and records and adequate internal accounting controls.
The DOJ and SEC’s FCPA Resource Guide is written for organizations of all sizes, including small businesses entering international markets.
Important: The FCPA is not a rule that says every gift, meal, travel expense, or government interaction is automatically illegal. Facts, intent, recipient, business purpose, value, local law, documentation, and surrounding circumstances all matter. Specific situations should be reviewed with qualified legal counsel.
How FCPA Risk Shows Up in a Small Business
You do not need offices in ten countries to create exposure. Risk can emerge through a single distributor, sales agent, consultant, joint venture, sourcing relationship, or government-linked customer.
| Situation | Red Flag | Control |
|---|---|---|
| Foreign sales agent | Large success fee with vague services | Due diligence, written scope, market-rate review, approval |
| Government-linked customer | Official asks for a personal benefit | Stop, document, escalate to counsel/compliance |
| Marketing expense | No invoice, vague description, unusual intermediary | Require supporting documents and business-purpose review |
| Travel/hospitality | Luxury or unrelated personal travel | Preapproval, limits, agenda, receipts, legitimate business purpose |
| Distributor | Refuses ownership disclosure | Beneficial-owner review and contract controls |
Liberty Mutual FCPA Case: What the DOJ Record Actually Shows
In August 2025, the DOJ declined to prosecute Liberty Mutual Insurance Company in connection with conduct involving its Indian subsidiary, Liberty General Insurance. According to the DOJ, approximately $1.47 million in bribes were paid to officials at six state-owned banks in India from about 2017 through 2022 in exchange for business referrals. DOJ said certain employees used third-party intermediaries and concealed the payments as marketing expenses.
The DOJ calculated approximately $4.7 million in profits from the affected relationships. Liberty Mutual agreed to disgorge $4,699,088.
Why the outcome matters
- The company voluntarily self-disclosed the matter.
- DOJ credited full and proactive cooperation.
- The company conducted root-cause analysis and separated personnel involved.
- It strengthened third-party vetting, monitoring, payment oversight, and compliance controls.
- The declination did not provide protection from prosecution to individuals.
The primary DOJ records are the Liberty Mutual declination letter and the DOJ Fraud Section’s 2025 Year in Review.
Third-Party Due Diligence Is One of the Most Important Controls
DOJ and SEC guidance repeatedly emphasizes third parties because agents, consultants, distributors, and intermediaries are frequently used to conceal improper payments.
A practical third-party review should answer:
- Who owns the company?
- Who introduced the third party?
- Does anyone involved have a relationship with a government official?
- What exact service is being purchased?
- Is the fee commercially reasonable?
- Where will payment be sent?
- Does the bank account match the contracting party?
- Why is an intermediary necessary?
- Are there credible corruption, sanctions, or misconduct concerns?
- Can the third party certify compliance and accept audit/termination provisions?
Red flags that deserve escalation
- requests for cash, crypto, or payments to unrelated accounts;
- unusually high commissions;
- vague invoices such as “consulting” or “special marketing”;
- refusal to identify owners or subcontractors;
- claims that political connections are the reason the deal will succeed;
- requests to backdate or alter documents;
- pressure to bypass normal approval procedures;
- a third party recommended by the official who controls the business decision.
Build Payment and Accounting Controls That Make Concealment Harder
The Liberty Mutual matter is a useful reminder that questionable payments can be hidden inside ordinary expense categories. Small businesses need accounting controls that make that harder.
| Control | What It Prevents |
|---|---|
| Vendor onboarding before payment | Unknown or unverified payees |
| Invoice + contract + business purpose | Vague unsupported expenses |
| Second approval above a threshold | One-person override risk |
| Bank-account verification | Diversion to unrelated beneficiaries |
| Accurate expense coding | Hiding payments inside generic categories |
| Monthly exception review | Repeated unusual transactions |
Your Chart of Accounts and QuickBooks workflow should make expenses easier to understand—not provide vague buckets where unusual transactions disappear.
Gifts, Meals, Travel and Hospitality Need Rules
Businesses that interact with government officials or employees of state-owned enterprises should have a written process for gifts, meals, travel, event tickets, sponsorships, charitable requests, and similar expenditures.
Useful controls include:
- preapproval above defined limits;
- documenting attendees and business purpose;
- avoiding cash and cash equivalents;
- paying legitimate vendors directly when appropriate;
- avoiding side trips or expenses for spouses/family unless clearly reviewed and lawful;
- checking local-law restrictions;
- retaining receipts and approvals;
- escalating anything tied to a pending contract, license, permit, tender, or official decision.
What Changed in the DOJ Enforcement Framework by 2026?
The DOJ issued updated FCPA enforcement guidelines in June 2025. Those guidelines direct prosecutors to consider priorities such as links to cartels or transnational criminal organizations, harm to identifiable U.S. companies’ ability to compete, national-security implications, serious misconduct, and efficient use of enforcement resources.
Then, on March 10, 2026, DOJ issued its first Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy for criminal matters, except criminal antitrust matters. Under that framework, companies can receive substantial benefits when they voluntarily self-disclose qualifying misconduct, fully cooperate, and timely and appropriately remediate.
Do not interpret enforcement prioritization as permission to relax controls. DOJ officials have continued to state that companies should maintain effective compliance programs. A narrower prosecution priority does not make bribery lawful, eliminate accounting obligations, or remove the business risk of bad third parties.
A Practical FCPA Compliance Program for a Small Business
You do not need a multinational compliance department to build meaningful controls. Start with a risk-based system proportionate to your operations.
1. Map your exposure
List foreign countries, agents, distributors, public-sector customers, state-owned companies, permits, customs interactions, tenders, and third parties that interact with officials on your behalf.
2. Create a written anti-bribery rule
State clearly that employees and third parties may not make or authorize improper payments and may not conceal transactions in the books.
3. Formalize third-party onboarding
Use a checklist, ownership questions, references, screening, documented scope, approval and a signed agreement. Keep agreements and approval records organized. Software does not replace legal review.
4. Build an approval matrix
Define who can approve agents, commissions, government-related expenses, gifts, travel, sponsorships, charitable payments, and high-risk transactions.
5. Train the people who can create risk
Sales, procurement, finance, executives, and anyone managing foreign third parties should know the red flags and escalation path. A training/SOP platform such as
Trainual can help maintain repeatable training and attestations.
6. Protect systems and evidence
Use role-based access, MFA, secure document sharing, and controlled credentials. See the Net Profits guide to small business password security. 
1Password may fit businesses that need managed team credentials and access controls.
7. Monitor and investigate exceptions
Review high commissions, new vendors, round-dollar payments, manual journals, duplicate vendors, expense reports, government-related spending, and unusual country/payment combinations.
8. Make escalation safe
Employees need a clear way to stop a transaction and raise concerns without being told to “just get the deal done.” Serious concerns should be directed promptly to qualified legal counsel.
30-Day FCPA Compliance Checklist
- Week 1: identify countries, foreign intermediaries, government-linked customers, licenses, permits, and tenders.
- Week 1: review your largest foreign-agent, distributor, consulting, and marketing payments.
- Week 2: create third-party onboarding and beneficial-ownership questions.
- Week 2: create a gift/travel/hospitality approval rule.
- Week 2: define payment approval thresholds and bank-account verification.
- Week 3: update third-party contracts with appropriate compliance provisions after legal review.
- Week 3: train sales, finance, procurement, and leadership on red flags.
- Week 4: run an exception report for vague consulting/marketing expenses, manual payments, and unusual commissions.
- Week 4: document who receives escalations and when outside counsel should be contacted.
Cornelius’ Take
Many compliance failures are also operations failures. The company did not know who approved the payment, the contract did not match the invoice, the expense category was vague, nobody verified the third party, or the person who spotted the red flag had no authority to stop the transaction. Good compliance should be built into the workflow—not added after the money moves.
Practical Next Step
Pull the ten largest payments made to foreign consultants, agents, distributors, marketing firms, or intermediaries during the last 12 months. For each one, confirm the owner, contract, scope, invoice, approval, bank recipient, expense classification, government connection, and business result. Any file you cannot explain clearly belongs on your review list.
FCPA Compliance FAQs
Does the FCPA apply only to huge public companies?
No. The FCPA’s jurisdictional rules are more complex than company size. DOJ’s own Resource Guide specifically discusses enterprises of all sizes, including small businesses entering foreign markets.
Can a business be responsible for what an outside agent does?
Third parties can create serious FCPA risk. That is why DOJ and SEC emphasize risk-based due diligence, contract controls, monitoring, and attention to red flags.
Was Liberty Mutual convicted of an FCPA crime?
No. DOJ issued a declination. The company agreed to disgorge approximately $4.7 million in profits, and the DOJ cited voluntary self-disclosure, cooperation, remediation, compliance improvements, and other factors in its decision.
Does a DOJ corporate declination protect employees?
Not necessarily. The Liberty Mutual declination expressly stated that it did not provide protection against prosecution of individuals.
What should I do if I discover a questionable foreign payment?
Preserve relevant records, avoid destroying or altering documents, stop further questionable payments when appropriate, restrict unnecessary access, and contact qualified legal counsel promptly. Decisions about investigation, privilege, disclosure, and government contact should be made with appropriate legal advice.
Strengthen the Business System Behind Compliance
Net Profits Consulting helps small businesses improve financial controls, accounting workflows, approvals, documentation, and operating systems. Compliance-specific legal advice should come from qualified counsel, but strong books and strong processes make it easier to identify unusual activity before it becomes a larger problem.
Related Net Profits resources:
- Workflow Automation for Small Businesses
- Small Business Password Security
- Proposal and Contract Automation
- Business Consulting
- Net Profits Partner Ecosystem
Need stronger controls before your business grows internationally?
Book a 15-minute Net Profits strategy call to identify financial, documentation, and workflow gaps that should be fixed before scale makes them harder to control.
About the author
Cornelius Frazier, MBA is a business consultant, operations strategist, accounting professional, and Certified Business Educator with more than two decades of business and finance experience. Learn more about Net Profits Consulting.
Affiliate disclosure: Some tool links in this article are affiliate links. Net Profits Consulting may earn a commission if you purchase through them, at no additional cost to you. Tools are included only where they fit the workflow discussed.
Legal disclaimer: This article is educational information, not legal advice. FCPA jurisdiction, liability, disclosure obligations, local law, and appropriate remediation depend on the facts. Consult qualified legal counsel for advice regarding a specific transaction, investigation, government interaction, or suspected violation.
