Corruption risk for small businesses: the FCPA, US bribery rules and what changed in 2025 and 2026

Bribery law sounds like a topic for oil majors and defense contractors. It is not. The moment you form a US company, that company is a domestic concern under the Foreign Corrupt Practices Act, whether its owner lives in Lyon, Milan or Malmö. If it sells to a state-owned hospital in Asia, uses a sales agent in the Gulf or needs a customs clearance in a hurry, the FCPA applies to it. Enforcement priorities shifted sharply in 2025. The statute did not change.

Why a small US company is covered

The FCPA has three doors, and every business with a US connection walks through at least one of them.

The definition of domestic concern lists corporations, partnerships, associations, business trusts and other unincorporated organizations that are organized under the laws of a state. A Texas or Delaware company you form for your US business falls into this group; its owners' nationality does not matter. The same applies to its officers, directors, employees and agents, and to stockholders acting on its behalf.

For a European parent the consequence is direct: what your US subsidiary does abroad is judged by US law, and what your European staff do while visiting the US can be too. If you are still choosing a structure, our page on branch or subsidiary in the US explains the options.

What the FCPA prohibits

The anti-bribery provision has five building blocks. A violation needs all of them:

1. An offer, payment, promise or authorization of money or anything of value. Gifts, travel, a job for a relative or a donation can all be things of value.
2. Made corruptly, with the intent to influence the recipient.
3. To a foreign official, a foreign political party or party official, or a candidate for foreign office, or to anyone else while knowing that all or part will be passed on to one of them. A foreign official includes any officer or employee of a foreign government or of one of its agencies or instrumentalities, which is how employees of state-owned companies come into scope.
4. For an official purpose: influencing an official act or decision, inducing a breach of duty, securing an improper advantage, or getting the official to use influence with the government.
5. To obtain or retain business for or with anyone, or to direct business to anyone.

Point 3 is where small companies get caught. Most do not hand cash to an official; they pay an agent, a consultant or a distributor who does. The statute treats a person as knowing when they are aware of a high probability that a circumstance exists, unless they actually believe it does not. Deliberately not asking is therefore no defense. If you sell through intermediaries, read our guide to US sales channels: agents, distributors and subsidiaries with this in mind, because the same questions apply when your US company appoints agents abroad.

The facilitation exception, the two defenses and how Europe differs

The FCPA does not apply to a facilitating or expediting payment made to secure a routine governmental action. The statute defines that narrowly: actions an official ordinarily and commonly performs, such as issuing permits or licenses to do business, processing visas and work orders, providing police protection or mail service, scheduling inspections, supplying power and water, or loading and unloading cargo. It expressly excludes any decision on whether, or on what terms, to award new business or to continue existing business.

Two affirmative defenses exist. A payment is a defense if it was lawful under the written laws and regulations of the official's country. And a reasonable and bona fide expenditure, such as travel and lodging, is a defense if it is directly related to promoting, demonstrating or explaining products or services, or to performing a contract with a foreign government.

Here a European owner has to be careful, because home rules are stricter. The UK Bribery Act 2010 has no exemption for facilitation payments; the joint guidance of the Serious Fraud Office and the Director of Public Prosecutions says they were illegal before the Act and remain so. Section 7 of that Act makes a commercial organization liable for failing to prevent bribery by persons associated with it, unless it proves it had adequate procedures, and it reaches companies incorporated elsewhere that carry on business in the UK. If your group has a UK company or does business there, a facilitation payment allowed in Texas can still be a crime in London. Run one policy for the whole group and to write it to the strictest law that applies, which usually means no facilitation payments at all.

The penalties

The FCPA's own figures look modest. The total exposure is not.

• Companies: a criminal fine of up to $2,000,000 per violation of the anti-bribery provisions, plus a civil penalty of up to $10,000.
• Individuals: officers, directors, employees, agents and stockholders acting for the company who willfully violate the rules face a fine of up to $100,000, up to five years in prison, or both, plus a civil penalty of up to $10,000.
• The company may not pay its people's fines. The statute says a fine imposed on an individual may not be paid, directly or indirectly, by the domestic concern.
• The general fine statute raises the ceiling. Under 18 U.S.C. 3571 the maximum fine for a felony is $250,000 for an individual and $500,000 for an organization, or twice the gross gain or twice the gross loss from the offense, whichever is greater.

There is now also a demand side. The Foreign Extortion Prevention Act, 18 U.S.C. 1352, makes it a crime for a foreign official to demand or accept a bribe from an issuer, a domestic concern or a person in US territory in connection with obtaining or retaining business. The penalty is a fine of up to $250,000 or three times the value of the bribe, up to 15 years in prison, or both. For a small company that is being squeezed abroad, this matters: the official asking for money is now committing a US crime too.

What changed in 2025 and 2026

Enforcement priorities moved more in eighteen months than in the previous twenty years. The law itself stayed the same.

• February 10, 2025: Executive Order 14209 directed the Attorney General to stop opening new FCPA investigations for 180 days, unless an individual exception was made, to review existing cases and to issue new guidelines.
• June 9, 2025: the Deputy Attorney General issued the Guidelines for Investigations and Enforcement of the FCPA. Every new investigation now needs authorization from the head of the Criminal Division or a more senior official.
• March 10, 2026: the Department of Justice issued a department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy for criminal cases.

The June 2025 guidelines tell prosecutors to weigh whether the conduct is linked to cartels or transnational criminal organizations, whether it deprived specific and identifiable US companies of fair access to compete, whether it threatens US national security in areas such as defense, intelligence or critical infrastructure, and whether it is serious misconduct. They state that enforcement shall not focus on routine business practices or on low-dollar, generally accepted business courtesies, and that the focus is on substantial bribes, sophisticated concealment, fraud and obstruction tied to particular individuals. Prosecutors are also told to consider whether a foreign authority is willing and able to prosecute the same conduct. The guidelines say enforcement will not target companies or people because of their nationality, and a footnote observes that the largest FCPA cases have overwhelmingly been brought against foreign companies.

The March 2026 policy explains what self-reporting earns. The department will decline to prosecute a company that voluntarily self-disclosed the misconduct, fully cooperated, remediated in time and appropriately, and has no aggravating circumstances. Even then the company pays disgorgement or forfeiture and restitution, and every declination is made public.

For a small company we read this as fewer cases, but no free pass. Priorities change with administrations while the statute stays, the guidelines expressly leave prosecutors discretion, and a competitor that lost a tender to you is exactly the kind of identifiable US victim the new guidelines describe.

Bribery at home: US officials and federal contracts

The FCPA deals with foreign officials. Dealing with American officials is covered by other laws, and they are strict.

Federal bribery under 18 U.S.C. 201(b), corruptly giving or offering anything of value to a public official to influence an official act, carries up to 15 years in prison and a fine of up to three times the value of the bribe, and the offender may be barred from holding federal office. The separate gratuity offense in section 201(c), giving something of value for or because of an official act even without a deal, carries up to two years.

On the everyday level, executive branch employees work under the federal gift rules. The basic exception lets an employee accept unsolicited gifts worth $20 or less per source per occasion, with a cap of $50 from any one source in a calendar year, and never cash or investment interests. If your company courts federal agencies, a lunch invitation can already run into that limit, and the burden sits with the official, who will usually say no. Our guide to federal contracts and small business certifications covers how selling to the government works.

State and local officials are governed by state law, which varies. Before you entertain anyone on a public payroll, ask what their own rules allow.

A compliance program sized for a small company

Large companies spend millions on compliance. A small company needs a short list of controls that are actually used. These are the ones we recommend:

1. A one-page policy. No bribes, no facilitation payments, gifts and hospitality only when modest, recorded and lawful where the recipient sits. Signed by every employee and every agent.
2. Know your intermediaries. Before you appoint an agent, consultant or distributor in a high-risk country, find out who owns them, whether they have links to officials, and why their fee is what it is. Write the reasons down.
3. Contract clauses. Every agent contract should contain an anti-corruption clause, a right to audit and a right to terminate if the clause is breached.
4. Pay against invoices, to accounts in the agent's name and country. Payments to third parties, to offshore accounts or in cash are the classic red flag.
5. Book every expense truthfully. Accurate books are a legal obligation for issuers under the FCPA's accounting provisions, and for everyone else they are what lets you prove a payment was legitimate. Our page on bookkeeping for a US LLC describes what good records look like.
6. A way to raise concerns. An email address that reaches the owner directly is enough for a ten-person company. What matters is that people use it and are not punished for it.
7. Act when something comes up. Under the March 2026 policy, self-disclosure, cooperation and remediation are the path to a declination. That path is only open to a company that finds problems itself.

None of this replaces advice on a specific case. If a payment has already been made or demanded, stop, preserve the records and get counsel involved before anyone talks to the authorities or the counterparty.

Where corruption risk meets market entry

Most of our clients sell into the US market, and their corruption exposure inside the country is low. The US has its problems, but a small business does not pay anyone to register a company, get a tax number or clear a shipment through customs. The risk grows when the US company becomes the group's hub for sales into Latin America, the Middle East or Asia, or when it bids for public contracts at home.

That is the moment to put the controls above in place, and to think about which entity signs which contract. Our page on legal certainty in the US explains why the American system rewards companies that document their decisions, and the overview of CFIUS review covers the other national security rule a foreign investor should know before buying into a sensitive sector.