Anti-Bribery & Corruption Compliance for Foreign Companies in India

The Triple Exposure Problem for Foreign Companies in India

Foreign companies operating in India face a unique anti-corruption challenge: they must simultaneously comply with India's domestic anti-bribery laws, the extraterritorial reach of their home country's legislation (such as the US Foreign Corrupt Practices Act or the UK Bribery Act 2010), and the evolving enforcement landscape that has seen Indian authorities become significantly more aggressive in pursuing corporate corruption since the Prevention of Corruption (Amendment) Act of 2018.

This is not a theoretical risk. In September 2022, Oracle Corporation settled charges with the US Securities and Exchange Commission for violating the FCPA when its Indian subsidiary created and used slush funds to bribe government officials in return for business. Similar enforcement actions have targeted Walmart, Rolls-Royce, and other multinationals with Indian operations. Understanding and managing this triple exposure is not optional; it is a business-critical compliance imperative.

India's Prevention of Corruption Act: The 2018 Amendments

The Prevention of Corruption Act 1988 (PCA) is India's principal anti-corruption statute. The Prevention of Corruption (Amendment) Act 2018, effective 26 July 2018, fundamentally reshaped the legal landscape by aligning Indian law with international standards under the United Nations Convention Against Corruption.

Key Changes Under the 2018 Amendment

Section 9: Corporate Liability

The most significant change for foreign companies is Section 9, which introduces the concept of corporate liability for bribery. Under this provision:

• A commercial organisation is guilty of an offence if any person associated with it gives or promises an undue advantage to a public servant, intending to obtain or retain business or any advantage in the conduct of business.
• The definition of "commercial organisation" covers companies incorporated in India and companies incorporated outside India that carry on business in India. This means the foreign parent company itself could face prosecution in India.
• If a director, manager, secretary, or other officer consented to or connived in the offence, that individual is personally liable and faces imprisonment of 3 to 7 years plus a fine.

The Adequate Procedures Defence

Section 9 provides a statutory defence: a commercial organisation is not criminally liable if it can prove it had adequate procedures in place to prevent persons associated with it from engaging in corrupt practices. This makes building and documenting a robust compliance program not just a best practice but a legal necessity. The Indian government has not yet issued specific guidance on what constitutes "adequate procedures," but the Central Vigilance Commission (CVC) has referenced international frameworks including the UK Ministry of Justice's guidance on the Bribery Act.

FCPA Exposure for US-Parented Indian Subsidiaries

The US Foreign Corrupt Practices Act applies to issuers (companies listed on US exchanges), domestic concerns (US companies and residents), and any person who takes corrupt action while in the territory of the United States. For US parent companies with Indian subsidiaries, FCPA exposure arises in several ways:

Direct Liability

The parent company is directly liable for its own acts, such as approving payments to Indian government officials or directing the subsidiary to make such payments.

Subsidiary Liability

Under the legal doctrine of respondeat superior, a parent company may be held vicariously liable for corrupt acts committed by its subsidiary's employees if those employees acted within the scope of their authority and at least partly for the benefit of the parent. Even without actual knowledge, enforcement authorities may impute knowledge to the parent if it was aware of the high probability of corrupt activity but deliberately avoided confirming it.

Books and Records Provisions

The FCPA's accounting provisions require issuers to maintain accurate books, records, and accounts that fairly reflect transactions. A subsidiary's slush funds, off-the-books payments, or mis-characterized expenses can trigger FCPA violations even without proving a bribe was actually paid.

For companies registering subsidiaries in India from the United States, building FCPA-compliant financial controls into the subsidiary's operations from day one is essential.

UK Bribery Act Exposure

The UK Bribery Act 2010 has the broadest extraterritorial reach of any anti-corruption statute. It applies to any organisation that carries on business in the UK, regardless of where the bribery occurs. Under Section 7, a commercial organisation is guilty of an offence if a person associated with it bribes another person with the intention of obtaining or retaining business, unless the organisation can prove it had adequate procedures in place.

Key differences from the FCPA that foreign companies must understand:

• The Bribery Act covers private-sector bribery, not just bribery of public officials
• Facilitation payments (small payments to expedite routine government actions) are illegal under the Bribery Act but have a limited exception under the FCPA
• There is no materiality threshold; any bribe of any value can trigger liability

For companies entering India from the United Kingdom, this means their Indian subsidiary's interactions with both government officials and private-sector partners must meet the Bribery Act's stringent standards.

High-Risk Areas for Foreign Companies in India

Understanding where corruption risks concentrate in Indian business operations allows companies to focus their compliance resources:

Government Interactions

• Licenses and permits: Obtaining building permits, environmental clearances, factory licenses, and sector-specific approvals often involves interactions with mid-level government officials where demands for facilitation payments are common.
• Tax assessments: Transfer pricing audits, GST assessments, and income tax proceedings can create pressure points where corrupt intermediaries offer to "manage" the outcome.
• Customs clearance: Import-dependent subsidiaries face risks at ports and customs checkpoints, particularly for time-sensitive shipments.
• Government contracts: Companies bidding on public procurement contracts face heightened bribery risks during the tender and evaluation process.

Third-Party Intermediaries

The highest FCPA enforcement risk globally comes from third-party intermediaries, and India is no exception. Common high-risk intermediaries include:

• Government relations consultants engaged to "facilitate" approvals
• Customs brokers who handle clearance on behalf of the company
• Tax advisors who interact with tax authorities on behalf of the subsidiary
• Joint venture partners who handle government-facing aspects of the business
• Distributors and agents who interact with state-owned enterprises

Employment and Labour

• Labour inspections: Factory and labour compliance inspections can trigger demands for payments to avoid citations.
• Provident fund and ESI: Interactions with the EPFO and ESI offices around contribution compliance.

Building a Compliance Program for Indian Operations

An effective anti-bribery compliance program for Indian operations must satisfy the "adequate procedures" defence under Section 9 of the PCA, the DOJ/SEC evaluation criteria for FCPA compliance programs, and the UK Ministry of Justice's six principles. Here are the essential components:

1. Written Anti-Bribery Policy

Draft a clear, India-specific anti-bribery policy that:

• Explicitly prohibits all forms of bribery, including facilitation payments
• Defines what constitutes a "government official" under Indian law (which includes employees of state-owned enterprises and public-sector banks)
• Sets monetary thresholds for gifts, hospitality, and entertainment
• Establishes a process for pre-approval of payments to third-party intermediaries
• Is translated into local languages if subsidiary employees are not English-proficient

2. Risk Assessment

Conduct an India-specific corruption risk assessment covering:

• Industry sector (some sectors like defence, mining, and infrastructure carry higher inherent risk)
• Geographic footprint within India (corruption risk varies significantly by state)
• Types and volume of government interactions
• Third-party intermediary landscape
• Transaction patterns (cash payments, intermediary commissions, donations)

3. Third-Party Due Diligence

Implement a tiered due diligence process for all third parties who interact with government on your behalf:

• Standard due diligence: Identity verification, background checks, sanctions screening
• Enhanced due diligence: For high-risk intermediaries, conduct in-person interviews, check references, verify fee structures against market benchmarks, and review their own compliance programs
• Ongoing monitoring: Annual re-certification of high-risk third parties, with transaction monitoring for unusual patterns

4. Vigil Mechanism and Whistleblower Protection

Under Section 177 of the Companies Act 2013, the following companies must establish a vigil mechanism (whistleblower channel):

• All listed companies
• Companies accepting public deposits
• Companies with borrowings exceeding INR 50 crore from banks or financial institutions

Even if not legally required, every foreign-owned subsidiary should implement a whistleblower mechanism that:

• Allows anonymous reporting in local languages
• Protects whistleblowers from retaliation
• Routes reports to the audit committee or a designated director
• Maintains investigation records for a minimum of 8 years

5. Training and Communication

Conduct annual anti-bribery training for all Indian subsidiary employees, with enhanced training for:

• Employees who interact with government officials
• Procurement and vendor management teams
• Finance and accounts teams responsible for payment processing
• Sales teams, especially those dealing with government or public-sector clients

6. Financial Controls and Record-Keeping

Implement financial controls that prevent disguised bribery payments:

• Dual approval for all payments above a defined threshold
• No cash payments above INR 10,000 (in line with Section 269ST of the Income Tax Act)
• Regular reconciliation of intermediary payments against actual services rendered
• Retention of all third-party contracts, invoices, and payment records

Enforcement Landscape in India

India's anti-corruption enforcement involves multiple agencies:

While enforcement has historically been uneven, the trend is toward significantly greater scrutiny. The Enforcement Directorate's activity has increased dramatically, and India's mutual legal assistance treaties (MLATs) with the US, UK, and other jurisdictions mean that evidence gathered in Indian investigations can support foreign prosecutions under the FCPA or Bribery Act.

Penalties and Consequences

Under Indian Law

• PCA Section 7 (public servant taking bribe): 3-7 years imprisonment and fine
• PCA Section 8 (giving a bribe): Up to 7 years imprisonment and fine
• PCA Section 9 (corporate liability): Fine for the organisation; 3-7 years imprisonment for consenting/conniving officers
• IPC/BNS fraud provisions: Up to 7 years imprisonment under what was Section 420 (now Section 318 of the Bharatiya Nyaya Sanhita 2023)

Under FCPA

• Criminal penalties (companies): Up to USD 2 million per violation, or twice the gain/loss from the offence
• Criminal penalties (individuals): Up to USD 250,000 and 5 years imprisonment per violation
• Civil penalties: Up to USD 16,000 per violation (accounting provisions) or USD 100,000 per violation (anti-bribery provisions)
• Disgorgement: Return of ill-gotten profits, often running into tens or hundreds of millions of dollars

Under UK Bribery Act

• Individuals: Up to 10 years imprisonment and unlimited fines
• Organisations: Unlimited fines
• Deferred prosecution agreements: UK authorities can impose compliance monitors and corporate governance reforms

Collateral Consequences

Beyond criminal penalties, corruption investigations trigger:

• Debarment from government contracts in India and internationally
• Reputational damage affecting customer relationships, partnerships, and talent acquisition
• Share price impact for listed parent companies
• Director disqualification and personal liability
• Loss of export licences and trade preferences

India's Transparency International Ranking and Business Reality

India ranked 93rd out of 180 countries in Transparency International's 2024 Corruption Perceptions Index, scoring 39 out of 100. While this represents improvement from a decade ago, it signals that foreign companies must approach Indian operations with robust anti-corruption safeguards. The practical reality on the ground varies significantly by state, sector, and the level of government interaction required.

States like Gujarat, Karnataka, and Tamil Nadu have made significant progress in reducing corruption through digitisation of government services and e-governance platforms. However, sectors involving heavy regulation, such as construction, mining, real estate, and defence procurement, continue to present elevated corruption risk regardless of geography.

Foreign companies should not view India's ranking as a reason to avoid the market. Instead, it should inform the level of investment in compliance infrastructure. Companies that build strong anti-corruption programs from the outset consistently report that it becomes a competitive advantage, as it builds trust with Indian partners, customers, and regulatory authorities.

Related Party Transaction Monitoring

For foreign-owned subsidiaries, anti-corruption compliance intersects with intercompany transaction monitoring. Unusual payment patterns within the group can signal corruption risks:

• Inflated intercompany invoices: Where excess payments are diverted to fund bribes
• Unexplained consultant fees: Third-party payments that lack adequate documentation of services received
• Cash withdrawals: Any significant cash transactions in a subsidiary that primarily operates through bank transfers
• Gifts and entertainment: Expenditure on hospitality that exceeds policy limits or lacks proper pre-approval

The annual compliance review should include a specific anti-corruption audit module that examines these transaction patterns against the company's anti-bribery policy thresholds.

Practical Steps for Foreign Companies Entering India

For companies in the process of establishing a foreign subsidiary in India or those already operating, here is a priority-ordered compliance checklist:

1. Day 1: Adopt a written anti-bribery policy and communicate it to all Indian subsidiary personnel
2. Month 1: Complete an India-specific corruption risk assessment
3. Month 2: Implement third-party due diligence procedures for all government-facing intermediaries
4. Month 3: Establish a vigil mechanism/whistleblower channel with protections
5. Quarter 1: Conduct initial anti-bribery training for all subsidiary employees
6. Ongoing: Quarterly compliance reporting to the parent company's audit committee
7. Annual: Independent audit of the compliance program's effectiveness

Foreign companies should also ensure their FDI advisory and legal counsel in India have specific anti-corruption expertise, not just corporate law capabilities.

Record Retention and Investigation Readiness

Indian law does not specify a single retention period for anti-corruption records, but multiple statutes create overlapping requirements. The Income Tax Act requires retention of books of account for 8 years from the end of the relevant assessment year. The Companies Act requires board minutes, resolutions, and registers to be preserved permanently. FEMA records must be maintained for a minimum of 5 years. For anti-corruption compliance purposes, best practice is to retain all compliance records, including due diligence files, training records, investigation reports, and whistleblower complaints, for a minimum of 8 years.

Investigation readiness is equally important. When a corruption allegation surfaces, the company must be able to quickly retrieve relevant records, preserve electronic evidence, and engage qualified forensic investigators. Indian courts have increasingly accepted digital evidence under the Indian Evidence Act (now Bharatiya Sakshya Adhiniyam 2023), but proper authentication and chain-of-custody protocols are essential. Companies should designate in advance who will lead internal investigations, which external law firm will be engaged, and how privilege will be maintained over investigation materials.

Key Takeaways

• Foreign companies in India face triple anti-corruption exposure under the PCA 2018, FCPA, and/or UK Bribery Act, each with extraterritorial reach.
• Section 9 of the amended PCA introduces corporate liability for bribery but provides a statutory "adequate procedures" defence for companies with documented compliance programs.
• Penalties are severe: up to 7 years imprisonment under Indian law, USD 2 million per violation under FCPA, and unlimited fines under the UK Bribery Act.
• Third-party intermediaries (agents, consultants, customs brokers) represent the highest enforcement risk and require rigorous due diligence.
• Building a compliance program from Day 1 of Indian operations is both a legal necessity and the most cost-effective risk mitigation strategy available.