Prevention of Corruption Act: Compliance Guide for Foreign Directors in India

Why the Prevention of Corruption Act Matters for Foreign Directors

The Prevention of Corruption Act, 1988 (PCA), as substantially amended in 2018, is India's primary anti-corruption statute. While historically focused on punishing corrupt public servants, the 2018 Amendment fundamentally expanded its scope to create criminal liability for commercial organizations and their officers — a shift directly modeled on the UK Bribery Act's corporate liability framework.

For foreign directors serving on the boards of Indian subsidiaries, joint ventures, or branch offices, this creates a real and personal criminal exposure. If your Indian entity or any person associated with it bribes a public servant to obtain or retain business, and the prosecution can establish that the bribery occurred with your consent or connivance as a director, you face imprisonment of 3 to 7 years and a fine. The only statutory defence available is proving that your organization had "adequate procedures" in place to prevent bribery.

As of March 2026, the Central Government has not yet issued formal guidelines prescribing what constitutes "adequate procedures" under the PCA — leaving foreign directors in the uncomfortable position of having to design their own compliance frameworks without definitive regulatory guidance. This guide provides a practical roadmap for building a defensible anti-corruption compliance program for your Indian operations.

The 2018 Amendment: What Changed

The Prevention of Corruption (Amendment) Act, 2018, which came into effect on July 26, 2018, introduced several changes that fundamentally altered the compliance landscape for foreign companies operating in India.

Section 9: Commercial Organization Liability

Section 9 creates a standalone offence for commercial organizations. If any person associated with a commercial organization gives or promises to give an undue advantage to a public servant with the intention of obtaining or retaining business or an advantage in the conduct of business, the commercial organization is guilty of the offence and punishable with a fine.

Key definitions under Section 9:

Section 10: Personal Liability of Directors and Officers

Section 10 extends criminal liability from the commercial organization to its officers. If an offence under Section 9 is committed by a commercial organization, and the offence is proved to have been committed with the consent or connivance of any director, manager, secretary, or other officer, that individual is guilty of the offence and punishable with imprisonment of not less than 3 years but which may extend to 7 years, and fine.

The key protective element for foreign directors is that Section 10 requires "consent or connivance" — not mere negligence or failure to supervise. This means:

• Consent: The director actively agreed to or authorized the corrupt act
• Connivance: The director was aware of the corrupt act and deliberately turned a blind eye or failed to prevent it despite having the power to do so

The Supreme Court reaffirmed in Sanjay Dutt & Others v. State of Haryana (2025 INSC 34) that directors are not automatically vicariously liable under the PCA solely due to their position, authorization of acts, or supervisory role. Criminal liability of officers arises only if the company itself is found liable and there is personal involvement of the director in the offence.

The Adequate Procedures Defence

The most important provision for foreign directors is the statutory defence under Section 9: it shall be a defence for the commercial organization to prove that it had in place adequate procedures to prevent persons associated with it from undertaking corrupt conduct. This is the PCA's equivalent of the UK Bribery Act's "adequate procedures" defence — and it is the primary tool for protecting both the organization and its directors from criminal liability.

However, the Central Government has not yet issued the prescribed guidelines defining what constitutes adequate procedures. This creates significant uncertainty, but also an opportunity — foreign companies can design their compliance programs based on international best practices, which Indian courts are likely to consider favorably when the guidelines are eventually issued.

Building an Adequate Procedures Defence

In the absence of formal Indian guidelines, foreign directors should build their anti-corruption compliance programs drawing on the six principles of the UK Bribery Act guidance, the U.S. Department of Justice's FCPA Resource Guide, and Transparency International's Business Principles for Countering Bribery. These frameworks are internationally recognized and are likely to satisfy any future Indian government guidelines.

Principle 1: Top-Level Commitment

Anti-corruption compliance must be driven from the board level — not delegated entirely to the compliance department. Foreign directors should:

• Issue a formal anti-corruption policy statement signed by the board of the Indian entity
• Include anti-corruption compliance as a standing agenda item at board meetings
• Allocate specific budget for compliance training, audits, and whistleblower mechanisms
• Ensure the Company Secretary records board-level discussions on anti-corruption measures in meeting minutes

Principle 2: Risk Assessment

Conduct a systematic assessment of bribery risks specific to your Indian operations. Key risk areas for foreign companies include:

Principle 3: Due Diligence on Third Parties

Third-party intermediaries are the most common channel for corruption. Foreign directors must ensure their Indian entities conduct thorough due diligence on all agents, consultants, distributors, and government relations advisors. A robust due diligence program includes:

• Background checks: Verify the third party's corporate registration, beneficial ownership, litigation history, and any connections to government officials or politically exposed persons (PEPs)
• Written agreements: Every third-party engagement must have a written contract with explicit anti-bribery representations and warranties, audit rights, and termination clauses for corruption violations
• Fee structure review: Commission or fee structures that are unusual for the industry, success-based fees linked to government approvals, or payments to offshore entities should be treated as red flags
• Ongoing monitoring: Due diligence is not a one-time exercise. Implement annual re-certification for high-risk third parties and require them to complete anti-corruption training

Principle 4: Clear Policies and Procedures

Your Indian entity should maintain comprehensive written policies covering:

• Gifts and hospitality: Specific monetary thresholds (e.g., no gifts exceeding INR 5,000 to government officials), pre-approval requirements for government entertainment, and a complete prohibition on cash gifts
• Political and charitable contributions: Prohibition or strict pre-approval requirements for political donations; due diligence on charitable organizations before donations to ensure they are not fronts for government officials
• Facilitation payments: A clear statement prohibiting facilitation payments ("speed money") — even though the PCA does not explicitly carve out facilitation payments, unlike the FCPA. The UK Bribery Act also prohibits facilitation payments, so companies subject to both laws should maintain a blanket prohibition
• Sponsorships and travel: Pre-approval for sponsorship of government events, travel expenses for government officials, and any engagement that could be perceived as providing an undue advantage

Principle 5: Training and Communication

Anti-corruption policies are only effective if employees and third parties understand them. Implement:

• Annual training: Mandatory anti-corruption training for all employees of the Indian entity, with enhanced modules for finance, procurement, government relations, and sales teams
• Third-party training: Require agents, distributors, and consultants to complete anti-corruption training and sign annual compliance certifications
• Scenario-based training: Use India-specific scenarios — customs clearance delays, tax assessment challenges, permit processing, labour inspector visits — to make training practically relevant
• Record keeping: Maintain records of all training sessions, attendance, and certifications. These records are critical evidence of adequate procedures if the company ever faces a PCA prosecution

Principle 6: Monitoring, Review, and Whistleblower Mechanisms

• Internal audits: Conduct annual anti-corruption audits of the Indian entity, focusing on high-risk transactions, government interactions, and third-party payments
• Whistleblower channel: Establish a confidential, anonymous reporting channel (hotline or online portal) available to all employees and third parties. The Companies Act, 2013 already mandates a vigil mechanism for listed companies and companies accepting public deposits — extend this to your Indian subsidiary regardless of whether it is legally required
• Investigation protocol: Establish a clear protocol for investigating corruption allegations, including evidence preservation, legal privilege considerations, and reporting obligations to the parent company
• Periodic review: Review and update the anti-corruption compliance program annually based on audit findings, regulatory changes, enforcement trends, and business model evolution

Interaction with FCPA and UK Bribery Act

Foreign directors must navigate the intersection of India's PCA with extraterritorial anti-corruption laws — primarily the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act, 2010. If your parent company is a U.S. issuer or a UK-connected entity, your Indian operations are simultaneously subject to multiple anti-corruption regimes.

Key Differences Across Regimes

Enforcement Case Study: Oracle Corporation (2022)

Oracle Corporation settled SEC charges in September 2022 for violating the FCPA when its Indian subsidiary created and used slush funds to bribe government officials in return for business. Oracle paid approximately USD 23 million in penalties. This case illustrates the cross-jurisdictional exposure — the bribery occurred in India and would have been prosecutable under both the PCA and the FCPA. Foreign directors must ensure their Indian compliance programs satisfy the requirements of all applicable anti-corruption regimes simultaneously.

Practical Compliance Roadmap for Foreign Directors

Phase 1: Assessment (Month 1-2)

1. Map all Indian government touchpoints — licenses, permits, tax assessments, regulatory inspections, public procurement
2. Identify all third-party intermediaries with government interface — agents, customs brokers, tax consultants, government relations advisors
3. Review existing policies, procedures, and training programs for gaps against UK Bribery Act guidance and FCPA best practices
4. Assess the Indian entity's compliance calendar for regulatory filing deadlines that create corruption pressure points

Phase 2: Policy Development (Month 2-4)

1. Draft comprehensive anti-corruption policy for the Indian entity, covering all six principles
2. Develop specific policies for gifts and hospitality, political contributions, charitable donations, facilitation payments, and third-party due diligence
3. Create an incident response protocol for corruption allegations
4. Establish a whistleblower mechanism with Board-level reporting
5. Present policies to the board for formal adoption and record in board meeting minutes

Phase 3: Implementation (Month 4-6)

1. Conduct anti-corruption training for all employees of the Indian entity
2. Perform due diligence on existing third-party intermediaries and remediate gaps
3. Implement financial controls — segregation of duties, approval thresholds, and audit trails for government-related expenditures
4. Update employment contracts to include anti-corruption clauses and consequences for violations
5. Engage external counsel to review the compliance program and provide a written assessment

Phase 4: Ongoing Monitoring (Continuous)

1. Conduct annual anti-corruption audits of the Indian entity
2. Require annual compliance certifications from employees and third parties
3. Monitor enforcement trends — CBI prosecutions, Enforcement Directorate actions, and Supreme Court rulings on PCA
4. Review and update policies annually based on audit findings and regulatory developments
5. Report compliance program status to the parent company board quarterly

Enforcement Landscape and Recent Developments

India's anti-corruption enforcement has intensified significantly in 2024-2026. The Central Bureau of Investigation (CBI) and the Enforcement Directorate (ED) have increased the pace of investigations and prosecutions. Key developments affecting foreign companies include:

• Supreme Court ruling on director liability (2025): The Court held in Sanjay Dutt & Others v. State of Haryana that directors are not automatically vicariously liable under the PCA — criminal liability requires proof of personal consent or connivance. This is a significant protection for foreign directors who maintain genuine compliance oversight
• Enhanced digital investigation: Under the new criminal procedure (BNSS), investigators have expanded powers to seize electronic devices, access cloud data, and use digital forensics. Anti-corruption investigations now routinely examine emails, WhatsApp messages, and financial system records
• Pending adequate procedures guidelines: As of March 2026, the Central Government has still not issued formal guidelines on adequate procedures. However, the absence of guidelines does not diminish the defence — it means courts will assess adequacy based on reasonableness and international best practices
• India's UNCAC compliance: India is a signatory to the United Nations Convention Against Corruption (UNCAC) and is progressively aligning its enforcement framework with international standards. The 2018 PCA Amendment was itself a step toward UNCAC compliance

Common Mistakes Foreign Directors Make

Mistake 1: Assuming the PCA Only Applies to Indian Nationals

The PCA applies to all commercial organizations carrying on business in India, regardless of where they are incorporated. Foreign companies with Indian subsidiaries, branch offices, liaison offices, or even project offices are covered. Foreign directors serving on Indian entity boards are personally within Section 10's scope.

Mistake 2: Relying on Parent Company Policies Without Local Adaptation

A global anti-corruption policy from the parent company's head office is insufficient unless it is adapted to Indian-specific risks, regulatory requirements, and operational realities. Indian courts will assess whether the adequate procedures were relevant and operational in the Indian context — not whether they satisfied compliance requirements in New York or London.

Mistake 3: Treating Facilitation Payments as Low-Risk

Unlike the FCPA (which provides a limited exemption for facilitation payments for routine governmental action), neither the Indian PCA nor the UK Bribery Act exempts facilitation payments. Paying "speed money" to expedite routine government approvals — a common practice in India — is a criminal offence under the PCA and can trigger FCPA/UKBA liability if the parent company is U.S.- or UK-connected.

Mistake 4: Neglecting Third-Party Due Diligence

The majority of PCA and FCPA enforcement actions involve third-party intermediaries — agents, consultants, customs brokers, and government relations advisors. Foreign directors who fail to ensure robust due diligence on Indian third parties are exposed to the most common vector of corruption liability.

Mistake 5: Not Documenting Compliance Efforts

The adequate procedures defence requires proof. If your Indian entity conducts anti-corruption training but does not maintain attendance records, or implements due diligence procedures but does not document the results, you cannot demonstrate adequate procedures in court. Every element of the compliance program must be documented, dated, and preserved. Our FEMA compliance team can assist with structuring documentation for regulatory defence.

Key Takeaways

• The PCA 2018 Amendment creates direct criminal liability for commercial organizations — including foreign companies operating in India — that bribe public servants through any associated person, including employees, agents, and consultants
• Foreign directors face personal liability under Section 10 with imprisonment of 3-7 years if bribery occurs with their consent or connivance. The Supreme Court (2025) confirmed that mere directorial position is insufficient — personal involvement must be established
• The "adequate procedures" defence is the primary protection, but the Central Government has not yet issued formal guidelines. Build your compliance program on UK Bribery Act principles, FCPA best practices, and UNCAC standards
• Six essential elements: top-level commitment, risk assessment, third-party due diligence, clear policies, training and communication, and monitoring with whistleblower mechanisms
• Cross-jurisdictional compliance is mandatory if your parent company is subject to the FCPA or UK Bribery Act. Your Indian compliance program must simultaneously satisfy Indian PCA, FCPA, and UKBA requirements
• Document everything: Training records, due diligence files, policy adoptions, board discussions, audit reports, and whistleblower investigations. The adequate procedures defence requires proof, not promises