Reading a change in U.S. enforcement policy as permission to relax anti-bribery controls, including FCPA third-party due diligence, is the wrong lesson. Freshfields’ latest analysis reports remarks by U.S. DOJ Criminal Division leadership on 30 September 2026 that FCPA enforcement is “really ramping up”, with priorities that emphasise misconduct affecting U.S. interests, cartels and transnational criminal organisations, and serious corporate misconduct.
For manufacturers, pharma, energy and infrastructure groups, and for the distributors that sell for them, the practical question is not which priority list is current. It is whether the company can show, payment by payment, that the people it pays are who they say they are and are paid for real work. This article is general information, not legal advice. Confirm your own position with counsel.
Crest.Digital’s platform connects ownership, PEP, adverse media and payment signals for every distributor and agent in one continuously updated view.
Explore the PlatformWhat the 30 September Remarks Signal
According to Freshfields, the Criminal Division’s current framework, set out in a June 2025 memorandum, focuses on four areas: cartels and transnational criminal organisations, conduct that harms U.S. companies, U.S. national security interests, and serious misconduct, with continued emphasis on individual accountability. Freshfields also notes a March 2026 corporate enforcement and voluntary self-disclosure policy, with incentives for companies that disclose, cooperate and remediate.
Two things follow. First, enforcement is narrower in stated priority but not absent, and it is explicitly active. Second, the cases highlighted involve intermediaries. Freshfields describes one matter in which a company allegedly directed third-party customs brokers to pay Mexican officials, with some funds said to reach cartels. Read the original analysis for the detail. The lesson for any business is that an intermediary is both a business convenience and a legal exposure.
Policy Shifts, Third-Party Risk Does Not
- Priorities change: DOJ’s stated focus areas are narrower and more targeted.
- The statute remains: The FCPA and the expectation of an effective compliance program are unchanged.
- Intermediaries stay central: Distributors, agents, consultants and brokers are still the usual route for improper payments.
- Evidence earns credit: DOJ policy rewards disclosure, cooperation and remediation, all of which depend on records you can produce.
The Exposure Chain: From Distributor to Government Interaction
Bribery risk rarely sits in the contract. It sits in a sequence:
Distributor → Agent → Consultant → Commission → Payment → Government Interaction
- Distributor: Appointed to sell in a market where public buyers, licences or customs matter.
- Agent and consultant: Sub-agents and advisers added by the distributor, often unknown to the principal.
- Commission: Discounts, rebates, success fees and marketing funds that can hide a pass-through.
- Payment: Where money moves, to which account, in which country, against what evidence.
- Government interaction: The tender, licence, inspection or clearance the money may be aimed at.
A questionnaire completed at onboarding sees the first link at best. Our piece on how a distributor can become your sanctions risk makes the same point for sanctions, and why questionnaires need continuous risk intelligence behind them explains the evidence gap.
What DOJ Asks About Third Parties
The DOJ Criminal Division’s Evaluation of Corporate Compliance Programs (September 2024 version) sets out the questions prosecutors use to judge a program. On third parties it asks, in substance, whether management is risk-based and matched to the risk identified, whether there is an appropriate business rationale for using the third party, whether contract terms describe the services and payment terms are appropriate, and whether compensation is commensurate with the services rendered.
It also asks how the company monitors third parties, whether it has audit rights over their books and accounts, and whether risk management continues “throughout the lifespan of the relationship, or primarily during the onboarding process”. The joint DOJ and SEC FCPA Resource Guide (second edition, 2020, with a December 2024 addendum) covers the statute, compliance expectations and enforcement approach in more detail. Check both for current wording.
Notice the shape of those questions. They are about transactions and the life of the relationship, not about a form. That is the design brief for distributor due diligence.
The 8-Step Process: Distributor Diligence as a Transaction Risk Process
Each step below answers a question a regulator may ask, and each leaves a record. Together they treat the distributor as a live relationship with money moving through it. The first four are identity and context. The next three are about the money. The last keeps the picture current.
Authenticate the Distributor
Confirm the entity exists and is who it claims to be: registration records, tax and bank details, address and signatories, matched against independent sources.
Trace Ownership
Identify owners and ultimate beneficial owners, and look for nominee structures, shell entities or hidden links to the customer or to officials.
Screen for PEP and Conflict of Interest
Check owners, directors and key staff for politically exposed persons, government ties and family or business links to your own people or to decision-makers.
Check Adverse Media
Search credible news and public records for bribery, corruption, sanctions or investigations involving the distributor, its owners and its network.
Test the Commission
Ask whether the commission is commensurate with the services, benchmarked against comparable arrangements, and supported by a documented business rationale.
Control the Payment
Pay only the contracted party, to a verified account in the expected country, against evidence the service was performed, with approval proportionate to risk.
Escalate Red Flags
Define the warning signs that stop a payment, who reviews them, and how the decision and its reasoning are recorded.
Review Continuously
Re-screen and re-test on a schedule and on triggers such as ownership change, new adverse media, a tender, or an unusual payment.
Ownership and influence checks are covered in depth in beneficial ownership and influential persons and PEP screening for vendors. For adverse media, see adverse media monitoring. For regulated sectors, distributor due diligence in India for FMCG, pharma and manufacturing applies the approach locally, and natural-language queries across the supply chain show how teams can ask the network questions directly.
Crest.Digital’s Agentic GRC and Agentic AI workflows run ownership, PEP, adverse media and exception checks continuously, with human approval and a full activity record. See the industries we cover.
Red Flags That Should Stop a Payment
A red flag is a reason to ask, not proof of wrongdoing. What matters is that the question is asked before the money moves and that the answer is recorded. Common warning signs discussed in enforcement guidance and practitioner literature include:
Payment Red Flags to Define in Advance
- Unusual commission: Rates well above comparable arrangements, or round amounts with no work behind them.
- Unusual payee: Payment to an account not in the contracted party’s name, or in a third country.
- Vague service: Invoices for “consulting” or “market access” with no deliverable.
- Government link: Introduction by an official, or an owner or relative who is a PEP.
- Timing pressure: Urgent approvals around a tender, licence, inspection or customs clearance.
- Resistance: Reluctance to accept anti-bribery clauses, audit rights or ownership disclosure.
Write these into the payment workflow so that a flagged item cannot be released without a documented second review. That record is also what lets a company show, if asked, that its program worked in practice.
Continuous Review: Because Risk Does Not Wait for the Annual Cycle
Ownership changes, officials change jobs, press coverage appears, and commissions drift. Our article on vendors approved before the risk changed explains why a one-time decision decays. Continuous review means re-screening owners and the network, watching for new signals, and comparing payments against the contract, with exceptions routed to a named reviewer.
Agentic AI can run these checks across systems and correlate them, for example a new adverse-media hit on an owner that coincides with a rising commission. People still decide, and every action is logged. This helps Internal Audit and forensic teams too: a consistent trail from onboarding to payment is far easier to test, or to investigate, than scattered emails and spreadsheets. See end-to-end vendor risk governance. Forensic and risk-advisory partners can also use the same evidence to support client engagements.
Your Turn: Which Link Does Your Program See?
- Onboarding only: We clear the distributor and then trust the relationship.
- Through commission: We test rates and rationale, but payments are reviewed separately.
- Through payment and review: One trail from distributor to payment, re-checked continuously.
Your distributor passed due diligence. Did the payment? Tell us in the comments where your program stops when you share this on LinkedIn.
Crest Perspective
FCPA enforcement patterns since 2020 share a consistent theme: companies face liability not for what their employees did but for what their third-party agents, distributors, and intermediaries did on their behalf. The DOJ’s revised corporate compliance guidance explicitly assesses whether a company’s third-party due diligence programme is proportionate to the corruption risk of the markets in which those third parties operate — making programme design, not just programme existence, a legal matter.
Frequently Asked Questions
According to Freshfields’ analysis, U.S. DOJ Criminal Division leadership said on 30 September 2026 that FCPA enforcement is ramping up, and DOJ guidance continues to prioritise misconduct affecting U.S. interests, cartels and transnational criminal organisations, and serious corporate misconduct. Priorities have shifted in emphasis, but the statute and the expectation of effective compliance programs remain. Read the primary sources and take legal advice for your own position.
Many bribery cases involve intermediaries such as agents, distributors, consultants and customs brokers, because an intermediary can move money to a government official at arm’s length from the company. The DOJ and SEC FCPA Resource Guide discusses third-party payments and the warning signs that should prompt further inquiry. That is why regulators ask how a company knows who it pays, why, and for what service.
The DOJ Evaluation of Corporate Compliance Programs (September 2024 version) asks whether third-party management is risk-based and matched to the risk identified, whether there is an appropriate business rationale for each third party, whether contract and payment terms describe the services and compensation is commensurate with them, whether the company monitors third parties and has audit rights, and whether risk management continues through the life of the relationship rather than mainly at onboarding.
A questionnaire is a useful starting point but only records what the distributor chose to say on one day. It does not show who ultimately owns the entity, whether a politically exposed person is involved, what the press says, whether commissions look reasonable, or whether payments go to the contracted party. Due diligence that follows the transaction, from commission to payment to government interaction, gives much stronger evidence.
Approval is a point in time, while ownership, officials, press coverage and payment behaviour all change. Continuous monitoring re-screens the distributor and its owners, watches for new adverse media or political links, and compares payments and commissions against the contract. Agentic AI can run these checks and raise exceptions, with a person reviewing and deciding and every action logged. This supports, and does not replace, legal and compliance judgment.