Skip to content
Spectra Forensics, Investigation Specialist

Regulatory framework · Bribery and financial crime

Corporate liability for bribery

Could the company be prosecuted for a bribe paid by someone else, and what protects it?

Spectra Forensics7 laws and regulators

Short answer

Yes. Since July 2018, section 9 of the Prevention of Corruption Act 1988 makes a commercial organisation liable when anyone performing services on its behalf bribes a public servant to win or keep business, whether or not the board knew. The only statutory defence is proof of adequate procedures. A company with US-listed securities or a UK business can face the FCPA or the UK Bribery Act for the same conduct, so one programme has to satisfy all three.

The landscape

Laws and regulators in play

Prevention of Corruption Act 1988, as amended in 2018 (s.8)
Makes giving or promising an undue advantage to a public servant an offence by the person who gives it, with an exemption for someone compelled to pay who reports it to the police or an investigating agency within seven days.
Prevention of Corruption Act 1988 (s.9)
Makes a commercial organisation liable, with a fine, for a bribe given by any person associated with it to obtain or retain business or an advantage; the defence is adequate procedures in line with guidelines to be prescribed.
Prevention of Corruption Act 1988 (s.10)
Makes the person in charge of the organisation liable to three to seven years’ imprisonment and a fine where the s.9 offence was committed with their consent or connivance.
Prevention of Corruption Act 1988 (s.17A)
Requires prior government approval before police enquire into a public servant’s official decisions, which can slow the criminal side of a matter.
US Foreign Corrupt Practices Act
Prohibits bribing foreign officials (15 U.S.C. 78dd-1 to 78dd-3) and requires issuers, including companies with listed ADRs, to keep accurate books and records and adequate internal accounting controls (15 U.S.C. 78m(b)(2)).
UK Bribery Act 2010 (ss.1, 6, 7)
Section 7 makes a company that carries on business in the UK liable for failing to prevent bribery by an associated person anywhere in the world, unless it had adequate procedures.
UK Economic Crime and Corporate Transparency Act 2023 (s.199)
Since 1 September 2025, large organisations can be liable for failing to prevent fraud by associated persons, subject to a reasonable-procedures defence.

Step by step

Decision framework

  1. 01

    Map where the company meets the state

    List every licence, approval, inspection, tender, customs or tax interaction, and who handles each one. Distributors, consultants, liaison agents and joint-venture partners belong on the map, because section 9 reaches anyone who performs services on the company’s behalf.

  2. 02

    Decide which regimes apply

    Indian law applies to every company incorporated in India and to foreign companies doing business here. Add the FCPA if the company or its parent has US-listed securities or acts in US territory, and the UK Bribery Act if any group company carries on business in the UK.

  3. 03

    Build procedures that would satisfy the strictest regime

    India has no notified guidelines under section 9 yet, so most companies design against the UK Ministry of Justice’s six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review.

  4. 04

    Test third parties before and during the relationship

    Due diligence on intermediaries, written anti-bribery terms, audit rights, and payment checks that look for success fees, round sums, cash and payments to third countries.

  5. 05

    When an allegation arrives, preserve and scope

    Hold the relevant emails, messaging, expense and vendor records; ring-fence the people involved; and agree whether the work will run under legal privilege before anyone is interviewed.

  6. 06

    Investigate independently and decide on disclosure

    Establish the facts, the money trail and who knew. Then take advice on reporting, on the s.8 seven-day window for anyone who was coerced, and on any parallel US or UK exposure before any regulator is approached.

  7. 07

    Remediate and record why

    Discipline, contract terminations, control changes and board minutes that show the response. A defence of adequate procedures is built from evidence that the programme worked in practice, not from the policy document.

Duties and deadlines

Who must do what, and by when

  • Board and senior management

    Set the tone, approve the anti-bribery policy and risk assessment, and receive regular reports on how it operates.

    By whenAnnually and whenever the business enters a new market or channel

    PCA s.9 defence; UK MoJ guidance; FCPA internal controls

  • Compliance or legal head

    Run third-party due diligence, gifts and hospitality controls, training and a reporting channel, and keep records that show they were applied.

    By whenBefore onboarding and on a risk-based refresh cycle

    PCA s.9 adequate procedures

  • A person compelled to pay a bribe

    Report the matter to the police or an investigating agency to rely on the exemption for coerced payments.

    By whenWithin seven days of the payment

    PCA s.8 proviso

  • Issuers with US-listed securities

    Keep books and records that fairly reflect transactions and maintain a system of internal accounting controls.

    By whenContinuously

    15 U.S.C. 78m(b)(2)(A) and (B)

  • Audit committee

    Oversee any investigation of a bribery allegation, including its independence, scope and outcome.

    By whenFrom the first credible allegation

    Companies Act 2013 s.177; SEBI LODR Reg 18

Analysis

How the regimes interact

Why this question matters

Before 2018, Indian anti-corruption law was aimed mainly at the public servant who took the bribe. The 2018 amendment turned the focus on the payer and, through section 9, on the company behind the payer. The practical result is that a board can no longer treat a bribe by a distributor or consultant as someone else's problem. The company's exposure is decided by what it did before the bribe was paid: whether it understood where its risks were, checked the people acting for it, and could show that its controls operated.

How the regimes interact

One standard of proof, three audiences. Section 9 of the PCA, section 7 of the UK Bribery Act and the FCPA's accounting provisions all ask, in different words, whether the company had controls fit for its risks. Indian law has not yet prescribed the guidelines that section 9 refers to. Commentary up to 2025 records that they remain unnotified, so the UK's six principles have become the working benchmark for Indian companies as well. A programme built to those principles, with evidence that it operates, is the most efficient way to answer all three regimes.

Where they differ. The UK offence of failing to prevent bribery covers bribes to anyone, public or private, and applies to companies that carry on business in the UK wherever the bribe was paid. Section 9 of the PCA is about bribing public servants. The FCPA's bribery provisions concern foreign officials, but its books-and-records and internal-controls rules apply to issuers whether or not a bribe is proved. A sales commission disguised as a marketing fee can therefore be an accounting violation in the US even where Indian prosecutors would need more to bring a bribery case.

Disclosure creates tension. A voluntary approach to one authority can trigger questions from another, and documents produced abroad can surface in Indian proceedings. Decide early who leads, whether the investigation runs under legal privilege, and in what order any authority is approached. The seven-day reporting window in section 8 for coerced payments is personal to the person who paid; it is not a company disclosure regime, but it can shape the first week of a matter.

Enforcement climate is not the law. The US enforcement pause of February 2025, followed by the Department of Justice's June 2025 guidelines prioritising serious misconduct, changed priorities, not the statute. Limitation periods continue to run, and the UK's newer failure-to-prevent-fraud offence has widened corporate exposure for groups with a UK business.

How Spectra Forensics can help

We run anti-bribery and corruption investigations, test third parties through integrity due diligence, and help companies show that their procedures work in practice. Speak to us in confidence.

Warning signs

Red flags

  • A consultant or ‘liaison agent’ whose fee is linked to a licence, approval or tender result.
  • Payments to a third party in a country with no link to the work, or requests to split invoices.
  • An intermediary recommended by the official who decides the matter.
  • Expense claims for hospitality to officials that are just under approval limits.
  • A distributor margin well above the market rate with no clear explanation.
  • Resistance to audit clauses or to disclosing who owns the intermediary.

Checklist

What good looks like

  • A documented bribery risk assessment, refreshed at least annually and approved by the board.
  • A register of every third party that deals with government on the company’s behalf, with due diligence on file.
  • Contract clauses giving audit rights and termination for corruption.
  • Finance controls that flag cash, round-sum, success-fee and third-country payments.
  • Training records for staff and intermediaries in high-risk roles.
  • A reporting channel the audit committee can see, with case records kept.
  • Evidence that investigations led to discipline and to control changes.

Myths and corrections

Common misreadings

Misreading

The company is safe if no director knew about the bribe.

Better reading

Section 9 does not require the board’s knowledge. The company is liable for an associated person’s bribe unless it proves adequate procedures; knowledge matters for the separate liability of individuals under section 10.

Misreading

Because the government has not notified the section 9 guidelines, the defence cannot be used.

Better reading

The defence is in the Act. Until guidelines are prescribed, companies are judged on whether their procedures were adequate in fact, and international guidance such as the UK’s six principles is the practical benchmark.

Misreading

Agents and distributors are independent contractors, so their conduct is theirs alone.

Better reading

An associated person is anyone who performs services for or on behalf of the organisation, whatever the contractual label.

Misreading

A US enforcement pause means the FCPA no longer matters.

Better reading

Executive Order 14209 of February 2025 paused new FCPA enforcement pending new guidelines, which the Department of Justice issued in June 2025. The statute, its five-year limitation period and the books-and-records rules remain in force.

For the board pack

Takeaways

  • 01Under section 9, a company can be convicted for a bribe it did not know about; the defence has to be proved.
  • 02Intermediaries are where most exposure sits, so due diligence and payment controls carry the most weight.
  • 03With no Indian guidelines notified, design to the UK six principles and document how they work in practice.
  • 04One set of facts can engage Indian, US and UK law; sequence any disclosure decision with advice on all three.

Questions we are asked

Who is an associated person under section 9?

Anyone who performs services for or on behalf of the commercial organisation, whether an employee, agent, subsidiary or other intermediary. What matters is the services performed, not the label in the contract. Employees are presumed to be associated persons.

Does section 9 apply to foreign companies?

Yes. A commercial organisation includes a body incorporated outside India that carries on business, or part of a business, in India, as well as Indian companies carrying on business in or outside India.

What is the penalty for a company under section 9?

A fine, with no statutory cap. Individuals in charge face separate liability under section 10 where the offence was committed with their consent or connivance, with imprisonment of three to seven years and a fine.

Has the UK’s failure to prevent fraud offence changed anything for Indian groups?

For groups with a UK business that meet the size test, yes. Since 1 September 2025, a large organisation can be liable if an associated person commits a specified fraud intending to benefit it, unless it had reasonable fraud-prevention procedures. Home Office guidance was published on 6 November 2024.

Sources

  1. Prevention of Corruption Act 1988, as amended by the Prevention of Corruption (Amendment) Act 2018 (Act 16 of 2018), in force 26 July 2018 link
  2. US Code, Title 15, ss. 78dd-1 to 78dd-3 and 78m(b)(2) link
  3. Executive Order 14209, Pausing Foreign Corrupt Practices Act Enforcement, 10 February 2025 link
  4. US Department of Justice, Guidelines for Investigations and Enforcement of the FCPA, 9 June 2025 link
  5. UK Bribery Act 2010 link
  6. UK Ministry of Justice, The Bribery Act 2010: Guidance, March 2011 link
  7. UK Economic Crime and Corporate Transparency Act 2023, ss. 199 and 201 link

This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.

Go deeper

Further reading

Anti-bribery & corruption2 Oct 2026

Building an Anti-Bribery Programme in India: The 2018 PCA Amendments and Corporate Liability

Since 2018, companies can be liable for bribes paid by their associates under the PC Act. What ss. 8, 9 and 10 mean and how to build an adequate programme.

Anti-bribery & corruption5 Oct 2026

FCPA and UK Bribery Act: When Foreign Anti-Bribery Laws Reach Indian Companies

When can the US FCPA or UK Bribery Act apply to an Indian company? The jurisdictional hooks, 2025 FCPA enforcement changes and the UK fraud offence.

Due diligence24 Aug 2026

Due Diligence on Business Partners in India: What to Check Before You Sign

A practical checklist for vetting distributors, suppliers and JV partners in India: MCA and GST records, litigation, site visits, references and red flags.

Confidential consultation

Facing this question on a live matter? Talk to us.

Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.

Speak to an expertAll regulatory frameworks
Confidential enquiry