Vetting Foreign Vendors Without Creating FCPA Exposure

Not every foreign vendor carries the same risk. The review should scale up for vendors who interact with government officials on your behalf, customs brokers, permit facilitators, government sales agents, and scale down for a vendor who simply sells you a commodity product with no government touchpoint. Sorting vendors into a risk tier at intake saves you from either skipping real risk or burning review time on low-risk purchases.

Build the tiering question into your procurement intake form itself: does this vendor interact with any government official or state-owned entity on our behalf. A yes routes to full review automatically.

Screen for sanctions list matches, adverse media, and beneficial ownership before signing, not as a formality after the relationship is already operating. Beneficial ownership matters specifically because a vendor can look clean on paper while being owned or controlled by a government official or their family member, which is exactly the structure enforcement actions target most often.

Document the screening result and the date it was run, since the value of a screen is proving you did it at the time, not just that you would have passed one if asked.

A code of conduct the vendor never reads does less work than a specific anti-bribery clause in the signed contract: representations that the vendor won't make improper payments on your behalf, an audit right, and a termination right if the representation turns out false. This gives you a contractual basis to act, not just a policy violation, if a problem surfaces later.

Have counsel confirm the clause is enforceable under the vendor's local contract law, since some standard anti-bribery language doesn't translate cleanly into every jurisdiction's contract enforcement.

A few patterns that warrant a hard stop rather than a caveat:

• A request to pay an unusually large commission or fee relative to the service, with no clear justification
• Reluctance to sign an anti-bribery representation or to disclose beneficial ownership
• A request to route payment through a third country or a personal account instead of the vendor's business account
• Specific, unsolicited claims that the vendor can expedite a government approval through a relationship

Any one of these is worth pausing the relationship until it's resolved, not proceeding while you look into it further.

Vendor vetting isn't a one-time gate. Re-screen periodically, especially for vendors in the highest risk tier, since ownership changes and sanctions lists update. A compliance platform like Vanta or Drata isn't built specifically for vendor screening, but it's useful for the surrounding structure: documenting that the review policy exists, runs on a schedule, and has an owner.

Name one person accountable for the vendor risk program specifically, distinct from whoever owns general procurement, so the review doesn't quietly stop happening once the person who set it up moves on to something else. Tie the re-screen date to the vendor record itself, not to a separate compliance calendar someone has to remember to cross-reference, so a lapsed review is visible the moment someone opens the vendor file.

A well-designed screening process still fails if the person adding a new vendor to your system doesn't know it exists or thinks it's optional for a small purchase. Walk procurement and finance staff through a real example of a red flag getting caught, not just the policy document, so they recognize the pattern in their own work rather than treating the checklist as a formality to click through.

MeetMyCOO's Olivia, an AI COO, can flag a new vendor that matches a higher-risk profile as it's entered, prompting the full review before a purchase order goes out rather than after.