Most enforcement actions for improper payments involve conduct by third parties — agents, distributors, consultants, customs brokers, joint venture partners.

Risk-based diligence. Tiered by country risk, interaction with government officials, transaction value and the nature of the service. Low-risk vendors should not consume the effort that a government-facing agent requires.

Core steps. Ownership and beneficial ownership identification; sanctions and watchlist screening; adverse media in local language; verification of the business purpose and the counterparty’s capability; and identification of any government official connections.

Red flags. Referral by a government official; refusal to accept anti-corruption terms; requests for payment to a third country or in cash; commissions materially above market; a shell entity with no employees; and an inability to explain what the intermediary actually does.

Contract terms. Anti-corruption representations and covenants, audit rights, compliance certification, termination for breach, and no subcontracting without consent.

Payment controls. No payments to a jurisdiction other than the one where services were rendered or the entity is organized; documented deliverables; approval thresholds.

Ongoing monitoring. Periodic recertification, refreshed screening, and audits proportionate to risk. Diligence performed once at onboarding and never revisited is the pattern enforcement authorities describe most often.