Anti-Bribery Compliance

The Bribery Act 2010 creates four criminal offences: bribing another person (s.1); being bribed (s.2); bribing a foreign public official (s.6); and the corporate offence of failing to prevent bribery by an associated person (s.7). The first three apply to individuals and organisations alike. The fourth applies only to commercial organisations and is strict liability — the prosecution does not need to prove the company knew about or authorised the bribery.

The penalties are severe: individuals face up to 10 years' imprisonment and unlimited fines; organisations face unlimited fines. Conviction can also trigger debarment from public procurement contracts. The Act applies extraterritorially — it can apply to bribery committed anywhere in the world by UK-connected businesses.

The only defence to the s.7 corporate offence is that the company had adequate procedures in place to prevent bribery. The Ministry of Justice has published guidance setting out six principles for adequate procedures:

1. Proportionate procedures — tailored to the actual bribery risks the business faces
2. Top-level commitment — senior management lead the anti-bribery culture
3. Risk assessment — the organisation identifies and assesses its bribery risks
4. Due diligence — on persons acting on the organisation's behalf
5. Communication and training — staff are aware of the policy and procedures
6. Monitoring and review — the procedures are kept under review and updated

For small businesses with low bribery risk, "adequate procedures" may simply mean a written anti-bribery policy and basic training. Larger businesses or those operating in high-risk sectors or countries will need more comprehensive programmes.

Most small UK businesses face relatively low bribery risk, but some basic steps are still advisable and may be required by larger clients or public sector contracts. At a minimum you should:

• Adopt a written anti-bribery policy stating zero tolerance for bribery, applicable to employees, contractors, and agents
• Train staff on what constitutes bribery and how to report concerns
• Review your gifts and hospitality arrangements — modest hospitality is generally acceptable but excessive gifts to win business are not
• Conduct basic due diligence on agents or intermediaries who act on your behalf, particularly in higher-risk countries
• Provide a confidential way for staff to report suspected bribery (a whistleblowing channel)

The Serious Fraud Office (SFO) and Crown Prosecution Service (CPS) have both prosecuted companies under the Act — compliance is not merely theoretical.

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) significantly strengthens the UK's corporate criminal liability framework. Most significantly for businesses, it creates a new failure to prevent fraud offence under section 199 (in force from 1 September 2025 for large organisations). This mirrors the structure of the Bribery Act's s.7 offence: a large organisation is criminally liable if a person associated with it commits fraud for the organisation's benefit, unless the organisation can demonstrate it had reasonable fraud prevention procedures in place.

For the purposes of the fraud prevention offence, a "large organisation" is one that meets at least two of: more than 250 employees; more than £36 million annual turnover; more than £18 million total assets. Smaller businesses are currently outside the direct scope, but supply chain pressure from larger customers — who must demonstrate due diligence over their associates — will increasingly push the standard down the chain.

ECCTA also introduces a new identification doctrine for economic crimes: companies can now be held criminally liable when a "senior manager" (not just the board) commits fraud or false accounting in the course of their functions. This is a major expansion of corporate criminal liability and substantially increases the risk of prosecution for large professional services firms, financial institutions, and corporates. Businesses should review their fraud risk assessment alongside their anti-bribery risk assessment and consider whether their existing adequate procedures would also satisfy the fraud prevention standard — the two frameworks are closely aligned.