FCPA Due Diligence Script for Third-Party Vetting

When your team needs to evaluate a third-party intermediary in a high-risk jurisdiction, you don't have time to build a questionnaire from scratch. A former Vitol oil trader was sentenced to four years in prison for bribing Mexican and Ecuadorian officials, a reminder that the companies you work with can expose you to FCPA liability even when your own employees follow the rules.

This script provides a structured conversation guide for initial due diligence calls with potential agents, consultants, or distributors. Use it to identify red flags early, before contracts are signed and risk becomes embedded in your operations.

Purpose of the Script

This verbal screening tool is for compliance or procurement teams conducting initial conversations with third-party intermediaries who will interact with government officials, obtain permits, or facilitate business in foreign markets. It's designed to:

• Identify FCPA risk indicators during live conversations
• Create a documented record of the vetting process
• Surface discrepancies between what the intermediary claims and what your research shows
• Establish baseline expectations about anti-corruption compliance

This isn't a contract. It's a discovery tool that helps you decide whether to proceed to formal due diligence, request additional documentation, or walk away.

Prerequisites

Before using this script, ensure you have:

1. Completed background research. Run the intermediary's name, principals, and business address through public records, sanctions lists, and adverse media searches. Know what you're looking for before you ask.

2. Jurisdiction risk assessment. Understand the Corruption Perceptions Index ranking and common enforcement patterns in the country where the intermediary operates. A generic script won't catch region-specific schemes.

3. Clear business justification. Document why you need this intermediary. If you can't articulate what specialized service they provide that your own team cannot, that's a red flag before the call even starts.

4. Assigned note-taker. One person asks questions; another documents responses verbatim. You'll need this record if the relationship goes sideways.

The Script

Opening

"Thank you for taking the time to speak with us today. As part of our standard process, we need to understand your business operations and compliance practices before we can move forward. I'm going to ask you some detailed questions. Please answer as specifically as you can."

Section 1: Business Structure and Ownership

• "Walk me through your ownership structure. Who owns more than 10% of your company?"
• "Are any of your owners, officers, or directors current or former government officials, or related to government officials?"
• "Do you have any business partnerships or joint ventures with government entities or state-owned enterprises?"
• "What percentage of your revenue comes from government contracts or government-adjacent work?"

What you're listening for: Evasiveness about ownership. Claims of "private" ownership that can't be verified. Family relationships to officials that aren't disclosed upfront.

Section 2: Services and Government Interaction

• "Describe exactly what services you'll perform for us. Be specific about tasks, not outcomes."
• "Will you interact directly with government officials as part of this work? If so, which agencies and for what purpose?"
• "How do you typically obtain permits or licenses for your clients?"
• "Have you ever made payments to government officials on behalf of a client? If so, describe the circumstances and documentation."

What you're listening for: Vague promises to "handle everything" or "take care of approvals." Inability to name specific officials or agencies. References to "facilitation" without clear process descriptions.

Section 3: Compliance Infrastructure

• "Do you have a written anti-corruption policy? Can you send it to us after this call?"
• "Describe your process for expense documentation and approval."
• "How do you train your employees on anti-bribery laws?"
• "When was your last compliance audit, and who conducted it?"

What you're listening for: Confusion about what you're asking. Claims of having policies that can't be produced. No training records or audit history.

Section 4: Compensation and Financial Practices

• "What's your standard commission or fee structure for this type of work?"
• "Do you expect any upfront payments, retainers, or success fees?"
• "Where do you maintain your business bank accounts?"
• "Have you ever been asked to invoice through a third country or use an account that doesn't match your business name?"

What you're listening for: Requests for cash payments. Fees wildly above market rate. Offshore accounts in jurisdictions unrelated to the work. Willingness to use alternative invoicing structures.

Section 5: Track Record and References

• "What similar projects have you completed in the past two years?"
• "Can you provide three client references we can contact?"
• "Have you or your company ever been investigated, charged, or sanctioned for corruption, fraud, or sanctions violations?"
• "Are you aware of any pending investigations or legal actions against your company?"

What you're listening for: Inability to name verifiable clients. Defensive reactions to background questions. Disclosures that don't match your pre-call research.

Closing

"Thank you for your time. We'll review your responses and follow up within [timeframe] about next steps. If we move forward, we'll need you to complete a detailed questionnaire and provide supporting documentation. Do you have any questions about our process?"

Customizing the Script

For higher-risk jurisdictions: Add questions about subcontractors ("Will you use any subcontractors or sub-agents? Who are they and what will they do?") and political connections ("Have you or your principals ever held elected office or worked in government?").

For specific industries: If you're in extractives, add questions about community engagement and environmental permitting. If you're in healthcare, add questions about interactions with hospital administrators or health ministry officials.

For ongoing relationships: If you're re-vetting an existing intermediary, add: "What's changed in your ownership, operations, or government relationships since we last spoke?"

For sensitive markets: In jurisdictions with known state-owned enterprise dominance, add: "What percentage of your clients are state-owned enterprises, and what services do you provide them?"

Validation Steps

After the call, your team should:

1. Compare responses to background research. Flag any discrepancies between what the intermediary said and what public records show. A mismatch on ownership or government relationships is disqualifying.

2. Verify claims within 48 hours. Contact provided references. Check that the anti-corruption policy they send matches what they described. Confirm business registrations and licenses.

3. Calculate the red flag score. Assign point values to risk indicators (offshore accounts, government relationships, vague service descriptions, no compliance infrastructure). Set a threshold for automatic rejection.

4. Document the decision. Whether you proceed or walk away, write down why. If enforcement comes years later, you'll need to show you asked the right questions and acted on the answers.

5. Escalate unclear responses. If the intermediary couldn't answer basic questions about ownership or compliance, that's not a "maybe." That's a no.

While this script won't prevent every FCPA violation, it will help avoid the most common one: bringing on an intermediary without asking hard questions. Use it every time, document every answer, and trust your instincts when something doesn't add up.