1A firm’s senior management are responsible for ensuring that the firm conducts its business with integrity and tackles the risk that the firm, or anyone acting on its behalf, engages in bribery and corruption. A firm’s senior management should therefore be kept up-to-date with, and stay fully abreast of, bribery and corruption issues.

Self-assessment questions:

1. • What role do senior management play in the firm’s anti-bribery and corruption effort? Do they approve and periodically review the strategies and policies for managing, monitoring and mitigating this risk? What steps do they take to ensure staff are aware of their interest in this area?

2. • Can your firm’s board and senior management demonstrate a good understanding of the bribery and corruption risks faced by the firm, the materiality to its business and how to apply a risk-based approach to anti-bribery and corruption?

3. • How are integrity and compliance with relevant anti-corruption legislation considered when discussing business opportunities?

4. • What information do senior management receive in relation to bribery and corruption, and how frequently? Is it sufficient for senior management effectively to fulfil their functions in relation to anti- bribery and corruption?

Examples of good practice		Examples of poor practice
•	The firm is committed to carrying out business fairly, honestly and openly.	•	There is a lack of awareness of, or engagement in, anti-bribery and corruption at senior management or board level.
•	Senior management lead by example in complying with the firm’s anti-corruption policies and procedures.	•	An ‘ask no questions’ culture sees management turn a blind eye to how new business is generated.
•	Responsibility for anti-bribery and corruption systems and controls is clearly documented and apportioned to a single senior manager or a committee with appropriate terms of reference and senior management membership who reports ultimately to the board.	•	Little or no management information is sent to the board about existing and emerging bribery and corruption risks faced by the business, including: higher risk third-party relationships or payments; the systems and controls to mitigate those risks; the effectiveness of these systems and controls; and legal and regulatory developments.
•	Anti-bribery systems and controls are subject to audit.
•	Management information submitted to the board ensures they are adequately informed of internal and external developments relevant to bribery and corruption and respond to these swiftly and effectively.

1The guidance in FCG 2.2.4G on risk assessment in relation to financial crime also applies to bribery and corruption.

We expect firms to identify, assess and regularly review and update their bribery and corruption risks. Corruption risk is the risk of a firm, or anyone acting on the firm’s behalf, engaging in corruption.

Self-assessment questions:

1. • How do you define bribery and corruption? Does your definition cover all forms of bribery and corrupt behaviour falling within the definition of ‘financial crime’ referred to in SYSC 3.2.6R and SYSC 6.1.1R or is it limited to ‘bribery’ as that term is defined in the Bribery Act 2010?

2. • Where is your firm exposed to bribery and corruption risk? (Have you considered risk associated with the products and services you offer, the customers and jurisdictions with which you do business, your exposure to public officials and public office holders and your own business practices, for example your approach to providing corporate hospitality, charitable and political donations and your use of third parties?)

3. • Has the risk of staff or third parties acting on the firm’s behalf offering or receiving bribes or other corrupt advantage been assessed across the business?

4. • Who is responsible for carrying out a bribery and corruption risk assessment and keeping it up to date? Do they have sufficient levels of expertise and seniority?

Examples of good practice		Examples of poor practice
•	Corruption risks are assessed in all jurisdictions where the firm operates and across all business channels.	•	Departments responsible for identifying and assessing bribery and corruption risk are ill equipped to do so.
•	The firm considers factors that might lead business units to downplay the level of bribery and corruption risk to which they are exposed, such as lack of expertise or awareness, or potential conflicts of interest.	•	For fear of harming the business, the firm classifies as low risk a jurisdiction generally associated with high risk.
		•	The risk assessment is only based on generic, external sources.

1The guidance in FCG 2.2.5G on policies and procedures in relation to financial crime and in FCG 2.2.6G on staff recruitment, vetting, training, awareness and remuneration also applies to bribery and corruption.

Firms’ policies and procedures to reduce their financial crime risk must cover corruption and bribery.

Self-assessment questions:

1. • Do your anti-bribery and corruption policies adequately address all areas of bribery and corruption risk to which your firm is exposed, either in a stand-alone document or as part of separate policies? (for example, do your policies and procedures cover: expected standards of behaviour; escalation processes; conflicts of interest; expenses, gifts and hospitality; the use of third parties to win business; whistleblowing; monitoring and review mechanisms; and disciplinary sanctions for breaches?)

2. • Have you considered the extent to which corporate hospitality might influence, or be perceived to influence, a business decision? Do you impose and enforce limits that are appropriate to your business and proportionate to the bribery and corruption risk associated with your business relationships?

3. • How do you satisfy yourself that your anti-corruption policies and procedures are applied effectively?

4. • How do your firm’s policies and procedures help it to identify whether someone acting on behalf of the firm is corrupt?

5. • How does your firm react to suspicions or allegations of bribery or corruption involving people with whom the firm is connected?

Examples of good practice		Examples of poor practice
•	The firm clearly sets out behaviour expected of those acting on its behalf.	•	The firm does not assess the extent to which staff comply with its anti-corruption policies and procedures.
•	There are unambiguous consequences for breaches of the firm’s anti-corruption policy.	•	The firm’s anti-corruption policies and procedures are out of date.
•	Risk-based, appropriate additional monitoring and due diligence are undertaken for jurisdictions, sectors and business relationships identified as higher risk.	•	A firm relies on passages in the staff code of conduct that prohibit improper payments, but has no other controls.
•	Staff responsible for implementing and monitoring anti-bribery and corruption policies and procedures have adequate levels of anti-corruption expertise.	•	The firm does not record corporate hospitality given or received.
•	Where appropriate, the firm refers to existing sources of information, such as expense registers, policy queries and whistleblowing and complaints hotlines, to monitor the effectiveness of its anti- bribery and corruption policies and procedures.	•	The firm does not respond to external events that may highlight weaknesses in its anti-corruption systems and controls.
•	Political and charitable donations are subject to appropriate due diligence and are approved at an appropriate management level, with compliance input.	•	The firm fails to consider whether clients or charities who stand to benefit from corporate hospitality or donations have links to relevant political or administrative decision-makers.
•	Firms who do not provide staff with access to whistleblowing hotlines have processes in place to allow staff to raise concerns in confidence or, where possible, anonymously, with adequate levels of protection.	•	The firm fails to maintain records of incidents and complaints.

See SYSC 3.2.6R and SYSC 6.1.1R.

1We expect firms to take adequate and risk-sensitive measures to address the risk that a third party acting on behalf of the firm may engage in corruption.

Self-assessment questions:

1. • Do your firm’s policies and procedures clearly define ‘third party’?

2. • Do you know your third party?

3. • What is your firm’s policy on selecting third parties? How do you check whether it is being followed?

4. • To what extent are third-party relationships monitored and reviewed? Is the frequency and depth of the monitoring and review commensurate to the risk associated with the relationship?

5. • Is the extent of due diligence on third parties determined on a risk-sensitive basis? Do you seek to identify any bribery and corruption issues as part of your due diligence work, e.g. negative allegations against the third party or any political connections? Is due diligence applied consistently when establishing and reviewing third-party relationships?

6. • Is the risk assessment and due diligence information kept up to date? How?

7. • Do you have effective systems and controls in place to ensure payments to third parties are in line with what is both expected and approved?

Examples of good practice		Examples of poor practice
•	Where a firm uses third parties to generate business, these relationships are subject to thorough due diligence and management oversight.	•	A firm using intermediaries fails to satisfy itself that those businesses have adequate controls to detect and prevent where staff have used bribery to generate business.
•	The firm reviews in sufficient detail its relationships with third parties on a regular basis to confirm that it is still necessary and appropriate to continue with the relationship.	•	The firm fails to establish and record an adequate commercial rationale to support its payments to overseas third parties. For example, why it is necessary to use a third party to win business and what services would the third party provide to the firm?
•	Third parties are paid directly for their work.	•	The firm is unable to produce a list of approved third parties, associated due diligence and details of payments made to them.
•	The firm includes specific anti-bribery and corruption clauses in contracts with third parties.	•	The firm does not discourage the giving or receipt of cash gifts.
•	The firm provides anti-bribery and corruption training to third parties where appropriate.	•	There is no checking of compliance’s operational role in approving new third-party relationships and accounts.
•	The firm reviews and monitors payments to third parties. It records the purpose of third-party payments.	•	A firm assumes that long-standing third-party relationships present no bribery or corruption risk.
•	There are higher or extra levels of due diligence and approval for high risk third-party relationships.	•	A firm relies exclusively on informal means to assess the bribery and corruption risks associated with third parties, such as staff’s personal knowledge of the relationship with the overseas third parties.
•	There is appropriate scrutiny of and approval for relationships with third parties that introduce business to the firm.
•	The firm’s compliance function has oversight of all third-party relationships and monitors this list to identify risk indicators, for example a third party’s political or public service connections.