Foreign Corrupt Practices Act (FCPA): SEC Enforcement.

Last Updated on: 4th August 2026, 01:33 am

The SEC handles civil FCPA enforcement, and the DOJ handles criminal FCPA enforcement. While this distinction might suggest that any case involving civil violations of the FCPA will only involve the SEC, and any case involving criminal violations will only involve the DOJ, this is far from the case. For one, companies, banks, and individuals facing FCPA investigations often face scrutiny from both agencies at the same time.

The SEC has the authority to pursue civil FCPA enforcement actions based on anti-bribery violations by issuers and books-and-records and internal-controls violations by issuers. It can also pursue civil enforcement actions against issuers and, where authorized by applicable securities laws, certain individuals and entities. In this context, an issuer is any company that is either listed on a U.S. Stock exchange or that lists its financial statements on its annual SEC filings. A covered actor is any person or entity, including companies and banks, that can be accused of violating the FCPA.

Also, while Executive Order 14209 directed the Attorney General to review and revise policies governing FCPA investigations and enforcement; the DOJ issued revised guidelines on June 9, 2025,, this does not mean that the DOJ has sole authority to pursue enforcement actions under the FCPA. As discussed, the SEC still has the authority to pursue civil FCPA enforcement in its own investigations.

Companies, banks, and individuals can face both civil and criminal penalties for violating the FCPA. Examples of parallel FCPA enforcement actions involving the SEC and the DOJ include:

• In 2008, the SEC imposed a $350 million disgorgement penalty on Siemens. In parallel, the DOJ imposed a $450 million fine on Siemens.
• On January 9, 2014, Alcoa paid $175 million in disgorgement to the SEC, while Alcoa’s parallel DOJ resolution involved $223 million in fines and forfeiture.

Who Can the SEC Charge Under the FCPA?

The anti-bribery provisions of the FCPA reach “U.S. Persons,” “issuers,” “covered territorial actors,” and certain foreign actors. While both the DOJ and SEC have jurisdiction to pursue criminal and civil FCPA enforcement actions against all of these actors, the SEC is limited to pursuing civil enforcement actions against issuers under 15 U.S.C. § 78dd-1. As an anti-bribery provision, this section has jurisdiction to reach both domestic issuers and foreign issuers that, among other things, (i) “list own securities on a registered U.S. Securities exchange,” (ii) “make, or is required to make, annual report to the SEC,” or (iii) meet either of these criteria.

Under the FCPA, certain foreign actors are known as covered territorial actors. These covered territorial actors are also subject to both criminal and civil enforcement action for bribing foreign officials, but this jurisdiction is limited to cases where they are acting within the United States. A “domestic concern” is a separate category governed by 15 U.S.C. § 78dd-2, and is defined under the FCPA as any individual who is a citizen, national, or resident of the United States, and any corporation, partnership, association, joint-stock company, business trust, unincorporated organization, or sole proprietorship that has its principal place of business in the United States or that is organized under the laws of a State of the United States or a territory, possession, or commonwealth of the United States.

Domestic concerns (non-issuers), individuals, and other entities not registered with the SEC are known as U.S. Persons. While the DOJ and SEC have jurisdiction to pursue criminal and civil enforcement action against U.S. Persons, the SEC is not authorized to pursue civil enforcement actions in anti-bribery cases. Also, while the SEC does not have jurisdiction to pursue civil anti-bribery enforcement action against domestic concerns, the DOJ can civilly enforce § 78dd-2 in these cases. Similarly, the DOJ has the authority to civilly enforce § 78dd-3 against covered territorial actors.

In practice, the DOJ and SEC have broad authority to pursue both companies and individuals for violating the FCPA. This risk extends to companies across many different sectors, particularly those with international operations and clients. As a result, a 2016 survey by EY of respondents in the construction-related services industry found that 13% of these entities felt that paying bribes to foreign officials is a common practice in countries where they do business.

What Must the SEC Prove in an FCPA Bribery Case?

To enforce civil penalties under the FCPA, the SEC must demonstrate that an issuer or other covered actor has made an unlawful offer to pay or offer money or anything of value to a foreign official, or, as a result of a completed transaction, actually offered or paid money or anything of value to a foreign official. This includes an attempt to pay or offer money or anything of value to a foreign official. As a result, an unlawful offer can establish liability for violating the FCPA, even in cases where no payment is completed.

The anti-bribery provisions of the FCPA also require that the defendant act with corrupt intent to influence the decision of a foreign official, or, as the anti-bribery provisions state, “corruptly” induce a foreign official. Both of these elements must also be proven in relation to the offer, offer, or payment to a foreign official, or a third party acting as an intermediary, of money or anything of value with the purpose of inducing that official to “do or to omit to do any act, or to use his influence with any foreign official or foreign political party to do or to omit to do any act” which would “secure any improper advantage” for the offeror, or the offeror’s affiliate, in obtaining or retaining business. This includes, but is not limited to, payments to secure: (i) “any contract from, or any commitment of funds to or from, any foreign government or political party;” (ii) “any other official act or decision;” (iii) “the procurement of any permit, license, or similar document to do or perform any act;” or (iv) “the sale, or purchase, of any articles, services, or other things in connection with any such contract, commitment, or act.”

Under the FCPA, third-party payments can also trigger liability. In these cases, the SEC must establish that the defendant made the third-party payment (or offer to pay), or otherwise induced the payment or offer, with the FCPA’s required knowledge of the payment or offer. The FCPA defines “knowledge” as including: (i) actual knowledge; (ii) “conscious disregard;” or (iii) “willful blindness,” meaning a “reckless disregard” or “deliberate ignorance” of the fact that the payment or offer violates the anti-bribery provisions.

The FCPA also provides for a number of statutory and affirmative defenses to anti-bribery enforcement action. The two primary statutory defenses are (i) facilitating payments, which can be considered a “safe harbor” in cases where a payment is made to secure a “routine governmental action,” as long as no discretion is involved, and (ii) promotional expenses, which refers to payments related to the promotion or explanation of products and services, so long as the payments themselves are not corrupt. In addition to these, defendants can use the “local-law” defense to an FCPA anti-bribery charge, provided that a written foreign law or regulation “expressly authorizes” the offer or payment. Finally, while rare, issuers and other covered actors can assert an affirmative defense if they can show they reasonably believed that the anti-bribery provision does not apply to the transaction or transaction at hand.

How Does Issuer Accounting Liability Extend Across Corporate Groups?

The FCPA contains two accounting provisions, the “books-and-records” and the “internal-controls” provisions, designed to discourage financial fraud and corporate mismanagement. Together, these rules are intended to make it harder for companies to hide payments made to foreign officials or to improperly use money or assets in the service of bribing foreign political leaders. As provided in the FCPA and the SEC’s corresponding regulations, issuers are prohibited from:

• Failing to make “accurate” annual, quarterly, and semi-annual financial reports in accordance with GAAP;
• Failing to “make and keep books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer”; and
• Failing to maintain “internal accounting controls sufficient to provide reasonable assurances” that: (i) “assets are used only with the authorization of management;” (ii) “transactions are executed and recorded reasonably and in a timely manner;” and (iii) “assets are not used or disposed of without the knowledge of management.”

Crucially, issuers can face books-and-records liability even if their financial statements are “accurate.” That said, failing to make accurate financial statements still constitutes a separate violation.

Are Violations of These Provisions Independent?

Yes, violations of the FCPA’s books-and-records and internal-controls provisions are independent. For instance, while failing to maintain adequate internal accounting controls often leads to the issuance of inaccurate financial statements, the liability imposed for failing to maintain adequate internal accounting controls may remain even if the books and records themselves, and the financial reports derived from them, do not contain inaccuracies that would otherwise be actionable.

While this distinction might seem to be a mere technicality, the internal-controls rule is intended to address issuers’ systemic failures (as opposed to individual transactions or records that are deemed inaccurate or deficient, to use the SEC’s phrasing).

The internal-controls rule applies to “transactions recorded reasonably, timely, and with adequate oversight by the issuer’s management.” It also applies to the “use of any financial instrument for bribes to foreign officials or other assets or funds improperly or improperly used to bribe foreign officials.”

Can Issuers Face Books-and-Records or Internal-Controls Liability for Subsidiaries’ Violations?

Yes, companies that fall within the FCPA’s jurisdiction under the books-and-records and internal-controls rules can face books-and-records or internal-controls liability in situations involving their subsidiaries. Generally, issuers consolidate their financial statements with those of their controlled subsidiaries. As a result, if an issuer’s subsidiary improperly uses intermediaries to pay bribes to foreign officials or improperly disposes of any of the subsidiary’s assets, this will often create liability for the issuer as well. In many cases, issuers and their subsidiaries will be held jointly and severally liable in SEC enforcement action.

How Long May a Merged Target Company’s Pre-Merger FCPA Violations Result in Liability for a Surviving Issuer?

In the case of a merger, liability for books-and-records and internal-controls violations may transfer to the surviving company, depending on the facts and applicable law. Because financial accounting records can persist for decades, a merged target company’s pre-merger FCPA liability can also persist for years or decades. By addressing target companies’ past FCPA issues as soon as possible, companies can substantially reduce the risks involved in pursuing mergers and other acquisitions.

What Happens After the SEC Opens an FCPA Investigation?

Depending on the circumstances involved, the SEC may conduct a voluntary or formal investigation. Voluntary investigations involve SEC staff members requesting pertinent documents, records, or electronically stored information (ESI) from a company, bank, individual, or other covered actor, and the recipient agreeing to provide them. While the SEC cannot compel this information (meaning this step is optional), recipients should be aware that failing to comply can result in substantial collateral liability in a formal investigation.

An SEC formal investigation order authorizes the SEC to compel the production of documents, records, or ESI, to request the testimony of witnesses, and to administer oaths under 15 U.S.C. § 78u(b). If the SEC recommends enforcement action, the agency may issue a “Wells notice” to the prospective defendant, after which the defendant will have the opportunity to contest the recommended enforcement action before it is initiated.

What Options Are Available in the Event of SEC FCPA Settlement Negotiations?

For many companies, banks, individuals, and other covered actors facing SEC enforcement action, settlement negotiations are the most prudent course of action. Settlements are either administrative or civil in nature, and both can be used to resolve an FCPA case (including a case involving violations of the anti-bribery, books-and-records, and internal-controls provisions). While the SEC may initiate proceedings in federal district court or through an administrative proceeding, settlement negotiations can lead to a case being dismissed entirely. In cases involving civil penalties, disgorgement, or prejudgment interest, the SEC will usually enforce the FCPA through federal district court.

What Remedies and Sanctions Can the SEC Seek in FCPA Investigations?

In addition to civil penalties, disgorgement, and prejudgment interest, if the SEC initiates a case in federal district court, it can also seek injunctive relief (i.e., it can impose an injunction prohibiting issuers or covered actors from engaging in or failing to prevent repeated bribery, or failing to accurately report issuers’ financial statements in the future). Additionally, the SEC can pursue officer-and-director bars, meaning it can prohibit individuals from serving as officers and directors of any issuer listed on a U.S. Securities exchange. Along with penalties, companies, banks, and other covered actors facing SEC enforcement action can also be subject to:

• Remediation or new controls;
• Remediation reporting;
• Remediation audits;
• Compliance reports;
• Compliance review and certification; and
• Independent compliance reviews.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

How Does the SEC Value Cooperation in FCPA Investigations?

The SEC evaluates cooperation in FCPA investigations based on self-policing, self-reporting, remediation, and assistance. When evaluating corporate cooperation, the SEC also takes into account, “the company’s prior compliance history, including whether any prior FCPA, whistleblower, or internal control enforcement action has been taken by the SEC, the U.S. Department of Justice (DOJ), or other regulatory authorities.” This is similar to the approach that has recently been adopted by the DOJ.

How Long Does SEC FCPA Exposure Last for Individuals?

In federal court, the SEC has the burden of proving a “preponderance of the evidence” to establish civil liability for violating the FCPA (or other federal securities laws). Issuers and covered actors can face primary liability under the FCPA’s anti-bribery, books-and-records, and internal-controls provisions. Individuals can also face primary liability if they have personally participated in issuer misconduct. Additionally, individuals may face civil FCPA liability under Exchange Act § 20(e) in situations where they know, recklessly, or, under certain circumstances, willfully ignore, the existence of issuer misconduct, and then “substantially assist” the issuer in violating the FCPA.

When does the statute of limitations for an SEC enforcement action apply?

The statute of limitations for any SEC enforcement action is generally five years, although the SEC can sometimes seek disgorgement for up to 20 years back in situations where the defendants are alleged to have committed an FCPA, whistleblower, or internal-controls enforcement action with scienter. When initiating a scienter-based disgorgement action, the SEC must also establish that it is acting to recover “property which the issuer, company, organization, or individual has wrongfully obtained” in violation of the FCPA or other securities law.

How long does the SEC have to initiate an FCPA investigation?

Generally, the SEC has five years to initiate an FCPA investigation. This is because, under 28 U.S.C. § 2462, a “complaint or other action shall not be filed by the United States against any person for any claim or demand for any money, property, right, title, or contract,.... Unless action is filed within five years from the date of accrual of the claim.” However, under 15 U.S.C. § 78u(d)(8), in situations where the SEC can prove “scienter,” the statute of limitations for disgorgement is ten years rather than five.

How can a written tolling agreement affect the statute of limitations?

A written tolling agreement between the SEC and a target individual will extend the otherwise applicable limitations period by the amount of time specified in the tolling agreement. While accepting a tolling agreement might seem counterintuitive, defendants should always consider that agreeing to sign a tolling agreement will often, while not giving the SEC any additional authority to seek an enforcement action against them, show the SEC that they are willing to cooperate.

How long does a request for foreign evidence extend the statute of limitations in an SEC investigation?

If the SEC or DOJ makes requests for evidence in foreign countries, this can extend the five-year (and, in disgorgement cases, the ten-year) statute of limitations. 28 U.S.C. § 2465(b) allows the SEC to toll the statute of limitations in an investigation by issuing a request for foreign evidence, and it is only until a response is received from the foreign entity that the tolling expires. As the statute notes, “foreign government evidence shall be considered of no use until received,” and a tolling period of three years will apply.

Did the 2025 FCPA Pause Stop SEC Enforcement?

On January 27, 2025, President Donald J. Trump issued Executive Order 14209 instructing the U.S. Attorney General to temporarily pause new FCPA matters. In July 2025, the DOJ issued subsequent guidance detailing that it would prioritize matters involving illegal cartel activities and potential national security risks. In DOJ’s guidance, the agency also deprioritized certain practices, like routine gift, travel, and entertainment expenses, that are not clearly designed to provide any particular benefit to foreign officials. In August 2025, the DOJ announced its first post-guidance FCPA enforcement action involving alleged bribery in Cameroon.

Has the DOJ Established a New Enforcement Program?

Yes, as of August 2025, the DOJ is operating the “Joint and Multilateral Enforcement Program.” While the program focuses on targeting corruption that affects U.S. Economic security, it also covers FCPA tips that are not within the SEC’s purview. For companies, banks, individuals, and other covered actors facing FCPA investigations and DOJ scrutiny, it is important to keep this new program in mind, as it may mean more scrutiny will be warranted.

Can the CFTC Assert Jurisdiction in Foreign Bribery Cases?

Yes, and, in some cases, this can be an independent source of liability for issuers and covered actors. For example, corruption involving “any of the types of misconduct covered by the FCPA” that are also “commodities or securities, such as gold, bitcoin, silver, corn, beef, crude oil, natural gas, or other financial instruments or derivatives,” can be treated as a violation of the Commodity Exchange Act. Additionally, corruption that has the potential to affect the price of a derivative contract may invite enforcement action by the CFTC.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm's attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.