the_order/docs/legal/ABAC_POLICY.md

The Order — Anti‑Bribery & Anti‑Corruption Policy

Owner: Chief Compliance Officer (CCO)
Approved by: Board of Directors
Effective: [insert date]
Applies to: All directors, officers, employees, temporary staff, and anyone acting on behalf of the Order (consultants, agents, distributors, intermediaries, JV partners, and subsidiaries—collectively, "Associated Persons"). UK law treats anyone "performing services for or on behalf of" the organization as an associated person. (UK Legislation)

1) Policy statement (tone from the top)

The Order has zero tolerance for bribery or corruption in any form. No one may directly or indirectly offer, promise, give, request, agree to receive, or accept anything of value to improperly influence any act or decision or to secure an improper advantage. This policy applies worldwide, without exception.

2) Purpose & legal framework this policy is designed to satisfy

• UK Bribery Act 2010 (UKBA) — creates four offenses: (1) bribing, (2) being bribed, (3) bribing a foreign public official, and (4) failure of a commercial organisation to prevent bribery by associated persons. Corporate liability for (4) is strict unless the organization proves adequate procedures based on six principles (proportionate procedures; top‑level commitment; risk assessment; due diligence; communication/training; monitoring & review). Facilitation (grease) payments are not exempt under UKBA. Penalties include up to 10 years' imprisonment for individuals and unlimited fines for organizations. (GOV.UK)

• U.S. Foreign Corrupt Practices Act (FCPA) — two pillars: anti‑bribery (prohibits corrupt payments to foreign officials to obtain/retain business) and accounting provisions (books‑and‑records + internal controls for SEC issuers). The FCPA recognizes a narrow exception for facilitating payments for routine governmental action and affirmative defenses for bona fide, directly related promotional/contract expenses—but local law may still prohibit them (and UKBA does). Penalties include criminal fines and imprisonment (with alternative fines up to 2x gain/loss). (SEC)

• Global benchmarks — UNCAC (comprehensive treaty) and OECD Good Practice Guidance inform best‑practice programs (risk‑based controls, due diligence, training, monitoring). (UNODC)

3) Key definitions

• Public/Government Official: Any officer/employee of a government, state‑owned/controlled entity, public international organization; any person acting in an official capacity; candidates/party officials. (See UKBA s.6 and FCPA guidance.) (UK Legislation)

• Anything of value: Cash, gifts, hospitality, travel, per diems, favors, internships, donations, sponsorships, discounts, in‑kind support, or other benefits. (Department of Justice)

• Associated Person: Anyone performing services for or on behalf of the Order (employees, agents, subsidiaries, certain JV partners). (UK Legislation)

• Facilitation (grease) payment: A small payment to expedite routine, non‑discretionary action by a public official. Strictly prohibited by this policy (even though FCPA provides a narrow exception). (GOV.UK)

4) Prohibited conduct

• Bribery in any form (offering, giving, requesting, accepting).
• Facilitation payments worldwide (safety‑of‑life exception below). (GOV.UK)
• Off‑book accounts, false invoices, mis‑recording, or other books‑and‑records violations. (Issuers must keep accurate books and maintain internal controls.) (Legal Information Institute)
• Indirect bribery via third parties, charitable or political donations, sponsorships, or community investments. (GOV.UK)

5) Gifts, hospitality & expenses (G&E)

Principle: modest, infrequent, transparent, never to influence or appear to influence a decision. UK guidance emphasizes "reasonable and proportionate." (GOV.UK)

Global baseline rules (the Order may set stricter local limits in country addenda):

• Cash or cash equivalents (gift cards, vouchers): Prohibited.
• Public officials: No gifts; modest refreshments or logo items of nominal value only, with written Compliance pre‑approval for any hospitality/expenses. (GOV.UK)
• Private‑sector counterparts: Up to US$100/£80 per person per event, US$200/£160 annual aggregate with the same person; pre‑approval above these limits. (These are policy thresholds, not legal thresholds.)
• Travel/hosting of public officials: allowed only if (a) directly related to product demos, training, or contract execution; (b) economy class; (c) itineraries/agendas documented; (d) pay vendors directly (no per‑diems/cash); (e) no family/side trips; and (f) Compliance pre‑approval. (This aligns with the FCPA "reasonable and bona fide" defense.) (SEC)
• Registers & documentation: All G&E must be logged in the G&E Register with purpose, attendees, value, approvals, and receipts.

6) Facilitation payments & safety exception

• Absolute ban on facilitation payments worldwide to satisfy UKBA and OECD expectations. (GOV.UK)
• Imminent threat to health/safety: If a payment is extorted to remove an immediate threat to health or safety, the employee must comply to stay safe, then report within 24 hours to Compliance and record fully (amount, recipient, circumstances). (Note: FCPA's exception is narrow; relying on it is discouraged and may breach local law.) (Department of Justice)

7) Charitable & political contributions; sponsorships; community investments

• Prohibited where intended to influence a decision or requested by/for the benefit of a public official.
• All such payments require due diligence (recipient identity/beneficial owners, link to any official, purpose, need), written agreement, and public disclosure where feasible.
• Corporate political contributions are prohibited unless expressly permitted by law and approved by Legal/Compliance in writing. (GOV.UK)

8) Conflicts of interest

Employees must disclose personal, financial, or family interests that could influence business decisions. Compliance will determine mitigation (recusal, divestment, or reassignment).

9) Third‑party management (agents, distributors, customs brokers, consultants, lobbyists, JV partners)

Because organizations are liable for associated persons, the Order applies a risk‑based lifecycle: screening → due diligence → contracting → training → controls → monitoring → renewal/termination. (UK Legislation)

Minimum requirements

• Risk rating (country, sector, role, government touchpoints, compensation type).
• Due diligence: identity & beneficial ownership, sanctions/adverse media checks, references; when high‑risk, enhanced checks and in‑person interviews.
• Contractual protections: ABAC reps/warranties, audit rights, books‑and‑records clause, right to terminate for breach, no success‑based commissions in government‑facing roles without CCO approval.
• Payment controls: pay only against detailed, verifiable invoices; no cash; bank accounts in the name/country of performance; split‑invoicing prohibited.
• Ongoing oversight: performance reviews, spot audits, certifications, and targeted training.

10) Books, records & internal controls

• All transactions must be recorded accurately and in reasonable detail; no off‑book accounts; maintain internal accounting controls appropriate to the risks. (For SEC issuers, these are statutory obligations under Exchange Act §13(b)(2)(A)–(B).) (Legal Information Institute)
• Controls to enforce this policy include: multi‑level approvals; segregation of duties; vendor onboarding checks; G&E and donations registers; data analytics for red‑flag detection; periodic internal audit testing. (These align with DOJ expectations for effective compliance programs.) (Department of Justice)

11) Training & communications

• Mandatory onboarding within 30 days; annual refresher thereafter.
• Enhanced training for high‑risk roles (sales, procurement, government relations, logistics, finance) and for high‑risk third parties.
• Track completions and comprehension; repeat until passed. (DOJ ECCP looks at design, implementation, and effectiveness.) (Department of Justice)

12) Speak‑up, reporting & non‑retaliation

• Report concerns to [hotline / email / portal]. Anonymous reports are permitted where lawful.
• The Order prohibits retaliation against anyone who raises a concern in good faith. All reports are assessed promptly and investigated under Legal/Compliance oversight; confidentiality is protected consistent with law and due process.

13) Investigations & discipline

• Employees must cooperate with internal investigations. Obstruction, destruction of records, or false statements are policy violations (and may breach law).
• Violations may result in disciplinary action up to termination, termination of third‑party relationships, disclosure to authorities, restitution, and other remedies permitted by law. (UKBA and FCPA impose serious criminal/civil penalties.) (UK Legislation)

14) Mergers, acquisitions & joint ventures

• Pre‑acquisition due diligence for bribery/corruption risks; contractual protections; 100‑day integration (policy roll‑out, training, controls, remediation, and audit) after closing. (OECD/DOJ emphasize risk‑based M&A diligence and post‑deal integration.) (Department of Justice)

15) Governance, monitoring & review

• CCO owns this policy, reports at least quarterly to the Audit/Compliance Committee.
• Annual risk assessment and program review, including testing of controls and improvements based on incident learnings. (Consistent with UK MoJ Principle 6 and DOJ ECCP.) (GOV.UK)

16) Exceptions

No exceptions to this policy except the safety‑of‑life scenario described above; any such exception must be reported immediately and documented.

---

Quick‑use appendices

Appendix A — Gifts/Hospitality quick matrix

Scenario	Allowed?	Pre‑approval	Documentation
Coffee/working meal with private‑sector customer (<US$50/£40)	Yes if legitimate business purpose	No	Receipt + entry in G&E Register
Logo pen or notebook to public official	Yes if nominal	No (unless local addendum requires)	Entry in G&E Register
Match tickets/travel for public official	No (unless directly related to legitimate demo/training and pre‑approved)	CCO approval	Agenda, invite list, receipts, register
Cash/gift cards to anyone	Never	—	—

(UK guidance stresses "reasonable and proportionate" hospitality; anything intended to influence is prohibited.) (GOV.UK)

Appendix B — Common red flags

• Requests for unusual commissions, success fees, or payment in cash/offshore accounts.
• Third party lacks experience, is suggested by a public official, or refuses audit clauses.
• Excessive G&E, travel unrelated to business, family members invited, side trips.
• Vague scopes, over‑invoicing, or split invoices; pressure to speed approvals.
• Frequent interaction with customs, licensing, or procurement officials in high‑risk countries.

(These reflect patterns highlighted across UKBA/FCPA guidance.) (SEC)

Appendix C — Third‑party due diligence (DD) checklist (risk‑based)

1. Identity/beneficial ownership; sanctions & adverse media; litigation; government links.
2. Business need, capability, commercial rationale; references.
3. Compensation structure (no success fee for government‑facing roles unless CCO approves).
4. Contractual ABAC clauses & audit rights; training commitment.
5. Post‑onboarding monitoring plan and renewal cadence. (GOV.UK)

Appendix D — Accounting & control reminders (for Finance)

• Record transactions accurately and in reasonable detail; prohibit side‑letters/off‑book arrangements.
• Maintain controls for approvals, vendor setup, G&E, donations/sponsorships, and third‑party payments.
• Periodically test and document control effectiveness (SEC §13(b)(2) standards for issuers; good practice for others). (Legal Information Institute)

Appendix E — Required minimum trainings

• All staff: annual ABAC fundamentals (policy, reporting channels).
• High‑risk teams: scenario‑based modules (G&E, third‑party oversight, customs/government interactions).
• Third parties (high risk): annual certification + targeted training. (Tracked to satisfy "communication & training" under UK MoJ and DOJ ECCP expectations.) (GOV.UK)

---

Country addenda (templates to localize)

Create short addenda for each country where the Order operates to address:

• Local definitions of "public official," gift taxes/limits, and lobbying rules.
• Any stricter local law (e.g., UK: no facilitation payments; strict corporate "failure to prevent" liability and "adequate procedures" defense). (GOV.UK)
• U.S.: FCPA's accounting provisions for SEC issuers; narrow facilitating‑payments exception under anti‑bribery (still prohibited by this policy). (Legal Information Institute)

---

Implementation checklist (90 days)

1. Board & CEO endorsement memo ("tone from the top").
2. Risk assessment (business lines, geographies, government touchpoints).
3. Stand up G&E and Donations/Sponsorships Registers and a single intake form.
4. Launch third‑party DD workflow (risk tiering, questionnaires, screening tools).
5. Train employees and high‑risk third parties; track completion.
6. Configure financial controls (vendor onboarding, approval thresholds, audit flags).
7. Establish speak‑up channels and investigation SOPs; anti‑retaliation notice.
8. Define metrics (training rates, DD cycle time, exception rates, hotline KPIs) and a quarterly report to the Audit/Compliance Committee. (All consistent with UK MoJ Principle 6 and DOJ ECCP.) (GOV.UK)

---

Why this policy maps to the law

• UK Bribery Act 2010: Addresses s.1–2 (bribing/being bribed), s.6 (bribing foreign public officials), and s.7 (failure to prevent bribery by associated persons); embeds the six "adequate procedures" principles; recognizes no facilitation‑payments exemption; notes penalties and extraterritorial reach. (GOV.UK)

• U.S. FCPA: Covers anti‑bribery prohibitions and the books‑and‑records / internal controls provisions (Exchange Act §13(b)(2)); acknowledges the narrow facilitating‑payments exception and reasonable and bona fide promotional/contract‑related expenses; emphasizes accurate records and effective controls. (Legal Information Institute)

• OECD/UNCAC: Aligns with international norms emphasizing preventive measures, criminalization, cooperation, and asset recovery; promotes risk‑based controls and due diligence. (Department of Justice)

---

Ready-to-use templates

1. Employee annual ABAC certification (one page)

"I certify that I have read the Order's ABAC Policy, completed required training, disclosed any conflicts, recorded all gifts/hospitality provided or received, and will promptly report suspected violations. Signature / Date."

2. G&E pre‑approval form (for public officials or anything above thresholds)

Purpose, attendee list & roles, agenda, estimated value per attendee, funding source, business rationale, confirming no family/side trips, approvals (Line Manager, Finance, CCO), and commitment to log all expenses.

3. Third‑party DD questionnaire (short form)

Legal name, ownership, government ties, services, geographies, references, compensation/terms, prior compliance issues, acceptance of audit/ABAC clauses, training commitment.

---

Key sources used for this policy

• UK MoJ Bribery Act Guidance incl. six principles; last updated Jan 22, 2025. (GOV.UK)
• Bribery Act 2010 (sections 6–8 & 11) and explanatory notes (associated persons; penalties). (UK Legislation)
• DOJ/SEC FCPA Resource Guide and SEC §13(b) materials (books & records; internal controls). (SEC)
• DOJ Evaluation of Corporate Compliance Programs (latest public version). (Department of Justice)
• UNCAC & OECD Good Practice Guidance. (UNODC)
• FCPA facilitation‑payments exception (narrow) vs. UKBA prohibition. (Department of Justice)

---

References