Anti Bribery Policy Template: Gift, Vendor, and Reporting Rules

The security questionnaire from a prospective enterprise customer is nearly done. One line is left, a plain yes or no: "Do you maintain an anti-bribery and anti-corruption policy?" Procurement is waiting, and the honest answer today is "we have a code of conduct."

That is the gap an anti bribery policy template closes. You need a real document you can adopt this week, not a paragraph of principles.

An anti-bribery policy is a written rule set that bans offering, paying, requesting, or accepting anything of value to improperly influence a decision, and sets the controls that back the ban: gift and hospitality limits, third-party vetting, accurate records, training, and a reporting channel. A good anti bribery and corruption policy fits on a few pages, names an owner, and produces evidence you can hand to a buyer or an auditor.

One honest scope note: for most early-stage SaaS companies, the exposure is not routine domestic sales. It comes through enterprise buyer questionnaires, foreign resellers and agents, government customers, and sponsorships. The policy is built for those.

By the end of this guide, you will have a free, ungated template with real sample clauses, a gift-limit decision table, a third-party red-flag procedure, and the evidence list buyers and auditors sample.

Here's what I'll cover:

• What an anti-bribery policy is, and how it differs from your code of conduct
• What an anti bribery policy template must include, section by section
• How to set gift and hospitality limits your team can follow
• How to vet resellers, agents, and consultants
• What the FCPA and the UK Bribery Act expect
• Where SOC 2, ISO 27001, ISO 37001, and SOX fit
• A free downloadable template, sample clauses, and four startup scenarios

What Is an Anti Bribery Policy Template, and What Does It Not Cover?

An anti bribery policy template is a ready-to-adapt document that tells everyone acting for your company what counts as a bribe, what they must never do, and what to do when someone asks. It sets the rules. The gift register, the partner files, and the training logs show the rules working.

Plain terms help here, because a bribe is not always cash:

• Bribery is offering, giving, requesting, or accepting something of value to improperly influence a decision.
• Corruption is the wider abuse of a position for private gain, and bribery is its most common form.
• A facilitation payment is a small payment to speed up a routine government action, such as processing a permit.
• A gift becomes a bribe when it is given to influence a decision. Value matters, but intent and timing matter more.

Anti Corruption Policy Template vs Code of Conduct, Whistleblower, and Third-Party Risk Policies

Several of your policies already touch bribery, so it helps to know who owns what. The code of conduct policy sets behavior standards and lists anti-bribery only as an optional section. This article is the standalone policy a buyer asks for by name.

The reporting section here links to the full treatment in our whistleblower policy template, which covers how concerns are raised and protected. The third-party risk management policy covers vendor risk broadly. This policy covers bribery-specific vetting of the people who act for you.

Anti Bribery Policy for Startups: Why You Need One Before the Next Enterprise Deal

Three groups ask for the written policy, usually in this order:

• Enterprise buyers, through security and vendor questionnaires that include an anti-bribery line.
• Auditors, who review your control environment and sample the policies you say you have.
• Your next sales or partnerships hire, who gets a request for event tickets, a sponsorship, or an unusual commission and needs a written answer.

Who is really exposed? Companies that sell to government customers, use foreign resellers or agents, or sponsor events with public officials. A US company with none of those still gets the questionnaire line, and a written policy turns a stalled deal into a quick yes.

What an Anti Bribery Policy Template Must Include

A working anti bribery policy has eight parts. Each answers a question a buyer, an auditor, or a new sales hire will eventually ask.

Anti Bribery and Corruption Policy Scope: Employees, Contractors, Agents, and Resellers

Scope is where anti-bribery policies quietly fail. A document that says "employees" and means full-time staff leaves out the people most likely to meet a bribery request: contractors, advisors, and the reseller in another country.

List the people explicitly:

• Employees, officers, and board members at every level
• Contractors, interns, and advisors who act for the company
• Agents, distributors, resellers, and consultants who represent the company or find business for it
• Anyone else acting on the company's behalf, whatever their contract says

The law cares about this, which is why the UK Bribery Act speaks of "associated persons" and why third parties get their own section below.

Prohibited Conduct in an Anti Bribery Policy Template: Bribes, Kickbacks, and Facilitation Payments

The prohibited list should read like something a new hire can apply on a bad day. Name the acts in plain language:

• Offering or paying anything of value to influence a decision, to win or keep business, or to gain an improper advantage
• Requesting or accepting a kickback, commission, or favor in return for a purchasing or hiring decision
• Making any payment through a third party that you could not make yourself
• Making facilitation payments (see the exception below)
• Making political or charitable donations to gain an advantage
• Recording any of the above as something else

On facilitation payments, the safest policy is the simplest.

SCCE's Compliance & Ethics Blog summarized advice from Alexandra Wrage, founder of TRACE International, in a podcast write-up: the simplest rule is "don't pay them, period". The two laws differ here.

The FCPA has a narrow exception for payments to expedite routine governmental action, such as processing a permit, and that exception does not cover a decision to award new business. The UK Bribery Act has no such exemption, as the Ministry of Justice guidance puts it in paragraph 45.

Write the policy to ban facilitation payments outright, with one narrow exception: a payment made to protect someone from a threat to life, limb, or liberty. The Ministry of Justice guidance recognizes that the common-law defence of duress is very likely to apply there. Anyone who pays must report it to the compliance owner the same day, and the company records it accurately.

Some people fear that a rule this strict bans normal courtesy. It does not. The DOJ and SEC FCPA Resource Guide lists the hallmarks of an appropriate gift: it is given openly and transparently, properly recorded in the giver's books and records, provided only to reflect esteem or gratitude, and permitted under local law. The next section turns those four hallmarks into a limit your team can apply.

Gifts and Hospitality Policy for Your Anti Bribery Policy Template: Setting Limits Your Team Can Follow

"Modest and infrequent" is what most templates say. Nobody can apply it at 6 p.m. when a customer offers tickets, so give your team numbers. The FCPA has no minimum threshold for a corrupt gift, and the Resource Guide notes that a modest amount in the United States can be a large and significant amount in another country, so your tiers are internal defaults, not legal safe harbors.

Four red lines apply regardless of value:

• Cash or cash equivalents, including gift cards and vouchers
• Anything during an active tender, renewal, or contract negotiation with the recipient
• Anything to a public official without written approval
• Anything hidden from the recipient's employer or off your own books

The Resource Guide also makes the point that matters most for a startup: a cup of coffee or a company-branded item of nominal value will not evidence corrupt intent. The larger and more extravagant the gift, the more likely it was given with an improper purpose. Your tiers put that sliding scale in writing.

Add a gift and hospitality register. It is one spreadsheet, and it is the first thing an auditor or a buyer's reviewer asks to see. Log:

1. Date and the name and employer of the recipient or giver
2. Description and estimated value
3. Business reason
4. Who approved it
5. Whether any decision with that person was pending

Third Party Due Diligence in an Anti Bribery Policy Template: Vetting Agents, Resellers, and Consultants

Intermediaries cause most real-world bribery cases, and the law treats their acts as yours. That is why the third-party section is the one auditors and enterprise buyers read most closely.

A Hacker News commenter in February 2024 described the temptation in plain terms: "you want a fixer that knows and bribes people where it's customary and expected". That sentence is the risk your policy exists to remove. Hire a fixer who does that, and you have hired a liability.

A third party due diligence procedure does not need to be heavy. For each partner who acts for you or finds business for you:

1. Tier the risk. Low risk is a domestic reseller with no government customers. High risk is an agent in a country with high corruption, a partner who deals with public officials, or any intermediary paid on commission.
2. Send a short questionnaire covering ownership, services, relationships with public officials, and past investigations.
3. Check ownership and public-official links. Ask who owns the company and whether any owner or director is a public official or related to one.
4. Put anti-bribery terms in the contract: a warranty that they will not bribe, a right to audit, and a right to terminate immediately for breach.
5. Define approved payments. Pay only against a written invoice for defined services, to an account in the partner's own name and country.
6. Refresh every year, and again whenever the relationship changes.

Hernan Huwyler, writing in a LinkedIn article in August 2016, put the underlying problem plainly: third parties act for you, but "their business activities are not always as transparent or controllable". Due diligence is how you buy back that transparency.

Bribery and Corruption Red Flags in Third-Party Relationships

The DOJ and SEC Resource Guide lists the common red flags associated with third parties. These bribery and corruption red flags apply to any agent, reseller, or consultant. Treat any one of them as a reason to pause and ask for an explanation before you sign or pay.

Link this process to your vendor management policy template, which covers the procurement side, and to the third-party risk management policy for the broader vendor risk program.

Anti Bribery Training and Reporting: Making the Policy Real

A policy nobody has read is a document, not a control. Training and reporting are the two parts that turn the words into behavior, and both leave records.

Anti Bribery Training: Who, How Often, and What Counts as Evidence

Keep training short and role-based. The policy should say:

• Everyone: onboarding training within the first 30 days, and an annual refresher
• Sales, partnerships, and finance: extra scenario training, because that is where the requests arrive
• Agents and resellers: a short briefing or a signed acknowledgment of the policy
• Evidence: a completion log with names and dates, plus a short scenario quiz

The security awareness training policy shows how to structure assignments and completion records. The same mechanics work for bribery.

Reporting Concerns: Channels, Non-Retaliation, and Investigation

An anti-bribery policy that says "zero tolerance" with no way to report a concern is a slogan. Set up:

• One main channel and one backup, for example the compliance owner and a named executive, plus an anonymous option if you can run one
• A no-retaliation rule, stated plainly, with discipline for anyone who retaliates
• An acknowledgment window, such as three business days
• A named investigator, with an outside reviewer when the report involves a senior person
• A record of every report and its outcome

Link the whole reporting process to your incident management policy for the steps after a report lands, and to the whistleblower policy template for the legal protections.

Anti Bribery Policy Template and the Law: FCPA, UK Bribery Act, and Where Your Policy Fits

No law says "you must have a document called an anti-bribery policy." The laws ban the conduct, and the policy is your evidence that you took reasonable steps to prevent it. Under the UK Bribery Act, that evidence can be a complete defence.

FCPA Compliance Policy: Anti Bribery and Accounting Provisions

A solid FCPA compliance policy has to cover two parts of the statute. The anti-bribery provisions apply to US companies of any size, including startups, and to US citizens, and they ban corrupt payments to foreign officials, including employees of state-owned companies. The accounting provisions require companies with SEC-registered securities to keep accurate books and records and adequate internal controls.

The penalties are set in the statute.

Under 15 U.S.C. 78dd-2, a company faces fines of up to $2 million per violation, and an individual who acts willfully faces up to five years in prison. The accounting provisions in 15 U.S.C. 78ff go further: up to $25 million for a company, and up to $5 million and 20 years for an individual. The Alternative Fines Act in 18 U.S.C. 3571 lets a court impose up to twice the gross gain or loss instead.

The books-and-records rule is the one people forget. A Hacker News commenter wrote in October 2020 about a media company where staff were told to log border bribes on expense reports as "Airport tax". That is exactly the pattern the accounting provisions exist to catch: the bribe is bad, and mislabeling it is a second violation.

On June 9, 2025, the Deputy Attorney General issued new guidelines for FCPA investigations, following an executive order that had paused enforcement. They tell prosecutors to focus on conduct with "strong indicia of corrupt intent" and not on "de minimis or low-dollar, generally accepted business courtesies." The guidelines change what prosecutors prioritize. They do not change the statute, and they create no rights that anyone can rely on.

UK Bribery Act Adequate Procedures: The Six Principles

Section 7 of the UK Bribery Act makes a commercial organization guilty of an offence if a person associated with it bribes another person to obtain or retain business or an advantage for the organization. The defence is to prove that you had adequate procedures designed to prevent bribery, and the standard of proof is the balance of probabilities. A conviction under section 7 carries an unlimited fine.

The Ministry of Justice guidance sets out six principles, and they define what UK Bribery Act adequate procedures look like in practice. Each maps to a section of this template, so the policy reads as the evidence:

Other Anti Bribery Laws to Check Before You Sell Abroad

Beyond these two, every country you sell into has its own bribery law, and some US states and countries reach private-sector bribery as well. Have counsel confirm which apply before you sign an overseas reseller or enter a government tender.

Anti Bribery Policy Requirements by Framework: SOC 2, ISO 27001, ISO 37001, and SOX

Compliance frameworks handle bribery differently, and the differences are where startups get confused. One is certifiable for it, one touches it through ethics, and two barely mention it.

Anti Bribery Policy SOC 2: Integrity and Ethical Values

Is an anti-bribery policy required for SOC 2? Not by name. The 2017 Trust Services Criteria do not mention bribery. Common Criteria CC1.1 says the entity demonstrates a commitment to integrity and ethical values, and its points of focus include defining standards of conduct, evaluating adherence to them, and addressing deviations.

Under an anti bribery policy SOC 2 audit, the code of conduct and signed acknowledgments are usually the core evidence. A standalone anti-bribery policy strengthens that evidence, and it answers the buyer's questionnaire line directly. See our SOC 2 framework page for how the criteria fit together.

ISO 37001: The Certifiable Anti-Bribery Standard

ISO 37001 is the international standard for anti-bribery management systems. The current edition is ISO 37001:2025, published in February 2025, and it replaces the 2016 edition. It covers a policy, top-management commitment, risk assessment, due diligence on business associates, financial and commercial controls, gifts and hospitality controls, and reporting.

For most early-stage companies, certification is optional and overkill. Large enterprises and government suppliers pursue it. This template gives you the same building blocks in a lighter form, and you can map it to ISO 37001 later if a customer requires certification.

SOX and Public-Company Controls

If you plan to go public, the books-and-records rules matter more. Our guide to what is SOX compliance explains the internal-controls side. In practice, accurate records of every payment, including gifts and agent commissions, are a part of both the FCPA's accounting provisions and your SOX controls.

Anti Bribery Policy Template: A Free Example You Can Download

Here is what an anti bribery policy example looks like as clauses you can adapt. Brackets mark the values to set for your own company.

Anti Bribery Policy Example: Sample Clauses You Can Adapt

Anti Bribery Policy Template Scenarios for Startups: What to Do When

Four situations your team is likely to meet, and how the policy answers each one:

• An overseas reseller asks for an advance "for local approvals." Do not wire it. Ask for an itemized invoice, pay any official fee directly to the agency, and escalate to the compliance owner. A payment with vague services behind it is a red flag.
• A customer's procurement lead asks for event tickets in the middle of an RFP. Decline politely until the decision is made. The buyer's own rules probably forbid it, and a pending decision is a red line in your policy. Offer a no-cost alternative.
• You are asked to sponsor a government-run conference. Put the sponsorship in a written agreement, pay the organizing body and not a person, and get compliance approval first. Do not pay for officials' travel or guests.
• A public official asks you to hire a relative. Do not discuss the job. Refer the request to the compliance owner before any offer. A job can count as a thing of value, and a hire that follows a request looks like a payment for a favor.

Rolling Out Your Anti Bribery Policy Template and Proving It Works

Writing the policy takes an afternoon. Rollout is where it turns into records, and records are what get sampled.

1. Name an owner, usually the CEO or the head of compliance.
2. Adapt the template, set your gift values, and remove clauses that do not fit.
3. Get leadership sign-off, because top-level commitment is part of the test.
4. Distribute and collect acknowledgments from everyone in scope.
5. Train sales, partnerships, and finance first, then everyone else.
6. Start the gift register, and screen your current agents and resellers.
7. Set an annual review date and put it in the policy.

Anti Bribery Policy Template Evidence: What Auditors and Buyers Sample

Answering Customer Questionnaires About Your Anti Bribery Policy

Anti Bribery Policy Template Mistakes to Avoid

These are easy to get wrong, and each one shows up in a buyer review or an audit:

• Copying a UK template for a US-only company without review. The two regimes differ on facilitation payments and on what counts as a defence.
• No gift register. A gift rule with no log is a rule you cannot prove.
• No third-party clause. The agent or reseller is where the real risk sits, so the policy must name them.
• "Zero tolerance" with no reporting channel. The slogan without a way to report is decoration.
• Never retraining. A signed acknowledgment from three years ago is weak evidence.
• Ignoring facilitation payments. Silence reads as permission, and the UK allows no exception.

How ComplyJet Helps You Maintain Your Anti Bribery Policy Template

A policy is quick to write and tedious to prove. The rules fit on a few pages. The proof is a year of consistent records.

ComplyJet's policy management drafts policies with AI from a library of 30+ templates mapped to SOC 2, ISO 27001, HIPAA, and GDPR, lets you edit them before publishing, distributes them to your team, and tracks acknowledgments with a timestamp and a version history. Our security awareness training assigns courses when a new hire is added through your HR integration and keeps per-person completion records.

We are not a legal advisor, and we are not a gift register or a third-party screening database. Your gift log and your partner files stay in your own tools. ComplyJet holds the policy, the acknowledgments, and the training evidence beside everything else an auditor asks for.

FAQs

What Is an Anti Bribery Policy Template?

A ready-to-adapt document that bans bribery and sets the controls behind the ban: gift limits, third-party vetting, records, training, and reporting. You fill in your own values, such as gift tiers and the compliance owner, and route it through approval and counsel review.

What Should an Anti Bribery and Corruption Policy Include?

Eight parts: a zero-tolerance statement, scope, prohibited conduct, gifts and hospitality, third parties, books and records, training and acknowledgment, and reporting with enforcement. Add a gift register and a third-party procedure so the policy produces evidence.

Is an Anti Bribery Policy Required for SOC 2?

Not by name. The SOC 2 criteria do not mention bribery, but CC1.1 expects a commitment to integrity and ethical values, usually shown through a code of conduct and signed acknowledgments. Enterprise questionnaires often ask about anti-bribery separately, so a written policy is the practical answer.

What Is the Difference Between a Bribe and a Gift?

Intent and timing. A gift given openly, recorded, modest, and lawful, with no decision pending, is a courtesy. The same item given to influence a decision is a bribe, whatever it costs. The FCPA sets no minimum value for a corrupt gift.

Are Facilitation Payments Illegal?

Under the UK Bribery Act, yes, with no exception. The FCPA has a narrow exception for routine governmental action, and it does not cover decisions to award business. Most policies ban facilitation payments outright, with a single exception for threats to personal safety.

Does the FCPA Apply to a Startup?

Yes. The anti-bribery provisions apply to any US company, whatever its size, and to US citizens. The accounting provisions apply to companies with SEC-registered securities. Selling to foreign governments or using foreign agents is where startups meet it first.

Is There a Free Anti Bribery Policy Template?

Yes. The PDF above is free and ungated: eight sections, sample clauses, a gift-limit table, a third-party procedure, a red-flag checklist, and an evidence list. Adapt the bracketed values, route it through your approval process, and have counsel review it.

Related Reading

• Code of Conduct Policy, for behavior standards and reporting expectations.
• Whistleblower Policy Template, for how concerns are raised and protected.
• Third-Party Risk Management Policy, for broader vendor risk assessment.
• Vendor Management Policy Template, for procurement and vendor onboarding rules.
• Incident Management Policy, for what happens after a report.
• Security Awareness Training Policy, for assigning and recording training.
• What Is SOX Compliance, for the books-and-records and internal controls side.

Sources:

• DOJ and SEC, A Resource Guide to the U.S. Foreign Corrupt Practices Act, Second Edition
• DOJ Deputy Attorney General, Guidelines for Investigations and Enforcement of the FCPA, June 9, 2025
• 15 U.S.C. 78dd-2, domestic concerns
• 15 U.S.C. 78ff, penalties
• 18 U.S.C. 3571, sentence of fine
• UK Ministry of Justice, Bribery Act 2010 Guidance
• ISO 37001, Anti-bribery management systems
• KirkpatrickPrice, SOC 2 Academy: Points of Focus
• SCCE Compliance & Ethics Blog, Alexandra Wrage on Gifts and Facilitation Payments
• Hernan Huwyler, Components of an effective third-party due diligence program, LinkedIn, August 2016
• Hacker News comment, February 2024
• Hacker News comment, October 2020