India's Prevention of Corruption Act makes it a crime to give an undue advantage to a public servant and, since 26 July 2018, makes a commercial organisation liable to a fine when anyone performing services for it bribes a public servant to win or keep business; foreign companies doing business in India are covered, and having adequate procedures is a defence. The Prevention of Money-laundering Act sets the money-laundering offence and places record-keeping, due diligence and reporting duties on banks, financial institutions, intermediaries and designated businesses, supervised by FIU-IND. Corporate governance duties, CSR spending under section 135 of the Companies Act, whistle-blowing and sanctions could not yet be confirmed from official sources.
Bribery of public servants and the corporate offence
Giving or promising an undue advantage, meaning any gratification other than legal remuneration, to induce or reward a public servant's improper performance of a public duty is punishable with up to seven years' imprisonment, a fine or both. A person compelled to pay is not liable if they report it to the authorities within seven days.
Under section 9, a commercial organisation is liable to a fine if any person associated with it, which means anyone performing services for or on its behalf, bribes a public servant to obtain or retain business or a business advantage for it. The definition reaches companies and partnerships formed outside India that carry on any part of their business in India, so a foreign parent's Indian sales activity can bring it within the offence. Directors and officers who consented to or connived in the offence face three to seven years' imprisonment.
The only statutory defence is that the organisation had adequate procedures in place in line with guidelines the Central Government is to prescribe. Because those guidelines were not confirmed, businesses should build controls around agents, distributors, customs brokers and licensing consultants that can be evidenced, rather than waiting for a prescribed template.123456
Money laundering and reporting entities
Money-laundering is punishable with rigorous imprisonment of three to seven years and a fine, up to ten years where the proceeds relate to certain scheduled offences. Reporting duties apply only to reporting entities: banks, financial institutions, intermediaries and designated businesses and professions such as casinos, notified real estate agents and dealers in precious metals and stones. Most operating companies are not reporting entities themselves but will meet these rules as customers of their bank.
A reporting entity must verify clients and beneficial owners, keep transaction and identity records for five years and report to FIU-IND, including monthly reports of cash transactions over Rs 10 lakh and cross-border wire transfers over Rs 5 lakh, and all suspicious transactions. For companies, a beneficial owner is anyone with more than 10% of shares, capital or profits. FIU-IND can fine an entity or its designated director Rs 10,000 to Rs 1 lakh for each failure. Banks apply these rules through the RBI's Know Your Customer Directions, which is why onboarding in India asks for detailed ownership information.7891011121314
Other regulatory penalty exposures
Several large statutory penalties arise outside criminal law. The Data Protection Board will be able to impose penalties of up to Rs 250 crore per breach for security failures once the DPDP Act's core obligations apply from 13 May 2027, and closing a notifiable deal before Competition Commission of India approval can cost up to 1% of turnover, assets or deal value. CERT-In's cyber security directions and the RBI's payment-data localisation rule already apply.
These exposures sit with different regulators on different timetables, so an India compliance programme should map each obligation to an owner, a regulator and a reporting deadline.15161718
| Rule | Who it applies to | Consequence |
|---|---|---|
| Bribing a public servant (PCA s.8) | Any person | Up to 7 years' imprisonment, fine or both |
| Failure to prevent bribery by associated persons (PCA s.9) | Commercial organisations, including foreign bodies doing business in India | Fine; adequate-procedures defence |
| Officer consent or connivance (PCA s.10) | Directors, managers, secretaries, other officers | 3 to 7 years' imprisonment and fine |
| Money-laundering (PMLA ss.3-4) | Any person | 3 to 7 years' rigorous imprisonment and fine (up to 10 years in some cases) |
| Reporting failures (PMLA s.13) | Reporting entities, designated directors, employees | Rs 10,000 to Rs 1 lakh per failure |
How it works, step by step
- Map every agent, distributor, consultant and other person performing services for the business in India and assess bribery risk35Internal compliance (Prevention of Corruption Act 1988, section 9)
- Document adequate procedures: policy, due diligence, contract clauses, training, monitoring and reporting channels4Internal compliance
- Check whether any group entity is a PMLA reporting entity and, if so, register with FIU-IND and appoint a designated director and principal officer813FIU-IND
- Prepare beneficial ownership information above the 10% threshold for bank onboarding1214Bank (RBI KYC Directions; PML Rules)
No timings or fees are shown unless an official source states them.
Documents usually needed
- Anti-bribery policy and third-party due diligence procedures evidencing adequate procedures under section 9
- Register of associated persons (agents, distributors, consultants) with due diligence records
- Beneficial ownership chart down to natural persons holding more than 10%
- AML programme, FIU-IND registration and designated director and principal officer details, where the entity is a reporting entity
- Incident response plan covering CERT-In reporting and, from 2027, Data Protection Board notification
Common mistakes
- Assuming a foreign parent is outside Indian anti-bribery law because it is incorporated abroad; section 9 covers foreign bodies carrying on any part of their business in India.
- Treating payments through agents or consultants as the agent's problem; the corporate offence turns on bribes by any person performing services on the organisation's behalf.
- Relying on an unadapted global policy without records that show the procedures operate in India.
- Under-preparing for bank onboarding by not mapping beneficial owners above 10%.
- Treating data protection and cyber incident reporting as IT issues rather than board-level risks with large penalties.
When the business crosses borders
- Foreign companies doing business in India can be liable under section 9 for bribes paid in India by their agents, alongside their home-country anti-bribery laws; controls should satisfy both.
- Cross-border wire transfers above Rs 5 lakh into or out of India are reported to FIU-IND by the reporting entity handling them.
- Penalty exposures under the DPDP Act and Competition Act can arise from activity outside India that affects India.
Questions businesses ask
Can a foreign company be prosecuted in India for a bribe paid by its Indian distributor?
It can be liable to a fine under section 9 of the Prevention of Corruption Act if it carries on business in India and the distributor was performing services on its behalf when it bribed a public servant to obtain or retain business for it. Having adequate procedures is a defence.345
Is there a fixed maximum fine for the corporate bribery offence?
Section 9 provides for a fine without stating a cap in the provisions checked here. Individual officers who consented or connived face three to seven years' imprisonment.36
Does an ordinary trading company have to file reports with FIU-IND?
Only reporting entities have PMLA reporting duties: banks, financial institutions, intermediaries and designated businesses and professions. Most trading companies are not, but their banks will apply due diligence and reporting rules to them.89
What this guide does not yet confirm
These points need checking with a qualified local professional in India before you rely on them.
- Whether the Central Government has prescribed the section 9(5) guidelines on adequate procedures was not confirmed.
- PMLA text was checked on FIU-IND's consolidated page, which references amendments only up to 2019; any later amendment, and the current list of notified designated businesses and professions, were not checked.
- Sanctions: India's implementation of United Nations Security Council sanctions and any autonomous measures were not verified.
- Corporate governance: directors' duties, CSR applicability thresholds and spending under section 135 and the vigil mechanism under section 177 of the Companies Act 2013 could not yet be checked on an official page (India Code text was truncated and MCA and the CSR portal could not be fetched).
- Whistle-blowing: the CVC's public interest disclosure regime and the status of the Whistle Blowers Protection Act 2014 were not verified.
- Criminal law: the Bharatiya Nyaya Sanhita 2023 and its effect on corporate fraud offences were not verified.
- Mandatory insurance (for example public liability and employee-related cover) was not verified.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Giving or promising an undue advantage to another person with the intention of inducing or rewarding a public servant's improper performance of a public duty is an offence punishable with imprisonment of up to seven years, a fine, or both. Section 8, Prevention of Corruption Act 1988, as substituted in 2018. 'Undue advantage' means any gratification other than legal remuneration (section 2(d)). Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018.
The bribe-giving offence does not apply to a person who was compelled to give the undue advantage, provided that person reports the matter to the law enforcement authority or investigating agency within seven days of giving it. First and second provisos to section 8(1), Prevention of Corruption Act 1988. A separate exception covers a person acting after informing an investigating agency in order to assist its investigation. Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018.
A commercial organisation is punishable with a fine if any person associated with it gives or promises an undue advantage to a public servant intending to obtain or retain business, or an advantage in the conduct of business, for the organisation. Section 9(1), Prevention of Corruption Act 1988. An associated person is anyone who performs services for or on behalf of the organisation. Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018.
It is a defence for a commercial organisation to prove that it had adequate procedures in place, in compliance with guidelines prescribed by the Central Government, to prevent persons associated with it from such conduct. Section 9, Prevention of Corruption Act 1988; section 9(5) requires the Central Government to prescribe the guidelines after consulting stakeholders. Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018. Whether the section 9(5) guidelines have been prescribed was not confirmed.
For the corporate bribery offence, a commercial organisation includes a body incorporated outside India, or a partnership or association formed outside India, that carries on a business or part of a business in any part of India. Section 9(3), Prevention of Corruption Act 1988; bodies incorporated or formed in India are covered whether they carry on business in India or outside India. Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018.
Where a corporate bribery offence is proved to have been committed with the consent or connivance of a director, manager, secretary or other officer, that officer is punishable with imprisonment of three to seven years and a fine. Section 10, Prevention of Corruption Act 1988. Central law.
Text as on 21 May 2025; sections 7 to 10 as substituted by Act 16 of 2018 with effect from 26 July 2018.
Money-laundering under the PMLA is punishable with rigorous imprisonment of three to seven years and a fine, rising to a maximum of ten years where the proceeds relate to an offence under paragraph 2 of Part A of the Schedule. Sections 3 and 4, Prevention of Money-laundering Act 2002. The offence covers any process or activity connected with proceeds of crime, including concealment, possession, acquisition or use. Central law.
FIU-IND's consolidated text; the latest amendment it references is Act 23 of 2019. Later amendments, if any, were not checked.
Reporting entities under the PMLA are banking companies, financial institutions, intermediaries and persons carrying on a designated business or profession, which include casino operators, real estate agents and dealers in precious metals, precious stones and other high value goods as notified by the Central Government. Sections 2(1)(wa) and 2(1)(sa), Prevention of Money-laundering Act 2002; the Central Government may designate further activities by notification. Central law.
FIU-IND's consolidated text; the latest amendment it references is Act 23 of 2019. Later amendments, if any, were not checked. The full list of notified designated businesses and professions was not checked.
A reporting entity must verify the identity of its clients and beneficial owners, keep records of transactions and identity documents, furnish prescribed transaction information to the Director of FIU-IND, and keep transaction records for five years from the date of the transaction. Sections 11A and 12, Prevention of Money-laundering Act 2002. Central law.
FIU-IND's consolidated text; the latest amendment it references is Act 23 of 2019. Later amendments, if any, were not checked.
The Director of FIU-IND may fine a reporting entity, its designated director or any of its employees between Rs 10,000 and Rs 1 lakh for each failure to comply with PMLA reporting obligations. Section 13(2)(d), Prevention of Money-laundering Act 2002. Central law.
FIU-IND's consolidated text; the latest amendment it references is Act 23 of 2019. Later amendments, if any, were not checked.
Reporting entities must record and report to FIU-IND all cash transactions of more than Rs 10 lakh, all cross-border wire transfers of more than Rs 5 lakh where the origin or destination is in India, and all suspicious transactions whether or not in cash; monthly reports are due by the 15th day of the following month. Rules 3 and 8, PML (Maintenance of Records) Rules 2005, as amended up to the Third Amendment Rules 2023. Central rule. Suspicious transactions are reported promptly under Rule 8(2), not in the monthly report.
The rules text says suspicious transactions must be furnished promptly; FIU-IND's FAQs state not later than seven working days after being satisfied that a transaction is suspicious.
For client due diligence, a beneficial owner of a company is a natural person who, alone or with others, has a controlling ownership interest of more than 10% of the shares, capital or profits of the company. Rule 9(3)(a), PML (Maintenance of Records) Rules 2005; partnerships also use 10% and unincorporated associations 15%. Central rule.
Other limbs of the definition (control through other means, senior managing official) were not checked.
FIU-IND, set up by the Government of India in November 2004, is the central national agency that receives, processes, analyses and disseminates information on suspect financial transactions, and reporting entities register with it through its FINnet portal. Central agency under the Ministry of Finance.
Registration point from the FAQs page; the home page also links the FINGate reporting portal.
Commercial banks apply the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, shown as updated as on 1 October 2026. Separate KYC directions apply to small finance, payments, local area, regional rural and co-operative banks. Central rule (RBI).
The listing was opened; the directions' content was not reviewed.
The Schedule to the DPDP Act sets maximum penalties of Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to notify a breach, Rs 200 crore for breaching children's data obligations, Rs 150 crore for breaching significant data fiduciary obligations and Rs 50 crore for other breaches by a Data Fiduciary. Imposed by the Data Protection Board after inquiry; penalties apply once the relevant obligations commence (13 May 2027).
Failure to notify a notifiable combination can attract a penalty of up to one per cent of the total turnover or assets, or of the value of the transaction, whichever is higher. Section 43A of the Competition Act as substituted by the Competition (Amendment) Act 2023.
The Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored in systems located only in India; processing abroad is permitted if the data is deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. RBI circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 and FAQs; applies to payment system operators, banks as operators or participants, and their third-party service providers.
FAQ page dated 26 June 2019.
CERT-In issued cyber security directions on information security practices and the reporting of cyber incidents dated 28 April 2022, effective 60 days after issue. Issued under section 70B(6) of the Information Technology Act 2000; apply to service providers, intermediaries, data centres, body corporates and government organisations. Specific reporting deadlines not confirmed from an official page.
Page loaded but showed only summary metadata (date and 60-day effect). The widely reported 6-hour incident-reporting deadline and 180-day log retention could not be confirmed on an official page; kept as research draft. Effective date computed as 60 days after 28 April 2022.
Questions on this topic
13 statements on anti-bribery, financial crime and compliance governance in India
