US enforcement risk is mainly federal: the Department of Justice and SEC enforce the Foreign Corrupt Practices Act, and Treasury's OFAC enforces sanctions. FCPA enforcement was paused and refocused in 2025 but the law has not changed. Federal prosecutors reward self-reporting, cooperation and an effective compliance programme, and whistleblower award programmes increase the chance that misconduct reaches the government.
FCPA: refocused, not repealed
In February 2025 Executive Order 14209 paused new FCPA cases while the Attorney General reviewed enforcement policy. Guidelines issued on 9 June 2025 now steer Department of Justice enforcement towards bribery linked to cartels and transnational criminal organisations, conduct that harms US competitors, national security threats and serious misconduct such as large bribes and concealment. Every new case needs senior approval.
The statute itself, including its anti-bribery and accounting provisions, remains in force. A narrower enforcement focus does not make past or future misconduct lawful, and foreign authorities may act where US prosecutors do not. Companies should keep anti-bribery controls in place and document risk-based decisions.123
Self-disclosure, cooperation and whistle-blowers
The Department of Justice's department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy offers a declination to companies that self-report, cooperate fully, remediate and have no aggravating circumstances, although disgorgement and restitution must still be paid. Companies that fall just short can obtain a non-prosecution agreement without a monitor and a 50% to 75% fine reduction.
The Corporate Whistleblower Awards Pilot Program pays whistle-blowers a share of forfeited assets for tips on foreign corruption, sanctions breaches, trade and customs fraud and other areas. A company that receives an internal report can still qualify for a declination if it self-reports within 120 days and before the Department contacts it, so internal reporting channels and fast triage matter.456
OFAC sanctions
OFAC administers country-based and list-based sanctions. Entities owned 50 percent or more, in aggregate, by blocked persons are blocked even if they are not listed, so screening must look through ownership chains, not just names.
When OFAC sets penalties it weighs the adequacy of the company's risk-based compliance programme, and voluntary self-disclosure halves the base penalty. A documented screening and escalation process is therefore both a preventive control and a mitigating factor.789
| Situation | Expected outcome |
|---|---|
| Self-disclosure, full cooperation, remediation, no aggravating circumstances | Declination; disgorgement and restitution still payable |
| Self-disclosure with aggravating factors or a near miss | Non-prosecution agreement under three years, no monitor, 50% to 75% off low end of fine range |
| All other cases | Reduction of no more than 50% off the fine |
Documents usually needed
- Anti-bribery and corruption policy covering FCPA accounting and internal control requirements
- Sanctions screening procedure including 50 percent ownership look-through
- Third-party due diligence records for agents, distributors and joint venture partners
- Internal whistle-blowing and investigation procedure with escalation timelines
- Board-level compliance reporting and risk assessment
Common mistakes
- Treating the 2025 FCPA pause as repeal; the statute and its accounting provisions remain in force.
- Screening only names against the SDN list and missing entities owned 50 percent or more by blocked persons.
- Letting internal whistle-blower reports sit; the 120-day self-reporting window is short.
- Assuming non-US companies are outside US reach; dealings in US dollars, through US persons or with US-listed status can bring them in.
- Running a paper compliance programme that would not count as adequate in an OFAC or Department of Justice assessment.
When the business crosses borders
- Foreign companies should check whether their transactions involve US persons, US dollar payments or US-origin goods, since these are common routes by which US sanctions reach non-US business; jurisdictional reach was not source-checked here.
- The FCPA accounting provisions apply to SEC-registered issuers, including foreign companies with US listings.
- Bribery not pursued in the United States may still be prosecuted under the laws of other countries, such as the UK Bribery Act.
Questions businesses ask
Is the FCPA still enforced?
Yes, but more selectively. Since June 2025 the Department of Justice prioritises cases linked to cartels, harm to US competitors, national security and serious misconduct, and each new case needs senior approval. The law itself has not changed.123
What does a company gain by self-reporting?
Under the Department of Justice policy, a company that self-reports, cooperates, remediates and has no aggravating circumstances can receive a declination, though it must pay disgorgement. OFAC also halves the base penalty for voluntary self-disclosure.49
Is a company owned by a sanctioned person automatically sanctioned?
If one or more blocked persons own 50 percent or more of it in aggregate, directly or indirectly, it is treated as blocked under OFAC's 50 percent rule.8
What this guide does not yet confirm
These points need checking with a qualified local professional in the United States before you rely on them.
- SEC civil enforcement policy on the FCPA after Executive Order 14209 was not source-checked.
- The Foreign Extortion Prevention Act (demand-side bribery) was not source-checked.
- OFAC's extended ten-year statute of limitations (2024) and whether OFAC liability is strict was not confirmed on an official page.
- Bank Secrecy Act anti-money-laundering programme rules for non-bank businesses were not reviewed.
- Export controls, including the status of the Commerce Department's affiliates rule, belong to the trade area and were not reviewed here.
- State-level anti-corruption and corporate governance rules, Sarbanes-Oxley duties for listed companies and SEC whistle-blower rules were not reviewed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Executive Order 14209, signed on 10 February 2025, directed the Attorney General to review FCPA enforcement policy for 180 days, not to start new FCPA investigations or enforcement actions without an individual exception, and to issue updated guidelines; it did not repeal the Foreign Corrupt Practices Act. Federal. The FCPA (15 USC 78dd-1 and following) remains law, and its statute of limitations is unaffected by the order.
The point about the statute of limitations is our reading; the order does not mention it.
Under Department of Justice guidelines of 9 June 2025, FCPA enforcement prioritises misconduct linked to cartels and transnational criminal organisations, conduct that harms identifiable US companies' ability to compete, threats to national security, and serious misconduct such as large bribes or sophisticated concealment, rather than routine or low-value business courtesies. Federal; Department of Justice criminal enforcement. The factors are not exhaustive. The guidelines do not bind the SEC's civil enforcement of the FCPA accounting provisions; this was not confirmed on the source.
SEC position not checked.
Every new FCPA investigation or enforcement action must be authorised by the Assistant Attorney General for the Criminal Division or a more senior Department of Justice official. Federal; Department of Justice.
Under the Department of Justice's department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy, the Department will decline to prosecute a company that voluntarily self-discloses, fully cooperates, remediates in a timely and appropriate way and has no aggravating circumstances, but the company must pay all disgorgement or forfeiture and restitution. Federal; all corporate criminal matters handled by the Department except antitrust violations under 15 USC 1-38. Declinations are made public.
The 10 March 2026 date comes from the link label on the Criminal Division corporate enforcement page; the policy document itself shows no date.
Where a company self-reports but does not qualify for a declination, or aggravating factors exist, the department-wide policy provides for a non-prosecution agreement of under three years, no independent compliance monitor and a fine reduction of 50% to 75% off the low end of the US Sentencing Guidelines range, absent particularly egregious or multiple aggravating factors. Federal; Department of Justice. In other cases the reduction is capped at 50%.
The Department of Justice Corporate Whistleblower Awards Pilot Program pays eligible whistleblowers a share of forfeited assets for original information on corporate misconduct in areas including foreign corruption, sanctions violations, and trade, tariff and customs fraud; a company that self-reports within 120 days of an internal whistleblower report, and before the Department contacts it, may still qualify for a declination. Federal; Department of Justice Criminal Division. Awards are discretionary. Programme guidance was updated in July 2026.
The Office of Foreign Assets Control (OFAC), part of the US Treasury, administers and enforces US economic and trade sanctions, using asset blocking and trade restrictions against targeted countries, regimes and persons. Federal. Programmes include Russia-related, Iran, North Korea, Cuba, Venezuela-related, counter-narcotics and cyber-related sanctions.
Under OFAC's 50 percent rule, entities owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons are themselves treated as blocked, even if not named on the sanctions list. Federal; OFAC programmes. Indirect ownership through other entities counts. Control without majority ownership is not captured by the rule but can still create risk.
Only the question text and opening of FAQ 401 were visible on the index page; the full FAQ page could not yet be checked. The point on control is general knowledge, not from the page.
OFAC's Economic Sanctions Enforcement Guidelines treat the existence and adequacy of a risk-based OFAC compliance programme as a general factor in penalty decisions, and voluntary self-disclosure halves the base penalty amount. Federal. In non-egregious cases with self-disclosure the base is one half of the transaction value (subject to a cap); in egregious cases, one half of the statutory maximum.
Regulatory text read on the Cornell Legal Information Institute reproduction of the Code of Federal Regulations; the eCFR at ecfr.gov is the government version. The cap figure shown on the page may be out of date and is not repeated here.
Questions on this topic
9 statements on anti-bribery, sanctions and corporate compliance in the United States
