In most international bribery cases, the money was not paid by the company itself but by an intermediary it was paying: a commercial agent, a consultant, a business introducer, a freight forwarder or a local partner. The French Sapin II Act of 9 December 2016 requires large companies to assess these third parties before working with them. Small and medium-sized companies are not subject to that duty, but they remain exposed to the offence of bribing a foreign public official, which French law now prosecutes even where the facts took place entirely abroad. The right question is therefore not “are we in scope?” but “what will we be able to show if a contract raises questions in five years’ time?”
A Lyon engineering SME specialising in water networks, with 140 employees, has been winning contracts in two Gulf states for six years thanks to a local consultant paid an 8% commission on signed contracts. In 2026 it enters into talks with a French industrial group that wants to buy it. The buyer’s due diligence team asks for three things: the consultant’s contract, evidence of the services performed, and the list of accounts into which the commissions were paid. The contract is two pages long, no report documents the services, and part of the commissions was paid to a company registered in the United Arab Emirates that is not the consultant’s. The price negotiation changes tone.
1. What the company risks, in scope or not
Article 435-3 of the French Criminal Code punishes active bribery of a foreign public official with ten years’ imprisonment and a fine of one million euros, which may be increased to twice the proceeds of the offence. For a legal entity, the fine is multiplied by five. Since the Sapin II Act, Article 435-6-2 of the French Criminal Code allows these offences to be prosecuted when committed abroad by a French national, by a person habitually resident in France or by a person carrying on all or part of their economic activity in France, without requiring that the conduct also be an offence in the country where it took place or a prior complaint from the victim.
Using an intermediary offers no protection. A company that pays a commission knowing, or choosing not to know, that part of it will reward a public decision-maker is a principal or an accomplice. On top of this come foreign laws with extraterritorial reach, the US Foreign Corrupt Practices Act and the UK Bribery Act, which may apply as soon as a payment passes through the US financial system or a company carries on part of its business in the United Kingdom.
2. The companies subject to Article 17
Article 17 of Act No. 2016-1691 applies to companies with at least 500 employees, or belonging to a group whose parent company has its registered office in France and whose headcount reaches that threshold, where their turnover, or consolidated turnover, exceeds 100 million euros. Their managers must put in place eight measures, including a risk map and procedures to assess customers, first-tier suppliers and intermediaries against that risk map.
Compliance is monitored by the French Anti-Corruption Agency (AFA). In case of failure, its sanctions committee may impose a fine of up to 200,000 euros for individuals and one million euros for legal entities, regardless of whether any bribery actually occurred. The AFA recommendations published in the Journal officiel of 12 January 2021 set out what it expects from third-party due diligence.
For an SME, Article 17 often matters indirectly: customers that are in scope impose their own questionnaires, and a buyer that is in scope will examine the SME’s intermediaries as if they were its own.
3. Assessing an intermediary before signing
The assessment is proportionate to the risk. It covers the intermediary’s real identity and its beneficial owners, any links with public officials or with the customer’s decision-makers, its actual expertise in the sector, its reputation, its criminal record, and whether the fee requested matches the services provided. It is documented in a dated file, updated regularly.
Some signals should stop the discussion or, at the very least, justify in-depth checks: the intermediary was recommended by the public customer itself; it asks for a commission far above industry practice or for a large advance; it refuses to describe its services precisely; it wants to be paid in cash, into an account in a third country or in the name of another company; it has neither an office nor staff; it asks that its role be kept confidential from the customer or that its invoices describe something other than what it actually does; it appeared just as the contract was becoming hard to win, or just after a change of decision-maker at the customer. None of these signals is proof. Taken together, they draw the typical profile of the cases that end up before the French national financial prosecutor (parquet national financier).
4. The contract with the intermediary
The contract is the first document anyone will ask for, whether the judge, the AFA or the buyer. It describes the expected services precisely and requires evidence of them, through periodic reports, minutes of meetings, identifiable deliverables. It sets a fee consistent with those services, payable only into an account in the intermediary’s name, in the country where it operates, against an invoice. It contains a precise anti-bribery undertaking, with a ban on any subcontracting or payment to a third party without written consent, a right of audit, a duty to disclose any link with a public official, and a right to terminate immediately without compensation in case of breach.
The governing law also needs thought. A commercial agency contract governed by the law of an EU Member State gives rise to an end-of-contract indemnity that a termination-for-breach clause does not always exclude (international commercial agents and termination indemnity).
5. Paying and monitoring over time
The initial assessment is not enough. Each payment must be matched against the services provided, and any request to change the payment terms triggers a fresh check. Success fees, paid when a public contract is signed, deserve particular attention, because this is the pattern in which money can most easily flow back to a decision-maker without leaving any paper trail in the French company, which sees only a consultancy invoice and a wire transfer, and which sometimes discovers years later, during a foreign investigation or an acquisition audit, that the receiving company belonged to a relative of a member of the tender committee.
6. When a problem comes to light
If questionable payments are discovered, for example during due diligence, the company must stop pending payments, preserve the documents and conduct a properly supervised internal investigation. Depending on the findings, it may consider approaching the national financial prosecutor. The judicial public interest agreement (convention judiciaire d’intérêt public), provided for by Article 41-1-2 of the French Code of Criminal Procedure, allows a legal entity to avoid a conviction in return for paying a public interest fine, capped at 30% of average turnover over the last three financial years, and implementing a compliance programme under AFA supervision. The prosecutor’s guidelines reward self-reporting and cooperation.
In the end, the Lyon SME was not bought by that group. It revised its intermediary contracts, stopped working with the Emirati company and commissioned an internal audit. The sale went through eighteen months later, with another buyer and a specific indemnity covering liabilities.
Keeping your export intermediaries in check
The firm drafts contracts with international agents and consultants, designs third-party due diligence procedures suited to the size of the company, and assists managers when difficulties arise. See our international contract and business law pages. For an initial discussion, use the contact page.
Further reading: Exclusive distribution abroad: what your agreement must lock down.
Frequently asked questions
Does an SME have to comply with the Sapin II Act?
The duty to put in place an anti-bribery programme under Article 17 applies only to companies with at least 500 employees and turnover above 100 million euros. An SME nevertheless remains exposed to the offence of bribing a foreign public official, and customers that are in scope often impose their own checks on it.
What is third-party due diligence?
It is the procedure, provided for by Article 17, used to assess the bribery risk posed by a customer, a first-tier supplier or an intermediary before entering into a relationship, and then throughout the relationship.
Is a high commission illegal?
No, but it must correspond to real, proportionate and documented services. A commission far above industry practice, without justification, is one of the main red flags.
Can France prosecute bribery committed entirely abroad?
Yes. Article 435-6-2 of the French Criminal Code allows prosecution of offences committed abroad by a French national, a habitual resident or a person carrying on an economic activity in France, without a dual criminality requirement.
What should we do if we discover suspicious payments?
Suspend the payments, preserve the documents and conduct an internal investigation supervised by a lawyer. Depending on its findings, approaching the national financial prosecutor with a view to a judicial public interest agreement may be considered.
On the same subject: exporting from France in 2026, the legal checklist before signing, exporter disputes, six situations, six answers and OFAC and the extraterritorial reach of US law.