ANTI-CORRUPTION RISKS OF OVERSEAS SUBSIDIARIES: THE NEED FOR EFFECTIVE HEADQUARTERS OVERSIGHT

I.    BACKGROUND

On August 19, 2026, the Seoul Central District Court found a former executive director of a listed Korean state-owned enterprise guilty of, among other things, contravening the Act on Combating Bribery of Foreign Public Officials in International Business Transactions (“Korean Foreign Bribery Act”).1  According to the allegations, the company and certain employees bribed foreign tax officials by paying approximately USD 55,000 through a third party in connection with a local tax investigation relating to a power plant project in Africa. The company and the individuals involved were prosecuted in November 2020.2

Separately, in August 2026, a former investment banker was convicted of violating the U.S. Foreign Corrupt Practices Act (“FCPA”) and money laundering offenses related to bribing Ghanaian government officials in connection with the development and financing of a power plant in Ghana. The scheme involved the use of personal email accounts, shell companies, false invoices, nominee accounts and cash withdrawals to circumvent the compliance measures, and to conceal and launder the bribe payments.3

Although unrelated, these cases illustrate how corruption risks arising from overseas operations (including dealings with public officials, third parties, and handling of funds) can lead to criminal liability. As Korean companies continue to expand their international operations, managing corruption risks remains a key compliance priority.

This legal update examines key corruption risks that may arise from overseas subsidiaries and, in particular, how Korean businesses should design and enhance headquarters-level oversight of overseas operations in light of domestic and international anti-corruption laws and compliance standards.

II.    KEY CONSIDERATIONS

A.    Key Anti-Corruption Risks from Overseas Subsidiaries

Anti-corruption risks in overseas operations extend beyond the conventional scenario of providing monetary or other benefits to senior government officials to secure public tenders or major projects. Such risks may arise at various points of contact with government agencies or state-owned enterprises in the ordinary course of business, as well as in transactions involving third parties, some instances of which are set out below. Companies should also be mindful of the status of their counterparties, as employees of enterprises controlled by foreign governments may, subject to the relevant statutory criteria, qualify as “foreign public officials” for the purposes of the Korean Foreign Bribery Act (Article 2(2)(c)).

• Bidding, licensing and government interactions: Providing money, benefits or other benefits to public officials to expedite procedures or obtain a favorable outcome in connection with public tenders, business rights, licenses and permits, completion inspections, tax or customs audits, or administrative measures.

• Transactions with state-owned enterprises: Providing improper benefits to personnel of state-owned enterprises in sectors such as power generation, energy, finance and transportation in connection with contracts, project approvals, financing or government guarantees.

• Use of third parties: Agents, consultants, customs brokers, tax or accounting advisors, distributors or other intermediaries interacting with government agencies on behalf of a company and passing a portion of their fees or success-based compensation to public officials.

• Accounting and managing funds: Concealing improper payments through excessive success fees, consulting fees unsupported by identifiable deliverables, payments to personal or third-country accounts, split invoices, repeated cash withdrawals, or the use of expense accounts that do not reflect the true nature of the relevant expenditure.

Third-party risks can be particularly difficult to identify because headquarters may have limited visibility into the ultimate use of funds paid to contractual counterparties and whether the relevant services were actually performed. In evaluating corporate compliance programs, the U.S. Department of Justice (“DOJ”) similarly considers whether a company applies risk-based due diligence to third-party relationships, including whether it understands the business rationale for engaging the third party, the third party’s qualifications, reputation and relationships with foreign officials, the specific services to be performed, whether those services are actually performed, and whether the third party compensation is commensurate with the services provided.4

B.    Headquarters Management and Oversight

For the purposes of fostering a mature governance structure, simply having a generic anti-corruption policy and providing staff training is unlikely to be sufficient. For activities and transactions that present heightened corruption risks, headquarters should maintain a robust risk-based compliance framework that enables the business to effectively detect and manage risks (i.e., red flags) by, for example, overseeing transactions and payments.

At a minimum, such a framework should: (i) identify key risks in relevant business practices; (ii) establish appropriate safeguards (controls) for higher-risk transactions and payments, such as approval and due diligence procedures prior to engaging high-risk third parties or transactions (including those involving public officials); and (iii) maintain reporting channels that give headquarters direct visibility into red flags, supported by periodic testing of the effectiveness of such controls designed to detect those red flags (e.g., internal audit).

Article 4 of the Korean Foreign Bribery Act provides that where a staff member bribes a foreign public official in connection with its employer’s business, the employer may also be subject to punishment, except to the extent the employer can show that it “has not been negligent in giving due attention and supervision concerning the relevant duties to prevent such an offence”. In terms of how this mechanism applies, the Korean Supreme Court confirmed that whether a corporation was negligent in exercising due care or management and supervision must be determined in light of the totality of the circumstances, including: 

• the legislative purpose of the relevant law; 
• the degree of harm expected from a violation; 
• the purpose of imposing corporate liability; 
• the specific manner and actual consequences of the violation; 
• the size of the corporation’s business; 
• the corporation’s ability to supervise the individual concerned and the nature of their reporting and supervisory relationship; and 
• the measures actually taken by the corporation to prevent violations.5

Accordingly, the key question is not whether policies exist on paper, but whether the company assessed the risks inherent in its overseas operations in advance, established practical systems and measures to manage those risks, and effectively implemented them.

Companies should therefore design compliance frameworks that allow them to demonstrate, if necessary, that they: (i) identified relevant risks in advance; (ii) clearly allocated authority and responsibility for reporting, approval and oversight; (iii) conducted appropriate due diligence, approval and monitoring of high-risk third parties and unusual payments; and (iv) ensured timely reporting, investigation and remediation when red flags arose. Companies should also retain relevant records appropriately.

C.    Potential Application of the U.S. FCPA and U.K. Bribery Act

For overseas operations, consideration of the Korean Foreign Bribery Act alone may not be sufficient. Depending on the structure of a transaction and its connections with the U.S. and the U.K., the U.S. FCPA or the U.K. Bribery Act 2010 (“UK Bribery Act”) may apply to conduct occurring outside those jurisdictions.

With respect to the U.S. FCPA, companies should first consider whether the company or any of its affiliates is listed on a U.S. securities exchange, whether its U.S. entity, employee, or agent was involved in the relevant transaction, and whether any act relating to the corrupt payment took place within the U.S. Where one or more of these jurisdictional connections is present, a Korean company may fall within the scope of the FCPA.6

A parent company does not become automatically liable merely because misconduct occurred at an overseas subsidiary. The analysis may, however, differ depending on factors such as the parent company’s direct participation in the conduct, the degree of control exercised over the subsidiary, and the parent company’s knowledge and direction of the subsidiary’s actions, both generally and in the context of the specific transaction.7

The FCPA does not provide an automatic defense merely because a company had a compliance program in place. However, whether the program was appropriately designed and effectively implemented is an important consideration in prosecution decisions, settlement terms, and the determination of penalties.8

Furthermore, in its 2025 enforcement guidelines, the DOJ stated that it would focus enforcement resources on cases involving key infrastructure and national security, as well as serious cases involving substantial bribe payments or sophisticated efforts to conceal them.9 The guilty verdict in the Ghana power plant case last month demonstrates that FCPA enforcement remains active.

With respect to the UK Bribery Act, a company incorporated or formed in the U.K., or carrying on a business or part of a business in the U.K., may fall within the scope of the statute. If an employee, agent, subsidiary or other person associated with the company bribes another person intending to obtain or retain business or an advantage in the conduct of business for the company, the company itself may incur liability for failure to prevent bribery, even where the underlying conduct occurs outside the U.K.10

A company may, however, have a defense if it can demonstrate that it had adequate procedures in place to prevent persons associated with it from engaging in bribery. U.K. government guidance identifies six principles that should inform such procedures: proportionality, top-level commitment, risk assessment, due diligence, communication (training), and monitoring and review.11

Companies should also pay particular attention to so-called “facilitation payments”. The FCPA retains a narrow exception for certain small payments intended to facilitate or expedite routine governmental action,12 while Korea removed its corresponding exception in 2014,13 and the U.K. provides no exemption for facilitation payments.14 Where the laws of multiple jurisdictions may become relevant, it is generally prudent for a global anti-corruption policy to be calibrated to the strictest applicable standard.

III.    KEY IMPLICATIONS 

Companies with active overseas operations should enhance their compliance frameworks by linking the actual business activities of their overseas subsidiaries with headquarters-level management and oversight.

A.    Headquarters’ Identification of Corruption Risks at Overseas Subsidiaries

Interactions with government agencies in connection with bidding, licensing, tax and customs matters, the use of high-risk third parties, gifts and entertainment, and unusual payments are among the key risk areas that headquarters should monitor on an ongoing basis.

Headquarters should not limit its oversight to receiving reports on an overseas subsidiary’s revenue or business performance. To the extent necessary, it should also be able to verify the transactions and expenditures through which those results were achieved and confirm that the relevant activities were conducted with appropriate safeguards against corruption risk.

B.    Third-Party Management and Anti-Corruption Controls Should Be Integrated into Contracting and Payment Processes

At the third-party selection stage, companies should assess the business rationale for the engagement, ownership and control, relationships with public officials, the nature of the services to be provided, and the level of compensation. Even after entering into the contract, companies should verify whether the services are actually performed and whether the relevant payments are appropriate.

It is also important to establish procedures that allow payments to be suspended and subject to further review where required due diligence or approvals have not been completed, or where red flags arise, such as requests for payment to personal accounts, excessive success fees, or consulting fees unsupported by identifiable deliverables.

C.    Companies Should Continually Test Their Headquarters Oversight Framework and Maintain Appropriate Records

Companies should not limit compliance at overseas subsidiaries to simply distributing headquarters policies and training materials to local offices. Respect for the independent management of an overseas subsidiary does not preclude headquarters-level compliance oversight.

Companies should regularly verify whether compliance controls are operating effectively through measures such as sample testing of high-risk transactions, internal audits, headquarters-level reporting channels, and investigation and remediation procedures when risks are identified.

Companies should also appropriately retain records relating to risk assessments, third-party due diligence, approvals and payments, whistleblower reports and investigations, and subsequent remediation. 

*    *    *

Bae, Kim & Lee LLC (“BKL”) has extensive experience advising clients on domestic and cross-border civil and criminal disputes arising from anti-corruption issues at overseas subsidiaries, related enforcement and sanctions matters, and the establishment and enhancement of compliance programs for overseas operations. If you require assistance or have any questions regarding these matters, please contact us.

[Korean Version]
 

Author: Jeena Kim Partner, Eunyoung Row Partner, Bochan Kim Senior Foreign Attorney (New York)

1. KIND (2025.8.26). “Occurrence of Embezzlement/Breach of Trust“.
2. Yeongnam Economy Daily (2021.11.19). “[Exclusive] KEPCO E&C and Others Indicted over Alleged Bribery in Ghana T2 Project“.
3. U.S. Department of Justice (2026.8.6). “Former Banker Convicted for Scheme to Bribe Ghanaian Officials“.
4. U.S. Department of Justice (2024.9). “Evaluation of Corporate Compliance Programs, E. Third Party Management”.
5. Supreme Court Decision 2015DO464, July 12, 2018: “[…] Whether, in a particular case, a corporation was negligent in exercising due care or management and supervision must be determined by considering all circumstances related to the violation as a whole, including the legislative purpose of the relevant statute; the degree of harm to the legally protected interest expected from a violation of the penal provision; the purpose of establishing a joint penalty provision for the violation; the specific manner of the violation and the degree of actual harm or consequences caused thereby; the scale of the corporation’s business; the corporation’s ability to supervise the offender and the specific command-and-supervision relationship; and the measures actually taken by the corporation to prevent the violation”. 
6. Criminal Division of the U.S. Department of Justice and the Enforcement Division of the U.S. Securities and Exchange Commission (2012.11.14). “A Resource Guide to the U.S. Foreign Corrupt Practices Act, Who is Covered by the Anti-Bribery Provisions?”.
7. Criminal Division of the U.S. Department of Justice and the Enforcement Division of the U.S. Securities and Exchange Commission (2012.11.14). “A Resource Guide to the U.S. Foreign Corrupt Practices Act, Parent-Subsidiary Liability”.
8. Criminal Division of the U.S. Department of Justice and the Enforcement Division of the U.S. Securities and Exchange Commission (2012.11.14). “A Resource Guide to the U.S. Foreign Corrupt Practices Act, Corporate Compliance Program”.
9. U.S. Department of Justice (2025.6.9). “Guidelines for Investigations and Enforcement of the Foreign Corrupt Practices Act (FCPA)“.
10. Crown Prosecution Service (2019.9). “Bribery Act 2010: Joint Prosecution Guidance of The Director of the Serious Fraud Office and The Director of Public Prosecutions“.
11. Gov.UK (2025.1.22). “Bribery Act 2010 guidance“.
12. Criminal Division of the U.S. Department of Justice and the Enforcement Division of the U.S. Securities and Exchange Commission (2012.11.14). “A Resource Guide to the U.S. Foreign Corrupt Practices Act, What are facilitating or expediting payments?”.
13. 2014 amendment to the Act on Combating Bribery of Foreign Public Officials in International Business Transactions (Link).
14. Ministry of Justice (2011.3). “The Bribery Act 2010, Facilitation Payments”.