For two decades, a serious anti-corruption programme meant an FCPA programme. Train people on public officials, screen the agents, control gifts and hospitality, keep the books accurate. That framework is no longer the standard your European exposure is measured against, and the difference is not one of degree.
Directive (EU) 2026/1021 on combating corruption, approved by the Council in April and in force since the end of May, sets a common criminal floor across the Member States. They have until June 2028 to write it into national law. It reaches conduct the FCPA does not reach at all, and it prices the consequences on a different basis entirely. Companies reading it as a European restatement of familiar rules are reading it wrong.
Below are the four places where a programme designed around Washington comes apart in Brussels, and what closing each gap involves.
Private-sector bribery is criminal conduct
The FCPA's anti-bribery provisions are aimed at foreign officials. Commercial bribery between private parties sits largely outside them, which is why most US-built policies define prohibited conduct by who receives the payment: a government employee, a state-owned enterprise, a political party.
The Directive does not draw that line. It requires every Member State to criminalise bribery in the private sector alongside bribery of public officials. The UK Bribery Act has done the same since 2011, so for companies with a UK footprint the principle is not new. For a company whose programme was written for US purposes and extended to Europe by translation, it is.
A policy that asks whether the counterparty is a government official is asking the wrong question in every Member State.
In practice, the gifts and hospitality policy, the agent screening thresholds and the escalation triggers all need rebuilding around conduct rather than counterparty status. A procurement manager at a private customer is now as relevant as a customs officer. It is a rewrite, not an annex.
Trading in influence has no clean analogue
Trading in influence means paying someone for their ability to sway a decision, rather than paying the person who makes it. The intermediary may hold no public office at all. The wrong lies in the promise of influence, whether or not it is ever exercised.
US programmes tend to catch this only incidentally, through third-party due diligence designed for a different purpose. A consultant with a well-placed relative, a former minister retained for "market access", an adviser paid on success: each can pass a standard FCPA screen and still sit squarely within this offence.
Closing the gap means adding influence to the questions your due diligence asks. Who does this person know? Why are we paying for that? Is the fee proportionate to work we can describe in writing? Those questions apply to government-relations advisers, consultants and success-fee arrangements as a category, not only to intermediaries who deal with officials.
There is no facilitation-payment safe harbour
The FCPA contains a narrow exception for payments that expedite routine governmental action, such as processing a visa or connecting a utility. It is heavily conditioned and rarely worth relying on, yet many programmes still carry it in some form: a permitted category with a low value threshold and a recording requirement.
Neither the UK Bribery Act nor the Directive recognises that exception. A policy permitting small facilitation payments carries a US carve-out into jurisdictions where the same payment is a crime.
The fix is simple on paper: prohibit them outright. The harder part is operational. Staff in higher-risk markets need guidance on what to do when a payment is demanded, including the difference between a facilitation payment and a payment made under genuine threat to someone's safety, which most regimes treat differently. That guidance has to exist before the demand is made, in the language of the person who will face it.
Exposure is priced on global revenue
For corporate bribery and misappropriation, each Member State must allow a maximum fine of at least 5% of worldwide turnover or, if it opts for a fixed ceiling, at least €40 million. For trading in influence, obstruction and enrichment, the floors are 3% or €24 million. States are free to go higher.
The practical point
Where a Member State takes the turnover route, the reference is the whole group's revenue. Not the local subsidiary's, and not the profit on the tainted deal.
That changes the board conversation about programme investment. Under a profit-based mindset, a small contract in a small market carries a small downside. Under a turnover basis, the downside is set by the size of the company, not the size of the deal. Exposure in a market that produces 2% of revenue can be priced as if it were the whole business.
The Directive also extends corporate liability to offences that result from a lack of supervision or control, and treats effective compliance measures as a factor in mitigation. Both point the same way: the quality of the programme is now part of how the penalty is calculated.
What closing the gaps involves
None of this requires starting again. It requires treating the FCPA programme as one layer rather than the whole structure. In sequence:
- Re-scope the risk assessment to cover commercial bribery and influence, country by country, for every Member State where you operate or sell.
- Rewrite the policy definitions around conduct rather than counterparty, and remove any facilitation-payment allowance.
- Extend third-party due diligence to advisers and consultants whose value lies in who they know.
- Document the controls so that, if it ever matters, you can show what the programme did and when.
- Watch transposition. The Directive sets the floor. National law in each Member State will set the actual obligations and the date they bite.
Companies that start now have until mid-2028 to close these gaps on their own timetable. Those that wait will be closing them on someone else's.