The EU anti-corruption directive, effective May 31, requires organizations to overhaul how they detect, prevent, and report corruption risks across borders. If you're operating in or with EU member states, your current anti-corruption program likely needs an update.
This checklist provides a structured compliance framework you can adapt to your organization's needs. It helps you address enforcement gaps targeted by the directive and prepare for the cross-border cooperation mechanisms regulators will use to share intelligence and coordinate investigations.
Purpose of This Checklist
Use this checklist to:
- Audit your current anti-corruption controls against the directive's standards.
- Identify gaps in your program related to cross-border cooperation.
- Build a remediation roadmap with clear responsibilities and timelines.
- Document your compliance status for board reports and regulatory inquiries.
This isn't a one-time task. Regulators will seek evidence of continuous monitoring and improvement, not just policy documentation.
Prerequisites
Before starting:
- Map your EU exposure: List every EU member state where you have employees, contractors, third parties, or business operations. Include jurisdictions where you process payments, hold licenses, or maintain data.
- Identify your compliance owner: Assign a senior leader (typically your Chief Compliance Officer, General Counsel, or CISO) to oversee the assessment and coordinate remediation.
- Gather existing documentation: Collect your current anti-corruption policy, third-party due diligence procedures, gift and hospitality registers, and incident response plans.
- Understand your data flows: The directive's cross-border cooperation provisions require visibility into how corruption-related data moves between jurisdictions, who can access it, and how long you retain it.
If you lack this baseline, pause and establish it first. You can't assess compliance without knowing where you operate and what controls you have.
Compliance Checklist Template
Copy this structure into your preferred documentation platform. Customize the columns and add rows as needed for your specific risk profile.
EU ANTI-CORRUPTION DIRECTIVE COMPLIANCE CHECKLIST
Organization: [Your Organization Name]
Assessment Date: [Date]
Owner: [Name, Title]
Review Frequency: Quarterly
---
SECTION 1: POLICY AND GOVERNANCE
Control Area | Current State | Gap Analysis | Remediation Action | Owner | Target Date | Status
-------------|---------------|--------------|-------------------|-------|-------------|-------
Anti-corruption policy covers all EU jurisdictions | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Not Started/In Progress/Complete]
Policy updated within last 12 months | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Board receives quarterly corruption risk reports | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Designated compliance officer for EU operations | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Escalation procedures for cross-border incidents | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
---
SECTION 2: THIRD-PARTY RISK MANAGEMENT
Control Area | Current State | Gap Analysis | Remediation Action | Owner | Target Date | Status
-------------|---------------|--------------|-------------------|-------|-------------|-------
Due diligence process for EU third parties | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Corruption risk scoring methodology | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Contract clauses require anti-corruption compliance | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Annual re-screening of high-risk third parties | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Termination rights for non-compliance | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
---
SECTION 3: DETECTION AND MONITORING
Control Area | Current State | Gap Analysis | Remediation Action | Owner | Target Date | Status
-------------|---------------|--------------|-------------------|-------|-------------|-------
Transaction monitoring for corruption indicators | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Gift and hospitality register maintained | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Whistleblower hotline available in all EU languages | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Whistleblower protection policy documented | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Quarterly review of high-risk transactions | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
---
SECTION 4: CROSS-BORDER COOPERATION READINESS
Control Area | Current State | Gap Analysis | Remediation Action | Owner | Target Date | Status
-------------|---------------|--------------|-------------------|-------|-------------|-------
Data sharing agreements with EU authorities documented | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Legal hold procedures for cross-border investigations | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Contact registry for EU regulators and law enforcement | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
[Incident response plan](/glossary/incident-response-plan) includes cross-border scenarios | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Data retention aligned with investigative timelines | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
---
SECTION 5: TRAINING AND AWARENESS
Control Area | Current State | Gap Analysis | Remediation Action | Owner | Target Date | Status
-------------|---------------|--------------|-------------------|-------|-------------|-------
Annual anti-corruption training for EU staff | [Yes/No/Partial] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Role-specific training for high-risk functions | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Training completion tracked and reported | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Training content updated for directive requirements | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Board and senior leadership trained on obligations | [Yes/No] | [Describe gaps] | [Specific action] | [Name] | [Date] | [Status]
Customizing the Checklist
For your jurisdiction profile: If you operate in high-corruption-risk EU member states, add rows for country-specific controls. Tailor your due diligence and monitoring intensity based on varying corruption risk profiles.
For your industry: Financial services firms should add controls for transaction monitoring and sanctions screening. If you're in construction or extractive industries, include public procurement controls and beneficial ownership verification.
For your third-party ecosystem: If you rely heavily on agents, distributors, or joint venture partners in EU markets, expand Section 2. Add rows for commission payment reviews, agent background checks, and contract audit rights.
For cross-border complexity: The directive's focus on improving cross-border cooperation means you need to consider data sovereignty and legal privilege differently. If you have subsidiaries in multiple EU member states, add controls for:
- Jurisdiction-specific data protection impact assessments for corruption investigation data.
- Legal counsel coordination across jurisdictions.
- Privilege logs that account for differing EU member state attorney-client privilege rules.
For integration with existing frameworks: If you're implementing ISO/IEC 37001 (Anti-Bribery Management Systems) or FATF Recommendations, map those controls to this checklist. Reference your existing control evidence in the "Current State" column and note where the directive requires additional measures.
Validation Steps
After completing your initial assessment:
Run a tabletop exercise: Simulate a cross-border corruption allegation. Walk through your escalation procedures, data preservation steps, and regulator notification process. Document any issues.
Test your data access: Ensure you can produce a complete audit trail for a suspicious payment within 48 hours and identify all parties involved across multiple EU jurisdictions. If not, improve your detection and monitoring controls.
Review with legal counsel: Have your EU-qualified legal team review your gap analysis and remediation plan. The directive's enforcement provisions vary by member state, and you need local expertise to validate your approach.
Benchmark against peers: Review recent enforcement actions in your industry. Identify control failures that led to penalties and incorporate those lessons into your checklist.
Schedule quarterly reviews: Regularly update this checklist. Corruption risks change as you enter new markets, launch new products, or hire new third parties. Your compliance posture needs to keep pace.
This checklist won't prevent every corruption risk, but it provides a structured way to identify gaps before regulators do. The directive's emphasis on closing enforcement gaps means the cost of non-compliance has increased.
