Anti-Bribery Due Diligence and Payment Controls Before Hiring a Local Agent or Consultant

You may have identified someone who appears well connected in the local market. They say they can introduce customers, communicate with government bodies or help move a project forward, but you are not yet sure whether it is safe to sign and pay them.

What you need at this stage is not simply a contract template. You need a control framework that can answer four practical questions: who does this person represent, what are they authorised to do, why is payment being made, and who approved it?

A common misunderstanding is that adding a “no bribery” clause to a contract transfers the risk to the agent or consultant. It does not. Contract wording sets expectations, but it cannot replace checks on the third party’s identity, service scope, relationships and basis for payment. Once the purpose of a payment is unclear, deliverables cannot be demonstrated, or an undisclosed connection to a customer, public body or procurement process emerges, it may already be difficult to put matters right.

Start with the question: does this third party need enhanced due diligence?

Not every local service provider requires the same level of review. It is more practical to assess risk according to the person’s role and the parties they may deal with, rather than placing every supplier through the same process.

Situations that normally call for closer review include:

• The person will represent you before government departments, regulators, state-owned entities or people involved in public procurement.
• They claim they can “speed things up”, “coordinate internally”, or resolve approval, licensing, customs clearance or visa matters through personal connections.
• Their fee is directly linked to winning an order, obtaining a permit, securing payment or achieving another specific outcome.
• They ask for payment to an account that differs from the contracting entity, or request cash, split payments or payment to a third party.
• They are unwilling to disclose their beneficial owners, subcontracting arrangements, existing clients or potential conflicts of interest.
• Their scope of work is broad, while deliverables, activity records and acceptance criteria remain vague.

Risk does not mean the person has necessarily done anything wrong. It means additional checks may be needed, and legal, finance and business owners should jointly decide whether to engage them, what authority they receive and how payments will be controlled.

Break background checks into four practical questions

1. Who are you actually hiring?

Do not rely only on a business card, company profile or quotation. Due diligence documents should, as far as possible, correspond with the legal entity that will sign the contract. This may include company registration information, business address, management details, information on beneficial ownership or control, and tax and bank payment details.

Where the consultant is an individual, confirm their identity, usual business address, professional background and whether they are providing services in their own name. If an individual introduces the engagement but requests payment to another company, ask for an explanation of the relationship and make sure the contract and payment records reflect it consistently.

The issue is not simply whether documents have been collected. Check whether they support each other. For example, does the company name match the bank account name? Is the authorised signatory consistent with the contract? Do the invoice details match the contracting party? Are the people who will actually perform the work the same people or team named in the agreement?

2. How will they perform the work?

Ask the agent or consultant to explain their working method, not only the result they promise to deliver. A reviewable description would normally cover the categories of target customers or institutions, planned communication activities, expected deliverables, whether subcontractors will be used, what information they need from you, and which decisions must remain with your own team.

If their main value is described as “knowing key people”, “having internal connections” or being able to “get it done without your involvement”, pause the engagement. Ask them to restate the work as verifiable business activities. What you are purchasing should be defined services such as market research, customer introductions, project coordination, translation support or business communications—not unexplained access to relationships.

3. Are there undisclosed conflicts of interest?

Agents, consultants, introducers and subcontractors may work for more than one client. That alone is not necessarily a problem. The key question is whether they have a relationship with a potential customer, procurement decision-maker, government official or your own employee that could affect their independence.

You can ask the third party to complete a conflict-of-interest declaration and commit to disclosing new relevant relationships during the engagement. For projects involving public procurement, licence applications, land, concessions or regulatory communications, it is sensible to raise the standard for relationship disclosures, document review and communication records. A qualified legal professional can then advise on the specific risks.

4. Can their previous business conduct be reasonably explained?

Background checks may include public-source searches, verification of business references, descriptions of previous project scopes, and screening for adverse media, litigation, sanctions or integrity-related concerns. Where screening produces a name match, incomplete information or media coverage, do not treat the search result alone as a conclusion. Ask the person concerned for an explanation and retain the basis for your decision.

The objective is not to prove that there is “zero risk”. It is to create a complete decision record: what you checked, what you found, how the third party explained it, who decided to accept or reject the engagement, and what additional controls are required going forward.

Do not use the contract only to prohibit conduct—define authority boundaries

Agency arrangements most often become difficult when a third party makes commitments beyond its authority while claiming to represent the company. Your contract and internal authorisation documents should separately address the following areas:

Control area	What should be clearly defined
Scope of services	Specific work, deliverables, work location and whether subcontracting is allowed
Prohibited conduct	No unauthorised commitments, quotations, payment promises or regulatory statements
External identity	Whether the third party may use your company name, branding, email address or business cards, and for what purpose
Communications	Which meetings they may attend alone and which require your representative or written confirmation
Fee arrangements	Charging basis, reimbursable expense categories, invoice requirements and preconditions for payment
Record-keeping obligations	Meeting notes, visit records, deliverables, expense evidence and subcontractor information
Termination and audit	Arrangements to suspend or terminate the engagement and recover documents where there are material inconsistencies, refusal to disclose or breach of requirements

Avoid broad wording such as “full authority to handle all related matters”. The broader the authority, the harder it becomes to assess whether the agent exceeded it. It also becomes more difficult to explain the connection between payments and business activity to banks, auditors or internal management.

Put payment controls in place before the first payment leaves the account

Anti-bribery controls should not sit only with legal or compliance teams. Business teams, finance teams and approvers each have a different role: the business team confirms that services were actually performed; finance checks the contract, invoice and receiving account; and the approver assesses whether the payment meets budget, authority and risk requirements.

At a minimum, a payment to an agent or consultant should be supported by the following evidence trail:

1. An approved contract, authorisation documents and due diligence outcome.
2. Deliverables or periodic service records submitted by the third party.
3. An invoice and expense breakdown consistent with the contract.
4. Records showing checks on the receiving account, currency, paying entity and payment purpose.
5. Approval records completed under your internal authority matrix.
6. For reimbursed expenses, original supporting documents showing that costs were actually incurred and related to the business.

Another common misunderstanding is that success fees can never be used. A more accurate approach is this: where compensation is linked to a specific commercial outcome, the risk assessment, definition of deliverables, approval level and payment evidence should be more rigorous. You should be able to explain what legitimate service the fee relates to, rather than pointing only to the fact that a project succeeded.

Payment controls should also follow several basic principles. The contracting party and receiving party should remain consistent. Avoid cash payments, third-party collections, payments to personal accounts and last-minute account changes without a reasonable commercial explanation. Account changes should be verified through an independent channel, not solely by email. Any unusual request should trigger a payment hold and further review.

When red flags appear, do not try to solve them only with extra contract wording

Where any of the following arises, the more prudent response is generally to pause contracting, authorisation or payment and document the reason:

• The third party refuses to provide information about its legal entity, controllers or receiving account.
• The service description remains vague while the commission or consulting fee appears unusually high.
• The third party asks for fees to be split into difficult-to-explain items such as “coordination fees” or “facilitation fees”.
• They are unwilling to accept written anti-bribery commitments, audit rights or record-retention requirements.
• Deliverables cannot be demonstrated, but payment is requested urgently.
• Business staff attempt to bypass the approval process and ask finance to “pay first and sort out the paperwork later”.

When a red flag appears, do not leave the decision to the same business person who is under pressure to move the transaction forward. Management, finance and compliance personnel who were not directly involved in negotiations should review the matter together. If legal risk or relationships with regulators are involved, seek advice from a qualified legal professional.

How to ask useful questions about cost and timing

Due diligence costs may include public-source searches, document translation or certification, third-party screening, reference checks, legal review and internal staff time. The difference between basic and enhanced due diligence usually depends on whether the ownership structure is complex, whether there are cross-border control relationships, whether the services involve contact with public-sector bodies, whether subcontractors need review, and how much follow-up is required after issues are identified.

Do not ask a provider only, “How much does due diligence cost and how many days will it take?” Better questions are: which information sources and verification steps are included in the quotation; what circumstances create additional charges; how will the review escalate if red flags are found; who will retain the final documentation; and whether updates are needed annually or at each renewal. When comparing quotations, check whether the scope covers your actual risk rather than comparing only the total price.

This content is provided for general information only and does not constitute legal, tax or immigration advice. Specific requirements should be confirmed with the relevant Sri Lankan authorities and the latest advice of the licensed professional advisers you engage.