Screening Suppliers, Agents and Third Parties as Part of an Anti-Fraud and Anti-Corruption Programme

Relationships with suppliers, agents, distributors, consultants and service providers are among the most sensitive risk points in corporate compliance programmes. Screening suppliers, agents and third parties as part of an anti-fraud and anti-corruption programme is not limited to confirming that an entity legally exists. It also requires understanding who owns and controls it, why it was selected, how it will be paid, and whether the relationship presents conflicts of interest or risks involving bribery, fraud, money laundering or competition-law violations.

Egyptian companies and international groups operating in Egypt need a risk-based methodology rather than one uniform model for every supplier. A customs broker or consultant dealing with a government authority should not be treated in the same way as a low-risk office-supplies vendor. Likewise, mandatory KYC and Beneficial Ownership obligations differ according to the sector and legal status of the entity.

What Is Third-Party Due Diligence?

Third-Party Due Diligence is a structured process for collecting and verifying legal, commercial, financial and conduct-related information about an external party before engagement and throughout the relationship, with the objective of identifying risk and making a proportionate decision to approve, reject or apply additional controls.

The process is not limited to suppliers; it may also include commercial agents, distributors, intermediaries, consultants, contractors, customs brokers, logistics providers and local partners.

Why Do Third-Party Risks Differ?

Risk is determined by the third party’s actual role rather than the label of the contract. An agent dealing with public officials, licences, customs or public tenders creates a different risk profile from a supplier providing an internal technical service.

Risk may also increase where commissions are high or success-based, ownership structures are opaque, or links emerge with an employee of the company or a public official.

Third-Party Due Diligence Under Egyptian Law: No Single TPDD Statute

Egypt does not have one general statute imposing a uniform Third-Party Due Diligence model on every private company. Obligations vary according to the activity, sector, regulator and nature of the relationship.

Accordingly, a distinction should be drawn between mandatory legal obligations, such as due-diligence requirements in sectors subject to anti-money laundering rules, and governance or compliance best practices adopted by ordinary companies to reduce risk.

Anti-Money Laundering Rules Do Not Apply in the Same Way to Every Company

Anti-Money Laundering Law No. 80 of 2002, its Executive Regulations and customer-due-diligence requirements impose specific obligations on financial institutions and other entities subject to the AML framework, including identification and verification of customers and beneficial owners using a risk-based approach.

These sector-specific obligations should not be converted into an assumption that every ordinary commercial company is legally required to apply full banking-style KYC to every supplier.

Beneficial Owner

In sectors subject to customer-due-diligence obligations, identifying the Beneficial Owner is a core element. AML requirements emphasise reaching the natural person who ultimately owns or controls the entity and taking reasonable steps to verify that person’s identity.

For companies not subject to those obligations in the same form, beneficial-ownership review remains an important practice for identifying conflicts of interest, hidden ownership or undisclosed relationships.

Reviewing Ownership and Control

Obtaining a Commercial Register extract alone is not sufficient. The ownership chain should be understood, particularly where intermediary companies, corporate shareholders or arrangements obscure the ultimate owner.

The more complex the structure without a clear commercial rationale, the greater the need for Enhanced Due Diligence.

Conflicts of Interest

One of the principal objectives of due diligence is to determine whether a supplier or agent is owned or controlled by a company employee, a relative of an employee, or another person able to influence the contracting decision.

The existence of such a relationship does not necessarily make the transaction unlawful, but it requires disclosure, management of the conflict and approval by the competent body under company policy and any applicable sector rules.

FRA and Related-Party Governance

Governance principles issued by the Financial Regulatory Authority emphasise transparency, disclosure and protection of stakeholder interests, while sector-specific rules contain more detailed requirements for FRA-regulated companies concerning related parties and conflicts of interest.

FRA rules should therefore not be generalised to every private company outside its jurisdiction, although they can still serve as a useful governance reference.

Bribery and Intermediaries

Due diligence should focus particularly on intermediaries representing the company before government entities, public officials, licensing authorities or customs, because the risk that a third party may channel an improper benefit is higher in those relationships.

However, a company is not automatically criminally liable for every bribe paid by an independent agent. Participation, knowledge, actual role and any applicable special statutory provision must be analysed.

Penal Code and Intermediaries

The Egyptian Penal Code regulates bribery, intermediation and criminal participation, but the capacity of the person allegedly bribed, the nature of the relevant entity and the facts must be identified precisely.

Public-funds or public-official provisions should not be applied automatically to every private commercial transaction without confirming the legal status of the parties.

Competition Law and Suppliers

Competition Protection Law No. 3 of 2005 criminalises specified forms of anti-competitive agreements and practices, including horizontal agreements among competitors and bid rigging where the statutory conditions are met.

Mere dealings with a supplier or distributor do not make the company liable for every competition-law violation by that party, but participation in or direction of the agreement may create independent risk.

Sanctions and Restricted-Party Lists

Where an international company is subject to foreign sanctions regimes or international financing conditions, additional sanctions or restricted-party screening may be required.

There is no single “international sanctions list” that every Egyptian company must screen in the same way; the regimes applicable to the company or transaction should be identified.

Risk Classification of Third Parties

The preferred approach is a Risk-Based Approach. It begins by classifying the third party according to its role, geography, interactions with government bodies, payment method, contract value and ownership structure.

The company then determines the appropriate level of review rather than conducting an expensive in-depth investigation of every supplier.

Examples of Higher-Risk Third Parties

Agents or consultants dealing with government entities or licensing authorities.
Customs brokers or shipping intermediaries involved in clearances and approvals.
Intermediaries receiving Success Fees or unusual commissions.
Entities with complex ownership structures or unclear beneficial ownership.
Suppliers linked to employees or senior management within the company.
Parties operating in higher-risk jurisdictions or sectors under the group’s policy.

Standard Due Diligence

Standard review may include verification of legal existence, Commercial Register details, tax number, required licences, physical address, principal owners, legal representative and the bank account used for payment.

These data should be checked for consistency with the nature of the requested service.

Enhanced Due Diligence

Enhanced Due Diligence is used where Red Flags appear or where the role is high risk. It may include deeper review of ownership, reputation, available litigation or regulatory history, independent sources, and relationships with public officials or government entities.

EDD does not authorise unlawful methods or unnecessary collection of personal data.

Verifying Actual Capacity to Perform the Service

A key question is whether the supplier has the personnel, experience and operational capability that justify the proposed fee.

An entity with a nominal address or no identifiable team may be a Red Flag, especially where it receives a substantial commission for undefined “facilitation” services.

Reviewing the Fee Structure

A high commission is not conclusive evidence of corruption, but it requires documented commercial justification.

The company should understand how the compensation is calculated, whether it is linked to a legitimate and clearly defined deliverable, and who ultimately receives the payment.

Payment Methods

Risk increases where payment is requested to an account not held in the contracting party’s name, in a country unrelated to the service, in cash without justification, or through an undisclosed third party.

These indicators do not prove an offence, but they warrant escalation of due diligence before payment.

Anti-Corruption Clauses

It is useful to include a clear obligation to comply with applicable anti-bribery and anti-corruption laws, together with representations concerning ownership and conflicts of interest and an undertaking not to provide improper benefits.

However, the existence of such a clause does not exempt the company from liability where it knows of or participates in unlawful conduct.

Right to Audit

An audit right may be an important tool in higher-risk contracts, but its scope, exercise mechanism, confidentiality requirements and record-retention period should be defined.

It is preferable to link the right to records relevant to the contract rather than granting the company unrestricted access to all of the third party’s accounts.

Termination for Compliance Breaches

A contract may grant the company a right to terminate where integrity obligations are breached or false information is provided, but the clause should define the relevant event, consequences and any notice procedure.

It should not be assumed that every unsubstantiated suspicion justifies immediate termination without assessment.

Refusal to Sign an Anti-Corruption Clause

Refusal may constitute a Red Flag, but it does not by itself prove corruption or legally require termination of the engagement in every case.

The reason for refusal, materiality of the clause and overall risk profile should be understood before a documented decision is made.

Continuous Monitoring

Due diligence does not end when the contract is signed. Ownership, management, payment methods, service scope and regulatory risks may change.

Companies should therefore define Trigger Events for re-screening rather than relying only on a fixed timetable.

Examples of Trigger Events

Change of owner or beneficial owner.
Request to change the bank account or payment destination.
Sudden increase in commission or contract scope.
Appearance of a complaint or integrity report.
New direct dealings by the third party with a government body.
A material regulatory or judicial decision becomes known to the company.
Expansion of the relationship into a higher-risk jurisdiction or activity.

Must Due Diligence Be Repeated Annually?

There is no general rule requiring every company to re-screen high-risk parties annually and other parties every two or three years.

An internal cycle may be adopted, but it is preferable to define re-screening by reference to risk, sector and Trigger Events, while taking account of any specific regulatory requirements.

Documenting the Decision

Third-Party Due Diligence should not end with a file of documents. The important point is to record the outcome, the Red Flags identified, how they were addressed, who approved continuation and why.

This record may later help demonstrate that the decision was based on a professional assessment rather than disregard of warning signs.

Failure to Conduct Due Diligence Does Not Automatically Create Criminal Liability

The absence of Due Diligence may reveal weakness in the compliance programme, but it does not automatically make the company or Board criminally liable for a third party’s offence.

Criminal liability requires a statutory basis, the relevant elements and an actual role; compliance failures should not be treated as a substitute for proving the offence.

Confiscation and Debarment Are Not Automatic Consequences

Discovery of misconduct by an agent does not automatically result in confiscation of company assets or exclusion from government contracting.

Such measures require a legal basis, relevant facts and a scope determined by statute, judgment or competent authority.

Contract Invalidity Is Not Automatic

Even where the third party committed a violation, the entire contract does not automatically become void. The nature of the violation, contract subject matter, mandatory rules and role of the parties must be examined.

The legal consequence may instead be termination, damages, unenforceability or independent liability rather than nullity.

FCPA and U.S.-Connected Companies

For companies within the scope of the FCPA, third parties are a recognised source of risk, particularly where foreign public officials are involved.

However, application of the FCPA requires satisfaction of jurisdictional and substantive elements; the fact that a company uses an agent in Egypt is not enough.

UK Bribery Act

Section 7 of the UK Bribery Act may expose a commercial organisation subject to the statute to liability for failure to prevent bribery committed by an associated person intending to obtain business or an advantage for the organisation, subject to a defence based on adequate anti-bribery procedures.

This makes Third-Party Due Diligence an important part of compliance for companies within the statute’s scope, but it does not convert UK law into an Egyptian legal rule.

Personal Data Protection Law

Reviewing owners, managers and related persons may involve processing personal data. The purpose, source and amount of data collected should therefore be defined, with access appropriately protected.

Cross-border transfer requirements should also be assessed where due diligence is managed by headquarters or an international platform.

Publicly Available Information Is Not Unlimited

The fact that information is available online does not mean its use or aggregation is unlimited or automatically appropriate.

The review should remain proportionate to its purpose and should not become broad collection of personal information unrelated to identified risk.

Commercial and Operational Effects

Effective TPDD protects the supply chain from dealing with unqualified or unstable entities and identifies conflicts of interest before they become a crisis.

It also supports financing and acquisition processes where investors or lenders assess the maturity of a company’s compliance and third-party management programme.

Common Errors

Common errors include sending a questionnaire and accepting it without verification, exempting a long-standing supplier because of personal trust, or focusing on the company name while ignoring the true owner.

Other errors include treating every Red Flag as an automatic reason for rejection or closing it through a formalistic memo unsupported by evidence.

Practical Best Practices

Due diligence should be integrated into the Procurement Workflow so that a supplier is not onboarded or paid before completing the required level of screening.

For higher-risk relationships, the person requesting the supplier should be separated from the person approving due diligence, with an Escalation pathway for Red Flags.

Practical Third-Party Checklist

Legal name, legal form and place of incorporation.
Commercial Register, tax number and relevant licences.
Owners, beneficial owner and control structure.
Legal representative and individuals who will deal with the company.
Nature of the service and genuine commercial need for it.
Method of calculating compensation and commission.
Bank account and country of payment.
Any relationship with company employees or their relatives.
Any interaction with government entities or public officials.
Red Flags and the decisions taken in relation to them.
Required compliance, audit and termination clauses.
Trigger Events or scheduled dates for re-screening.

When Is Specialist Legal Counsel or Local Counsel in Egypt Necessary?

Local Counsel becomes particularly important where the company is engaging an agent who deals with government bodies, where ownership is unclear, where conflicts of interest or unusual commissions appear, or where bribery or fraud is suspected.

Legal support is also important when drafting Anti-Corruption Clauses and Right to Audit provisions and when deciding whether the matter requires an internal investigation, action against the third party or engagement with an authority.

How Can Specialist Legal Support Help?

El Rouby Law Firm supports companies in designing Third-Party Risk Frameworks, conducting Legal Due Diligence and Enhanced Due Diligence, and reviewing ownership structures, conflicts of interest and higher-risk contracts.

The firm also supports drafting supplier and agency agreements, anti-corruption, audit and termination provisions, risk management and investigations, dispute prevention, negotiation and settlement, litigation and arbitration, and representation before competent Egyptian authorities depending on the matter.

Conclusion

Third-Party Due Diligence is not a box-ticking KYC exercise and does not provide an absolute guarantee against risk. Its real value lies in matching the level of review to the party’s role, understanding the beneficial owner, documenting Red Flags and decisions, and monitoring the relationship after contracting.

Where your company is establishing or developing a Third-Party Due Diligence programme or faces Red Flags involving an agent or supplier in Egypt, El Rouby Law Firm can review the legal and contractual framework, conduct Enhanced Due Diligence and identify appropriate preventive or remedial measures.