SAP's $220M FCPA Settlement and Its Third-Party Controls

Updated October 2026. First published January 2024.

On January 10, 2024, SAP SE settled foreign bribery charges with the SEC and the Justice Department. The SEC's share was $85 million in disgorgement and more than $13.4 million in prejudgment interest, a little over $98 million. That's the "$100 million" in this post's original headline. The Justice Department added a $118.8 million criminal penalty and $103.4 million in forfeiture under a three-year deferred prosecution agreement. After credits between the two resolutions, SAP paid more than $220 million.

Few broker-dealers will ever pay a foreign official. Most do pay third parties under commission agreements that need sign-offs: finders, solicitors, vendors, and firms that introduce accounts. That's why the SEC's order is worth reading. It describes a third-party control program that SAP had in writing and that its subsidiaries worked around, step by step.

What the SEC Found

From at least December 2014 through December 2018, SAP subsidiaries used consultants, business development partners, and resellers to pay officials at government customers in South Africa, Malawi, Kenya, Tanzania, Ghana, and Indonesia. In Azerbaijan, an employee gave officials at the state oil company gifts worth about $3,000 in December 2021 and January 2022, against a company gift limit of $30. The payments went on SAP's books as commissions and other ordinary expenses.

The SEC found violations of the FCPA's anti-bribery provision (Exchange Act Section 30A), its books and records provision (Section 13(b)(2)(A)), and its internal accounting controls provision (Section 13(b)(2)(B)). The order calls SAP a recidivist: the SEC had charged it in 2016 over a bribery scheme in Panama. The Justice Department's criminal information charged two conspiracy counts, one for South Africa and one for Indonesia.

The Policy SAP Had

On paper, the controls were reasonable. Employees had to run due diligence on each third party to confirm it had no family ties to the customer and wasn't a government official. Commission contracts had to be in writing and define the services and payment terms. Subsidiaries had to use a model agreement with standard commission rates, approved by local legal or compliance, the local managing director, and the local CFO. Non-standard terms needed regional approval.

The order shows three places where that program failed in practice. Each has a version in a broker-dealer's own payments.

Rates Set Just Under the Approval Line

SAP South Africa used two local business partners on deals with the Department of Water and Sanitation worth $35.4 million. Both were paid 14.9% commissions. SAP policy required Board approval above 15%, and the order says employees picked the rate to stay under it. They also authorized payment though the partners hadn't met their deliverables.

What to check: sort your third-party payments by rate or amount against each approval threshold. A cluster just below a limit tells you how people treat the limit.

Payment Without Proof of Work

On a $28.58 million Eskom license renewal, SAP South Africa paid a purported IT consultant $1.6 million. The consultant did no work; SAP's own employees did it, on the managing director's instruction. A 3D printing company was paid $5.18 million in consulting fees on Eskom contracts it wasn't qualified to perform. The SEC found SAP lacked sufficient payment approval controls to confirm that services were rendered before a third party was paid.

What to check: whether your payables process requires evidence of the service (a deliverable, a report, a record of hours) before a third-party invoice is paid, and whether someone outside the sales line approves it.

Reinstatement After a Red Flag

SAP Africa suspended a Zimbabwe-based reseller on September 12, 2018, after red flags that it was paying officials at the Tanzania Ports Authority and the Kenya Revenue Authority. Later in 2018 it let the reseller start reselling again, with the red flags still present. SAP ended the relationship in July 2019.

What to check: who can lift a suspension of a counterparty, what evidence they need to see, and where the decision is recorded.

The Evidence Was on Personal Phones

In Indonesia, two SAP account executives ran the schemes with a reseller's staff. Their WhatsApp messages asked for "baggage" and "envelopes," which the order says were understood as code for bribes. In some cases, fake training invoices from shell companies set up by the reseller's employees created slush funds for the bribes. The Justice Department credited SAP for imaging the phones of relevant employees at the start of its internal investigation, which preserved messages sent on mobile messaging apps. Broker-dealers will recognize the problem from the SEC's off-channel recordkeeping cases: business conducted on apps the firm doesn't capture is business the firm can't supervise.

What SAP Changed, and What Has Changed Since

SAP ended its business development partner program in 2018. The Justice Department says SAP also dropped its third-party sales commission model worldwide, banned sales commissions on public sector contracts in high-risk markets, and tied part of employee pay to compliance. Under the department's 2023 pilot program on compensation clawbacks, the criminal penalty was reduced by $109,141 for pay SAP withheld from qualifying employees.

Federal FCPA enforcement has changed since. On February 10, 2025, Executive Order 14209 directed the Attorney General to stop opening new FCPA investigations for 180 days and to issue new guidelines. The Deputy Attorney General's June 9, 2025 guidelines tell prosecutors to focus on individuals, on bribery tied to cartels and transnational criminal organizations, and on conduct that harms identifiable U.S. companies. Neither document amends the statute. The books and records and internal accounting controls provisions in the SAP order still apply to every SEC-reporting issuer, and the controls they require are the same ones you'd want around any third-party payment.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.