Yes, for the due diligence; not for the approval. An AI agent can trace ownership, screen owners for links to public officials, search for adverse news, check commission terms and watch payments for red flags. Deciding whether a red flag is explained, and whether a high-risk intermediary may be engaged, stays with the compliance officer.
Why do third parties need anti-bribery checks?
Because bribery often happens through someone else. Anti-bribery laws in many countries hold companies responsible for bribes paid on their behalf by agents, consultants, distributors and other intermediaries, and treat adequate procedures, including due diligence on those third parties, as central to the company's defence.
The checks are risk-based. A stationery supplier needs little. A sales agent who will deal with government buyers in a high-risk market, paid by commission, needs a great deal.
What may the agent do, and what stays with a person?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Risk tiering | Proposes a tier from role, country, government contact and payment structure | 2 | Setting the tier |
| Questionnaire | Sends, chases and checks completeness | 3 | Accepting gaps |
| Ownership | Traces beneficial owners from registries and documents | 1 | Judging incomplete chains |
| Official links | Screens owners and directors for links to public officials | 1 to 2 | Deciding what a link means |
| Adverse media | Searches for bribery, corruption and fraud reports | 1 to 2 | Weighing relevance |
| Commercial terms | Compares commission and fees with benchmarks the firm sets | 2 | Deciding if they are justified |
| Contract | Checks anti-bribery clauses and audit rights are present | 2 | Accepting deviations |
| Approval | Assembles the file | 2 | Approving or rejecting engagement |
| Payment monitoring | Flags payments to unexpected accounts, countries or in cash | 2 | Deciding on investigation |
The wider supplier assessment, covering security and resilience as well as bribery, is in whether an AI agent can assess third-party risk.
What red flags should the agent look for?
The agent should check for and report patterns that commonly signal bribery risk:
- commission well above what the firm pays for similar work;
- requests to pay into an account in a third country or in someone else's name;
- an intermediary recommended or required by a public official;
- an owner, director or close relative who is, or has lately been, a public official;
- vague descriptions of services, or a lack of the skills the role needs;
- requests for cash, secrecy, or success fees with no clear deliverable.
Finding a red flag is not a finding of bribery. Many have innocent explanations. The agent's job is to surface them with evidence; a person's job is to decide whether the explanation holds.
Why should the checking agent be separate?
If the same agent, or the same team's agent, both onboards a third party and checks it for bribery risk, the check loses its independence. A procurement agent is set up to get suppliers signed; a compliance agent is set up to find problems. They should have different briefs, different owners and different sources of authority. The point is made in whether a compliance agent should be separate from the agents it checks.
An illustrative example
Take an engineering firm appointing a local sales agent to help win infrastructure contracts in a market where most buyers are state bodies. The agent proposes the highest tier.
It traces the sales agent's company to two owners. One has a brother who sits on the board of a state utility, which is a likely buyer. Adverse media finds nothing. The proposed commission is twice the firm's usual rate for comparable markets. The sales agent has also asked for payments to go to an account in a different country from where it is registered.
The agent reports all three flags with evidence. The compliance officer meets the sales agent, who explains the account is for tax reasons and offers to change it, and justifies the commission by the length of the sales cycle. The officer is satisfied on the account but not on the commission, and approves the engagement only at the firm's usual rate, with enhanced audit rights and a ban on any work involving the utility. Her reasons go in the file.
How does this relate to AML and other checks?
Anti-bribery checks overlap with anti-money laundering work, since bribes have to be paid and hidden. The tools are similar, including ownership tracing and screening, but the focus differs; what AML is covers the money laundering side. Identity checks on individuals behind a third party follow the same discipline as customer checks; see how to let an AI agent request identity checks on customers. For financial firms in the EU, providers of the agents themselves may also be ICT third parties under DORA; see DORA makes agent providers your ICT third parties.
What controls make it safe?
- Red flag list written by compliance, versioned and tested.
- No approval capability: the agent cannot engage a third party.
- Every finding sourced, with registry, screening or news source recorded.
- Explanations recorded alongside flags, with the person who accepted them.
- Payment monitoring linked to the approved terms, so deviations show.
The principle for all compliance agents is in AI compliance agents: second line, never the last word.
Questions people ask
Can the agent re-check existing third parties?
Yes, on a cycle set by risk tier, and whenever monitoring raises a flag. Changes go to compliance for review.
Should the agent interview the third party?
No. It can draft questions. Conversations that test explanations should be held by a person.
Does a low-risk tier mean no checks at all?
It means lighter checks, usually screening and a basic questionnaire. The agent can complete those at scale.