A Kenyan company owned by a foreign group often assumes that the group’s global anti-corruption policy covers it. Kenyan law asks a narrower question. Section 9 of the Anti-Bribery Act (Cap. 79B) requires every private entity carrying on business in Kenya to have its own written procedures for preventing bribery, and the Bribery Regulations, 2022 say specifically what a subsidiary, branch, joint venture or franchisee must do. This guide explains the anti-bribery procedures in Kenya that the law requires, how a subsidiary can adopt its parent’s policy without falling short, and where the liability sits if it does not.
Who must have procedures, and who is liable
Section 9(1) of the Anti-Bribery Act requires a public or private entity to put in place procedures appropriate to its size, scale and operations. “Private entity” is defined widely in section 2 and includes a body incorporated in Kenya and any other body corporate, however established, that carries on business or part of its business in Kenya.
Under section 9(2), where a private entity fails to put procedures in place and the failure is proved to have been committed with the consent or connivance of a director, senior officer or person acting as one, that individual commits an offence. In our reading, no specific penalty is stated for that offence, so the general penalty in section 19 applies: a fine of up to five million shillings, imprisonment for up to ten years, or both. The EACC’s 2022 Guidelines and Model Procedures quote a fine of one million shillings, so plan around the Act’s own figure.
What the Regulations say about subsidiaries, branches and joint ventures
The Bribery Regulations, 2022 (Legal Notice 88 of 2022) deal with group structures directly.
Foreign parent (regulation 6). A subsidiary or branch of a foreign entity must establish bribery prevention procedures. If the foreign parent has procedures, the subsidiary may adopt them with the necessary modifications, but they must still comply with section 9.
Local parent (regulation 5). A subsidiary of a local entity may adopt its parent’s procedures with the necessary modifications, and responsibility for compliance and implementation stays with the subsidiary.
Branches (regulation 8). A local entity is responsible for ensuring its branches comply, whether or not they operate independently.
Joint ventures (regulation 7). Each entity in a joint venture is treated separately, and a separate entity incorporated by the venturers must establish its own procedures.
Franchisees (regulation 9). A franchisee must establish its own procedures, and may adopt the franchisor’s if they comply with section 9.
Regulation 4 lists factors that the procedures must take into account, including the number of employees, turnover, geographic spread, the risk of bribery in the entity’s operations, and whether it is a joint venture, a subsidiary of a local or foreign entity, or a branch or franchise. Regulation 12 requires the procedures to be in writing. Regulation 13(1) gave entities six months from publication of the Guidelines to establish them. The Guidelines were published on 27 May 2022, so that period has long expired.
What anti-bribery procedures in Kenya must contain
Regulation 13(2) names five guiding principles: risk assessment and management, communication and training, internal reporting mechanisms, whistleblower protection, and compliance monitoring and review. The 2022 Guidelines (Gazette Notice 6022 of 2022) expand on these. In particular they require:
a written document in the official languages; a mapped risk assessment with a mitigation plan; an implementation structure with leadership commitment and a designated senior officer; reporting channels that are timely, accessible and confidential and that also reach the EACC; measures to protect whistleblowers, informants and witnesses; communication and training for internal and external stakeholders; an enforcement structure; and monitoring, evaluation and review.
The EACC’s Model Procedures give a template. They set out a report-handling sequence, with the designated officer submitting a report to the enforcement structure and the EACC within twenty-four hours, an inquiry and findings within fourteen days, action or referral within seven days of the determination, and feedback to the informant within fourteen days. They also call for an annual review and include a compliance checklist and a reporting form.
Localising a parent group’s anti-bribery procedures in Kenya
A global policy is a good base, but in our view it usually needs five Kenyan fixes before it satisfies regulation 6.
The twenty-four hour duty. Section 14 requires a report to the EACC within twenty-four hours of any knowledge or suspicion of bribery, and failing to report is an offence. A policy routing reports to a regional team on a longer timetable needs a Kenyan fast track.
Whistleblower protection. Section 21(2) makes it an offence to demote, dismiss or harass a whistleblower or witness. Reflect that in your retaliation policy, including how disciplinary decisions involving a reporter are reviewed.
A Kenyan designated officer. The Guidelines expect a designated senior officer to oversee implementation. Name someone with authority in the Kenyan entity, not only at group level.
Local risk assessment. The Guidelines expect a mapped risk assessment reflecting your actual operations. Map the third parties that deal with government on your behalf, such as licensing agents and clearing agents, because a bribe paid by them may be attributed to you.
Language and format. The Guidelines require the procedures to be in writing and in the official languages.
Why third parties matter
Section 10 makes a private entity liable where a person associated with it bribes another person to obtain or retain business or an advantage for the entity. Section 11 treats as associated any person who performs services for the entity, including an agent or employee, and looks to all relevant circumstances. We did not find an express “adequate procedures” defence in the text of section 10 on Kenya Law, so we would not assume that having a policy shields the entity if an intermediary pays a bribe. The Model Procedures recommend anti-bribery clauses in contracts, third-party questionnaires, declarations and due diligence.
Section 15 applies the Act to conduct outside Kenya by a Kenyan citizen or a private or public entity that would be an offence if it took place in Kenya. Section 18(12) disqualifies a non-natural person convicted of bribery from transacting with national or county government for ten years, which matters for groups that bid for public contracts.
How We Can Help
Clay & Associates Advocates advises Kenyan subsidiaries and branches of foreign groups on localising anti-bribery procedures, risk assessments, third-party contracts and reporting lines. Our article on Anti-Bribery Act compliance covers the section 9 duty, our guide to conflicts of interest and gifts covers the staff code, and our guide to investigating employee fraud covers what to do when a report arrives. Contact our Regulatory & Compliance practice to review your group policy.
Sources: Anti-Bribery Act (Cap. 79B), sections 2, 9, 10, 11, 14, 15, 18, 19 and 21; Bribery Regulations, 2022 (Legal Notice 88 of 2022), regulations 4 to 9, 12 and 13; Anti-Bribery Act (Guidelines to Assist Public and Private Entities in the Preparation of Procedures for the Prevention of Bribery and Corruption), 2022 (Gazette Notice 6022 of 2022); EACC Model Procedures for Prevention of Bribery and Corruption.
Frequently asked questions
Can a Kenyan subsidiary simply adopt its parent’s global policy?
Regulation 6 allows it, with the necessary modifications, provided the procedures comply with section 9. The subsidiary must still establish procedures of its own, so the policy should be localised and formally adopted in Kenya.
Who is liable if the subsidiary has no procedures?
Under section 9(2), a director, senior officer or person acting as one commits an offence if the failure is proved to have been committed with their consent or connivance.
Do the procedures have to be reviewed?
The Guidelines require monitoring, evaluation and review, and the EACC’s Model Procedures say they should be reviewed periodically and in any event at least once a year.
Does the twenty-four hour reporting rule apply to us?
Section 14 applies to any person in a public or private entity who has knowledge or suspicion of bribery, and failing to report is an offence, so build it into your escalation route from day one.
