Skip to main content
Governance Authority
Category: Third-Party and Supply Chain

Agent and Intermediary Vetting

Also known as: Third-Party Agent Vetting, Intermediary Due Diligence
Simply put

Agent and intermediary vetting is the process of investigating and evaluating the third parties that act on a company's behalf, such as sales agents, brokers, consultants, or distributors, before and during a business relationship. It typically involves background checks, verifying credentials and ownership, and assessing whether the party poses legal, financial, or reputational risks. The goal is generally to reduce the chance that an intermediary exposes the organization to misconduct such as bribery or fraud.

Formal definition

Agent and intermediary vetting is a risk-based due diligence activity, typically owned by the compliance function with input from the business, that investigates, evaluates, and adjudicates the suitability of third parties who transact or interact with regulators, customers, or officials on the organization's behalf. It generally combines background investigation, verification of licenses and credentials where applicable (for example, license status for regulated intermediaries), beneficial ownership identification, and screening against relevant risk indicators, with the depth of review calibrated to the assessed risk. In many anti-corruption programs it is treated as a control against liability under laws such as the U.S. Foreign Corrupt Practices Act, where an intermediary's conduct can be attributed to the engaging entity; however, the specific legal requirements, screening scope, and record-keeping obligations vary by jurisdiction, sector, and the nature of the relationship. This entry is educational and not legal, audit, or compliance advice; the appropriate vetting standard depends on the facts and the professional's own judgment.

Why it matters

Third parties who act on a company's behalf can create liability for the engaging organization, particularly under anti-corruption regimes. Under laws such as the U.S. Foreign Corrupt Practices Act, an intermediary's conduct can, in certain circumstances, be attributed to the entity that engaged it, meaning a company can face exposure for improper payments or misconduct carried out by an agent, broker, consultant, or distributor. Vetting these parties before and during a relationship is generally treated as a first line of defense against such exposure, helping the organization identify legal, financial, and reputational risks before they materialize.

Because the misconduct of an intermediary may not be directly visible to the engaging company, due diligence serves to surface warning signs, such as undisclosed beneficial owners, questionable credentials, or a lack of appropriate licenses, that would otherwise be difficult to detect. Verifying beneficial ownership and confirming that regulated intermediaries hold valid, in-good-standing licenses (for example, through registries such as NMLS for mortgage brokers) are common elements of this scrutiny. The depth of review is typically calibrated to the assessed risk of the relationship rather than applied uniformly.

The specific legal requirements, screening scope, and record-keeping obligations vary by jurisdiction, sector, and the nature of the relationship. Vetting reduces but does not eliminate risk, and the appropriate standard for any given engagement depends on the facts and on professional judgment. Organizations should treat this entry as educational rather than as legal, audit, or compliance advice.

Who it's relevant to

Chief Compliance Officers and Compliance Teams
The compliance function typically owns agent and intermediary vetting, designing the risk-based approach, setting screening standards, and adjudicating suitability decisions. Compliance teams calibrate the depth of due diligence to the assessed risk and maintain the records needed to demonstrate that the control operated as intended.
Business and Sales Leaders
The business units that seek to engage agents, brokers, consultants, or distributors generally provide input to the vetting process and rely on its outcomes before proceeding. Because an intermediary's conduct can be attributed to the engaging entity, business owners share a practical interest in ensuring that third parties are properly evaluated before onboarding.
General Counsel and Legal Teams
Legal advisors are typically concerned with how intermediary conduct may create liability under anti-corruption laws such as the FCPA, where a third party's actions can expose the organization. They help interpret how requirements apply across relevant jurisdictions and sectors, recognizing that obligations vary and depend on the specific facts.
Internal Audit and Assurance Functions
Assurance functions may test whether the vetting control has been designed appropriately and is operating effectively, for example, checking that beneficial ownership was verified, licenses were confirmed where applicable, and adjudication decisions were documented in line with the program's risk-based approach.
Board and Risk Committee Members
Directors and committees with oversight responsibility generally seek assurance that management has implemented adequate third-party risk controls. Their role is typically one of oversight rather than performing the vetting itself, focusing on whether the program appropriately addresses the organization's exposure to intermediary-related misconduct.

Inside Agent and Intermediary Vetting

Risk-Based Due Diligence
A tiered process that calibrates the depth of vetting to the risk profile of the agent or intermediary, considering factors such as the jurisdiction of operation, sector, the nature and value of services, government interaction, and any prior red flags. Higher-risk relationships typically warrant enhanced scrutiny, while lower-risk ones may follow streamlined procedures.
Identity and Ownership Verification
Confirmation of the legal identity, corporate structure, and beneficial ownership of the third party, often to identify hidden connections to government officials, sanctioned parties, or other prohibited persons. This generally supports obligations arising under anti-bribery, sanctions, and anti-money-laundering expectations, which vary by jurisdiction and entity type.
Screening Against Watchlists and Adverse Media
Checks against sanctions lists, politically exposed persons (PEP) databases, debarment lists, and negative news sources. The applicable lists and legal weight depend on the jurisdictions to which the organization is subject; screening is a control input rather than a conclusive judgment on its own.
Business Rationale and Commercial Justification
Documentation establishing a legitimate business need for engaging the intermediary, the reasonableness of proposed compensation, and the absence of unusual payment arrangements. This helps distinguish genuine services from arrangements that may mask improper payments.
Contractual Safeguards
Provisions such as anti-corruption and compliance representations, audit and information rights, termination triggers, and requirements to cooperate with investigations. These are contractual controls whose enforceability and content depend on governing law and negotiation.
Approval and Accountability Structure
A defined workflow specifying who reviews findings and who authorizes onboarding. Management typically owns the operational vetting process and the decision to engage, while the board or a committee generally exercises oversight of the program rather than approving individual counterparties, absent unusual circumstances.
Ongoing Monitoring and Refresh
Periodic re-screening, risk reassessment, and monitoring of the relationship over its lifecycle, since vetting at onboarding addresses conditions at a single point in time and risk profiles can change.
Recordkeeping and Audit Trail
Retention of the due diligence performed, the rationale for decisions, and approvals, which supports demonstrability of the program and can inform assurance activities by internal audit or external reviewers.

Common questions

Answers to the questions practitioners most commonly ask about Agent and Intermediary Vetting.

Is agent and intermediary vetting the same as general vendor onboarding or procurement due diligence?
No. While there can be procedural overlap, agent and intermediary vetting is typically a distinct, risk-focused process aimed at parties who act on the organization's behalf or interface with third parties (often including public officials or customers), where the primary concern is exposure to bribery, corruption, sanctions, and reputational risk rather than commercial or operational supplier performance. Standard procurement due diligence may not probe beneficial ownership, government connections, or the business rationale for engaging the intermediary to the depth that anti-corruption risk generally requires. The appropriate scope depends on the intermediary's role, jurisdiction, sector, and the organization's own risk assessment, so treating the two processes as interchangeable can leave material risks unaddressed.
Does completing vetting at onboarding mean the intermediary relationship is cleared and no further work is needed?
Generally, no. Vetting is commonly understood as a point-in-time assessment that supports an initial engagement decision, not a permanent clearance. Ownership structures, political connections, sanctions status, and conduct can change over the life of a relationship, so many programs apply risk-based periodic refresh, ongoing monitoring, and event-driven re-review. The frequency and depth typically scale with the assessed risk. The design of any monitoring approach depends on the organization's risk profile, resources, and applicable expectations, and this entry is educational rather than prescriptive advice on any specific program.
Who within the organization typically owns the vetting process, and where does oversight sit?
In many organizations, the compliance function designs and administers the vetting framework and sets risk-based standards, while the business unit that sponsors the relationship generally owns the underlying risk and provides the commercial rationale. Under a three-lines model, the sponsoring business is typically the first line executing controls, compliance often operates as a second-line function setting policy and challenging decisions, and internal audit may provide independent assurance over the process as a third line. Board or committee-level oversight generally focuses on the adequacy of the program rather than individual vetting decisions. Exact allocation of accountability varies by entity type, size, and structure.
What information is typically gathered during intermediary vetting?
The specific inputs are risk-based, but programs commonly seek to understand the intermediary's legal identity and beneficial ownership, the business rationale for the engagement, the scope and nature of services, any connections to government officials or state-owned entities, and screening against sanctions, watchlists, and adverse media as applicable in the relevant jurisdictions. Higher-risk relationships may warrant enhanced steps such as deeper background research or documented references. The appropriate depth is a matter of professional judgment informed by the risk assessment; this entry does not prescribe a mandatory checklist and does not constitute legal or compliance advice.
How can vetting be prioritized when an organization has a large population of intermediaries?
A risk-based approach is generally used to allocate effort proportionately rather than applying uniform, exhaustive review to every party. Organizations typically segment intermediaries by factors such as the jurisdiction and sector involved, the degree of government interaction, the intermediary's role and remuneration structure, and the transaction values at stake, reserving enhanced due diligence for higher-risk categories and applying lighter procedures to lower-risk ones. The specific criteria and thresholds depend on the organization's own risk appetite and tolerance and should be documented and applied consistently. What constitutes an adequate approach varies by facts and jurisdiction.
How should the results of vetting and any subsequent decisions be documented?
Many programs maintain a documented record showing the due diligence performed, the risks identified, how those risks were assessed and mitigated, and the rationale for the approval or rejection decision, along with the identity of the approver. Such records generally help demonstrate that decisions were reasoned and consistent with policy, and they support ongoing monitoring and any later audit or assurance review. Where risks are identified but the relationship proceeds, documenting the mitigation and the basis for acceptance is commonly emphasized. Retention practices and specific documentation expectations vary by jurisdiction, framework, and entity, so this general description is not a substitute for tailored professional advice.

Common misconceptions

Vetting an agent once at onboarding satisfies the organization's obligations.
Vetting generally reflects conditions at a point in time. Ownership, sanctions status, and conduct can change, so many programs incorporate periodic refresh and ongoing monitoring proportionate to risk. The appropriate cadence depends on the risk profile, jurisdiction, and applicable expectations.
A clean screening result against watchlists means the intermediary is approved and low risk.
Screening is one input among several. The absence of a hit does not establish integrity or the legitimacy of the commercial arrangement; business rationale, ownership transparency, compensation reasonableness, and other factors also inform the decision. Screening reliability also depends on data quality and list coverage.
The board should review and approve each intermediary that passes vetting.
Vetting and onboarding decisions are typically operational activities owned by management or a compliance function. The board or a designated committee generally oversees the adequacy of the program and its governance rather than approving individual counterparties, though specific arrangements vary by entity.

Best practices

Adopt a documented risk-tiering methodology that calibrates due diligence depth to factors such as jurisdiction, sector, government interaction, and payment structure, and re-tier when circumstances change.
Verify beneficial ownership and screen against relevant sanctions, PEP, and debarment sources appropriate to the jurisdictions the organization is subject to, treating results as inputs rather than conclusions.
Require and document a clear commercial rationale and an assessment of compensation reasonableness before engaging an intermediary, escalating unusual payment arrangements.
Embed contractual safeguards such as compliance representations, audit and information rights, and termination triggers, tailored to applicable governing law.
Define an approval workflow with clear accountability, keeping onboarding decisions with management or compliance while positioning the board or a committee for program oversight.
Maintain a retrievable audit trail of due diligence, decisions, approvals, and refresh activity to support demonstrability and assurance reviews.