Vendor due diligence is the systematic verification of a prospective supplier against legal, integrity, financial, and operational criteria, conducted as a precondition to the procurer’s engagement of the supplier. Under Iraqi law, the conduct of vendor due diligence is governed by an aggregation of obligations arising under the Anti-Corruption Commission of Integrity Law No. 30 of 2011, the Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015, the Penal Code No. 111 of 1969, and the general principles of prudence reflected in the Iraqi Civil Code No. 40 of 1951. The procurer’s exposure to vendor-related risk is materially affected by the substantive content of the due diligence and by the documentary record retained.
Categories of Due Diligence
Vendor due diligence is conventionally structured into the following categories, each addressing a distinct dimension of vendor-related risk:
- Legal due diligence, addressing the vendor’s legal existence, capacity, and authority
- Integrity and anti-bribery due diligence, addressing the vendor’s compliance record and exposure to corruption-related risks
- Financial due diligence, addressing the vendor’s solvency and capacity to perform
- Technical and operational due diligence, addressing the vendor’s capacity to deliver the contract goods or services
- Sanctions and trade compliance due diligence, addressing exposure to international sanctions and trade restrictions
- Data protection and information security due diligence, where the vendor processes the procurer’s commercial or personal data
The intensity of due diligence in each category is calibrated to the materiality of the engagement and the risk profile of the vendor.
Legal Due Diligence
Legal due diligence is directed to the verification of the vendor’s legal existence and contractual capacity. The principal elements include verification of the vendor’s commercial registration with the Iraqi Companies Registrar under the Companies Law No. 21 of 1997; verification of the vendor’s tax registration and tax compliance status with the General Commission for Taxes; verification of the vendor’s social security registration where the vendor has employees; verification of the vendor’s sectoral licences where the activity requires them; verification of the vendor’s registration as a commercial agent under the Commercial Agency Law No. 79 of 2017 where the vendor is engaged in the importation of goods for trading purposes; and verification of the authority of the persons purporting to represent the vendor in contractual dealings, by reference to the vendor’s constitutional documents and corporate resolutions.
Integrity and Anti-Bribery Due Diligence
Integrity and anti-bribery due diligence is directed to the identification of the vendor’s exposure to corruption-related risks. The Iraqi Penal Code No. 111 of 1969 criminalises bribery in both its active and passive forms at Articles 307 to 314, with substantial penalties for both the briber and the recipient. The Anti-Corruption Commission of Integrity Law No. 30 of 2011 establishes the Commission of Integrity as the principal anti-corruption authority in Federal Iraq, with investigative and referral functions in respect of corruption-related offences. Procurers with foreign group exposure are additionally subject to extraterritorial anti-bribery legislation, including the United States Foreign Corrupt Practices Act of 1977 and the United Kingdom Bribery Act 2010, both of which apply to corrupt payments to Iraqi officials by persons within their jurisdictional reach.
Beneficial Ownership Identification
The identification of the vendor’s beneficial owners is an element both of legal due diligence and of integrity due diligence. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 and its implementing instruments prescribe customer due diligence requirements that include the identification of the natural persons holding a controlling interest in legal-person counterparties. Notwithstanding that the most prescriptive requirements apply to financial institutions, the principles of beneficial ownership identification have become market practice for substantial commercial engagements. The identification record should be sufficient to support the conclusion that no beneficial owner is a public official, a politically exposed person, or a person subject to sanctions, save where the engagement has been specifically authorised on that basis.
Sanctions Screening
Sanctions screening engages the verification that the vendor, its directors, its beneficial owners, and its principal counterparties are not designated under the international sanctions regimes binding on the procurer. The applicable regimes typically include:
- United Nations Security Council sanctions, directly applicable in Iraq through Council of Ministers implementing instruments
- United States OFAC sanctions, engaging procurers with a United States nexus or USD-denominated transactions
- European Union sanctions, engaging procurers with an EU nexus or EUR-denominated transactions
- United Kingdom sanctions, engaging procurers with a UK nexus
The screening record should be retained and refreshed on a periodic basis throughout the engagement, given the dynamic nature of sanctions designations.
Financial Due Diligence
Financial due diligence is directed to the verification of the vendor’s financial standing and capacity to perform. The principal sources include the vendor’s audited financial statements for at least the most recent three financial years, the vendor’s bank references, the vendor’s trade references from existing customers, public registry information including any record of insolvency or enforcement proceedings, and credit reports where available. For substantial engagements, the procurer may require the vendor to procure performance security in the form of bank guarantees, parent company guarantees, or insurance, the form and content of which is governed by the Commercial Code No. 30 of 1984 and the regulations of the Central Bank of Iraq.
Documentation and Retention
The vendor due diligence record should be documented systematically, with each element of verification supported by the source documentation, the analysis, and the conclusion reached. The retention period for the documentation is governed by the Commercial Code No. 30 of 1984 and the tax legislation, and where the engagement is regulated, by the applicable sectoral framework. The documentation should be retrievable in a form that supports its use as evidence in subsequent administrative, civil, or criminal proceedings should they arise.
Risk-Based Calibration
The intensity of vendor due diligence should be calibrated to the risk profile of the engagement, with reference to:
- The materiality of the contract value relative to the procurer’s overall procurement spending
- The nature of the contract goods or services and any specific regulatory engagement
- The jurisdiction of the vendor and the broader geopolitical risk profile
- The nature of the vendor’s interface with public officials in the performance of the contract
- The presence of any indicators of elevated risk identified at the screening stage
Higher-risk engagements warrant enhanced due diligence, including on-site visits, independent integrity investigations, and engagement of specialist advisors.
How We Can Help
Etihad Law Firm advises on the conduct of vendor due diligence in Iraq, including the design of due diligence frameworks calibrated to the procurer’s risk profile, the conduct of legal and integrity due diligence, sanctions and trade compliance screening, beneficial ownership identification, the documentation of due diligence findings, and the structuring of contractual protections informed by the due diligence outcome.