Business ethics code and anti-corruption policy: a worked example

What a business ethics and anti-corruption code actually is

A business ethics and anti-corruption code is a written statement of what a company will and will not do when money, a gift, or a business decision are on the table. It names specific behaviour: not paying a bribe, not accepting a facilitation payment, disclosing a conflict of interest before a transaction rather than the general aspiration to "act with integrity."

The document usually sits underneath a wider governance or ESG statement, since it covers one narrow area: bribery, gifts, conflicts of interest, fair competition, and money-laundering risk. A separate policy typically covers safety, another covers data protection, and the ethics code covers only this ground.

A procurement or compliance reader asks for this document first because it is the fastest way to check whether a supplier has thought through corruption risk at all, before checking whether the company has actually followed it. A code with no named limits, no gift value, no named decision-maker for a conflict, usually signals that second question was never asked either.

For a small company, an ethics code is often drafted the same week as a data protection policy and a complaints procedure, because a customer's vendor due-diligence questionnaire tends to ask for all three at once, under three different names.

Which law actually pushes a company toward one

No single EU regulation requires every company to publish an anti-corruption code. The clearest legal trigger sits in the UK Bribery Act 2010, section 7: a "relevant commercial organisation" is guilty of an offence if a person associated with it bribes someone to obtain or keep business, or a business advantage, for the organisation. The only defence is proving the organisation had "adequate procedures" in place to prevent that conduct, and the Act reaches beyond UK-incorporated companies: any company carrying on business, or part of a business, in the UK can fall within its scope regardless of where the bribery happened.

The UK Ministry of Justice's own statutory guidance sets out what "adequate procedures" means in practice, through six principles: proportionate procedures, top-level commitment, risk assessment, due diligence on partners, communication and training, and monitoring and review. A written code is the natural output of the first principle, and training staff on it satisfies the fifth.

Internationally, the OECD Anti-Bribery Convention binds 46 signatory states to criminalise bribery of foreign public officials, but it binds governments, not companies directly. A company is bound only through its home state's own implementing law.

Lithuania has its own Law on Prevention of Corruption, which states its purpose covers corruption prevention "in the civil service and the private sector." Its concrete mandatory measure, a corruption risk analysis, is defined, in the version of the text available for this article, as applying to state and municipal institutions rather than to private companies generally. That reading rests on an older consolidated version of the law, since the official legal register blocked automated access during research, and has not been checked against the current text by a lawyer. A private company remains free to adopt the same discipline voluntarily, which is what a code like EK-1 does.

What belongs in a workable code of conduct

A working code names four things a general integrity statement usually skips: a gift and hospitality limit stated as a number, a facilitation-payment rule with no stated exceptions, a conflict-of-interest process naming who decides, and a reporting channel for anyone who sees a breach.

The gift limit matters because "reasonable hospitality" means nothing without a figure attached. A code that names a cap, and states a separate rule for cash and cash-equivalents, gives a person an actual test to apply in the moment rather than a judgement call made under pressure.

A facilitation-payment rule is the clause most codes quietly water down. "Facilitation payments are discouraged" leaves room for a small, informal payment to get a permit processed faster. A code that bans them without exception, and states that the ban travels with the company into every country it works in regardless of local custom, closes that gap.

A working code also states how the company talks about competitors: in facts, without disparagement, and without using information it was not entitled to obtain. The reporting channel is usually a cross-reference rather than a repeated clause: the ethics code names the breach, and a separate complaints or whistleblowing procedure carries the deadlines and confidentiality rules for actually handling a report.

What to check when you are reading someone else's

Look for a number, not an adjective. "Modest gifts are permitted" says nothing useful; "gifts are accepted only as ordinary business courtesy and only under a stated value" gives a reader something to actually test a real gift against.

Check whether cash and gift cards are addressed separately from other gifts. A code that caps a gift over a stated value but stays silent on cash usually has a real gap, since cash is the easiest form of an informal payment to disguise as an ordinary gift.

Check who decides a conflict of interest that involves the person who would normally decide conflicts. A code naming only "the director" as the decision-maker, with no separate route for a conflict involving the director personally, has not actually closed that loop.

Check the review date and whether a named person is responsible for keeping the document current. Then check whether the code claims a specific sales result, reply count, or revenue figure anywhere else on the same company's site: a code that bans dishonest claims about its own product is a stronger signal than one that is silent on the company's own marketing.

What Ripe Leads' EK-1 commits to

Ripe Leads is the trading name of UAB "Kofi Tech." Its ethics and anti-corruption code, document code EK-1, applies to the director, employees, freelance partners and suppliers, and is published at kofitech.eu.

EK-1 bans giving or accepting a bribe, reward or benefit meant to influence a business or administrative decision, a ban that covers intermediaries and allows no facilitation payments "without exception," in every country the company works in, "whatever the local custom." Gifts are accepted only as ordinary business courtesy and only under a value of EUR 50; cash and gift cards are neither accepted nor given at any value; a gift above the limit is returned or logged and passed to the company; no gift or hospitality goes to a public sector representative at all. The director keeps the gift register.

A conflict of interest must be disclosed in writing to the director before a transaction; if the conflict concerns the director personally, the shareholder decides instead. EK-1 bans price, market or client-sharing agreements with competitors and bans using unlawfully obtained competitor or client information. On honest claims, the code states plainly that the company "promises no specific sales results, reply counts or revenue," and that any figure it does present carries its source and its period.

On money, EK-1 requires settlement by bank transfer only, never cash, checks a counterparty's identity and legal registration before contracting, and checks EU sanctions lists before contracting with a foreign counterparty. The full text sits at the EK-1 document on the sustainability page, alongside the twelve other policies it cross-references.

Review cadence and where it lives

EK-1 sets its own review point: the director reviews the code annually and approves any change by order, rather than by informal edit. The code cross-references SKT-1, the company's complaints and reports procedure, for handling an actual breach report, and EIP-1, the training programme whose module M3 teaches the code to every partner within their first 30 days of signing a contract.

The gift register itself is not published, since it would name real transactions and people, but its existence and the director's responsibility for keeping it are stated in the code itself, which is a different thing from claiming the register has never had an entry.

The document is published at kofitech.eu in plain HTML rather than a PDF handed out only on request, alongside all thirteen documents in the same set, which means the commitments are checkable by anyone running vendor due diligence without asking first.

What this document does not prove

EK-1, and the other twelve documents in the same set, are self-authored and approved internally by UAB "Kofi Tech." They are not audited, certified or verified by any third party, and no sustainability label, badge or score is claimed anywhere in connection with them. From 27 September 2026, the Empowering Consumers Directive, (EU) 2024/825, bans a self-awarded sustainability label outright, one more reason these pages carry no badge.

A written ban on facilitation payments is not the same as proof no facilitation payment has ever been made. A reader who needs independent assurance, rather than a company's own written word, should ask what external audit exists, because none is claimed here.