Compliance with Laws Clause: Scope, Carve-Ins, and Enforcement

A compliance with laws clause is a promise that each party will follow the laws that apply to what it does under the contract. It reads like boilerplate, but it is a live covenant. A breach can trigger indemnity, give the other side a right to terminate, and pull a regulator's problem into your contract. The whole fight is over scope: which laws, qualified by what, and with which named regimes pulled in by force.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

TL;DR

• A compliance with laws clause is a covenant, not a representation. Each party promises ongoing compliance with the laws that apply to its performance for the life of the contract.
• The core negotiation is scope: "all applicable laws" (broad, favors the recipient of the promise) versus "all material applicable laws" or a named list of specific regimes (narrow, favors the party making the promise).
• High-risk deals carve in named regimes by name: anti-corruption (the FCPA), economic sanctions, export controls, data protection, and anti-money-laundering. Naming them removes the "we didn't know that applied" argument.
• Knowledge and materiality qualifiers ("to its knowledge," "in all material respects") shrink the covenant. They are reasonable in some places and a trap in others, especially around sanctions and bribery.
• Breach of this clause usually feeds two other clauses: indemnification (you pay for the fallout) and termination (the other side walks). Read all three together or you will misprice the risk.

What a compliance with laws clause actually does

The clause does one main thing and two things by reference.

The covenant itself. It obligates each party to comply with the laws applicable to its own performance under the agreement. It is forward-looking and continuing, unlike a representation, which speaks as of a single date. That distinction matters: a representation is tested as of its date, while a covenant keeps applying, so a violation that continues keeps breaching it.

It allocates regulatory risk. When one party violates a law in the course of performing, the clause is the contractual hook that shifts the cost. Without it, the wronged party may have no contract claim at all, just a regulator and a headache.

It activates other remedies. A compliance breach is the trigger that other clauses point back to. Indemnities often cover "losses arising from a party's breach of its compliance obligations." Termination rights often list a compliance breach as cause. The clause is small, but it is wired into the parts of the contract that cost money.

Why it matters: the dollars at stake

Picture a US company that hires an overseas sales agent to win government contracts. The agreement has a one-line compliance clause: "Agent shall comply with all applicable laws." The agent pays a bribe to land a deal.

• If the clause names the FCPA and pairs with an indemnity, the company has a contract claim for its investigation costs and a clear right to terminate for cause. Whether a contract can also shift the company's own fines to the agent depends on the governing law and public policy. Not verified in our October 2026 review. Check the governing state's law.
• If the clause is silent on anti-corruption and the agent is judgment-proof, the company still faces the regulator, eats the cost, and may struggle to terminate cleanly.

FCPA resolutions can be very large. In December 2019, Ericsson agreed to pay more than $1 billion to resolve a parallel DOJ and SEC FCPA case (SEC press release 2019-254). The clause does not stop the conduct, but it decides who carries the loss and whether you can exit fast. That is why a covenant that looks like filler gets real attention in regulated and cross-border deals.

Where FCPA enforcement stands (as of 12 October 2026). On 10 February 2025, Executive Order 14209 directed the Attorney General, for 180 days, to "cease initiation of any new FCPA investigations or enforcement actions" unless an exception was made, and to issue updated guidelines. The Deputy Attorney General's guidelines of 9 June 2025 then set the factors prosecutors weigh (cartel and transnational criminal links, harm to U.S. competitors, national security, and "strong indicia of corrupt intent") and require authorization from the Assistant Attorney General for the Criminal Division (or a more senior official) before any new FCPA investigation. Neither document amends the statute, and the guidelines say they create no rights enforceable against the United States. DOJ's FCPA page, updated 18 August 2026, still presents the anti-bribery provisions as law. On 10 March 2026 DOJ also issued a Department-wide corporate enforcement policy for criminal cases, which rewards voluntary disclosure, cooperation and remediation. A compliance covenant is a private promise between the parties, so it does not depend on how active enforcement is in a given year. Read the current DOJ position before you rely on any enforcement assumption.

Who wants what

The pattern: the party relying on the promise wants a broad, strict, forward-looking covenant tied to strong remedies. The party giving the promise wants the smallest, most qualified version it can defend.

Market-standard language

A simple mutual version reads close to this:

Each party shall comply with all laws, rules, and regulations applicable
to its performance of this Agreement.

That is the broad baseline. The party making the promise usually wants to soften it with a materiality qualifier:

Each party shall comply, in all material respects, with all laws
applicable to its performance of this Agreement.

A regulated or cross-border deal adds a carve-in that names the regimes the parties actually care about. The named list is the heart of the clause:

Without limiting the foregoing, each party shall comply with all
applicable anti-corruption laws (including the US Foreign Corrupt
Practices Act), economic sanctions and trade-embargo laws, export-control
laws, data-protection and privacy laws, and anti-money-laundering laws.

Naming the regimes does two things. It signals that these are not afterthoughts, and it undercuts the argument that a party did not realize a given law applied to its work. The phrase "without limiting the foregoing" keeps the general "all applicable laws" covenant intact while spotlighting the high-risk ones.

The negotiation: standard, fallback, walk-away

Treat scope and remedy as separate trades.

The workhorse compromise keeps the general covenant broad and holds named regimes to a strict standard. A knowledge or materiality qualifier is allowed only on the diffuse, hard-to-track general laws. A party can reasonably say it cannot guarantee perfect compliance with every minor regulation everywhere. It cannot reasonably ask for a knowledge qualifier on whether it paid a bribe.

Common variations (and the language that creates them)

Small wording changes move real risk. The high-frequency variations:

• All laws vs material laws. Dropping in "in all material respects" turns a strict covenant into one that only bites on significant violations. It is the single most common softener.
• Named-regime carve-in. Adding "including the Foreign Corrupt Practices Act, economic sanctions laws, and export-control laws" elevates those regimes and undercuts the "did not know it applied" argument.
• Knowledge qualifier. "To its knowledge" converts a strict duty into one limited by what the party actually knew. Reasonable for obscure local rules, dangerous for sanctions and bribery.
• One-sided vs mutual. A clause that binds only the vendor (or only the supplier) when the deal is presented as balanced. Watch the subject of each sentence.
• Future-law lock. "Laws in effect as of the Effective Date" freezes the covenant at signing, so a mid-term regulatory change is not the promising party's problem. Buyers usually want "as amended from time to time."
• Permits and licenses add-on. Many clauses extend past "laws" to require each party to "obtain and maintain all permits, licenses, and authorizations" needed to perform. This is a meaningful expansion, not a synonym.

A tight, balanced clause that names the regimes and keeps the general covenant broad reads close to this:

Each party shall comply with all laws applicable to its performance,
including, without limitation, all applicable anti-corruption, sanctions,
export-control, data-protection, and anti-money-laundering laws, in each
case as amended from time to time, and shall obtain and maintain all
permits and authorizations required for its performance.

Jurisdiction and enforceability notes

Compliance with laws clauses are routinely enforced between sophisticated commercial parties, but a few points are worth flagging:

• It does not create new statutory liability. The clause makes a legal violation a breach of contract between the parties. It does not change what the underlying law requires or what a regulator can do. You still owe the regulator regardless of how the clause reads.
• You cannot contract around mandatory law. A clause cannot waive a party's own legal duties to the government or to third parties. It only allocates the contractual consequences of a breach between the two signatories.
• Named-regime laws are largely federal and apply on their own terms. US anti-corruption law (the FCPA reaches issuers, domestic concerns and certain others under 15 U.S.C. 78dd-1 to 78dd-3), sanctions (administered by OFAC), and export controls apply to the persons they cover whether or not the contract mentions them. Naming them adds a contract remedy; it does not expand or shrink the statute. The newer Foreign Extortion Prevention Act (18 U.S.C. 1352, enacted July 2024) makes it a crime for a foreign official to demand a bribe from the same classes of covered persons, so it belongs on an anti-corruption list as well (DOJ FCPA Unit page).
• The intent standards differ, and a contract knowledge qualifier does not track them. OFAC says it "may impose civil penalties for sanctions violations based on strict liability," meaning a person can be liable "even if such person did not know or have reason to know" the transaction was prohibited (Tri-Seal Compliance Note, 6 March 2024). Under the main sanctions statute the civil penalty applies to "any person who commits an unlawful act," while the criminal penalty requires that the person act "willfully" (50 U.S.C. 1705(b) and (c)). The export-control statute is built the same way (50 U.S.C. 4819: a "willfully" requirement for the criminal penalty, and a civil penalty "for each violation"). The FCPA anti-bribery provisions are different: they require a payment made "corruptly" (15 U.S.C. 78dd-1(a)), and for payments passed through a third party they define "knowing" to include awareness of "a high probability" that the money will reach a foreign official (78dd-1(f)(2)). A "to its knowledge" qualifier in the contract can therefore leave a gap on sanctions, and if it is read as actual knowledge it may be narrower than the FCPA's own standard.
• Sanctions exposure has a long tail. The limitation period for both civil and criminal sanctions enforcement under 50 U.S.C. 1705 is 10 years from the latest violation (1705(d)). Consider that when you set audit, record-keeping and survival terms.
• Governing law still controls interpretation. How a court reads "material," "applicable," or "knowledge" depends on the controlling state's law and the facts.

This is general information, not legal advice for a specific deal, and the law here moves. We reviewed the statutes and policy documents cited above on 12 October 2026; confirm the current statutes, regulations, and enforcement posture against the controlling law before you rely on any of it. For the broader risk-spotting approach, see our contract risk assessment framework.

Review checklist: red flags to catch

• The clause is one-sided, binding only your side, when the deal is presented as mutual.
• Scope is narrowed to "material laws" with no named-regime carve-in, in a deal that touches anti-corruption, sanctions, or data.
• A knowledge qualifier ("to its knowledge") sits on the named high-risk regimes, not just the diffuse general laws.
• Laws are frozen to the effective date, so mid-term regulatory changes fall on you.
• The compliance breach has no link to indemnity or termination, so the covenant has no real remedy behind it.
• The clause covers "laws" but omits permits and licenses the counterparty needs to perform legally.
• Cross-border deal with no anti-corruption, sanctions, or export language at all.

How it interacts with other clauses

The compliance with laws covenant is wired into several other provisions. Read it alongside:

• Indemnification: the clause that turns a compliance breach into a recoverable loss. A covenant with no indemnity behind it is weak.
• Representations and warranties: the point-in-time cousin. A compliance rep speaks at signing; this covenant continues for the term. Deals often use both.
• Termination: a compliance breach is a common "for cause" trigger. Check whether it is immediate or subject to a cure period.
• Data protection: privacy law is one of the named regimes this clause should reach, and the two are often cross-referenced.

For a step-by-step on building a clause set, see our guide on how to draft a contract, and browse the full clause library.

FAQ

What is a compliance with laws clause? It is a contract covenant in which each party promises to follow the laws that apply to its performance under the agreement. It is ongoing and forward-looking, and a breach typically feeds the indemnity and termination clauses.

Is it a representation or a covenant? It is usually a covenant, a continuing promise that lasts the life of the contract. A representation speaks as of a single date. Many deals include both: a compliance representation at signing and a compliance covenant for the term.

Should the clause say "all laws" or "material laws"? The party relying on the promise wants "all applicable laws" with no qualifier. The party making the promise wants "in all material respects." A common middle ground keeps the general covenant broad. It then applies materiality only to diffuse general laws, not to named high-risk regimes.

What are named regimes and why carve them in? Named regimes are specific bodies of law called out by name, commonly anti-corruption (the FCPA), economic sanctions, export controls, data protection, and anti-money-laundering. Naming them signals they are not afterthoughts and removes the argument that a party did not realize the law applied.

Is a knowledge qualifier ("to its knowledge") reasonable? Sometimes. It can be fair for obscure local rules a party cannot fully track. It is risky on sanctions, where civil liability can be strict, and on bribery, where the FCPA's own knowledge standard for third-party payments is broad. There, a knowledge qualifier can leave a gap between the contract claim and the actual exposure.

Does the clause make me liable to the regulator? No. The clause allocates the consequences of a legal violation between the two signatories. It does not change what the underlying statute requires or what a regulator can do. You owe the government whatever the law says regardless of how the clause is drafted.

What happens if a party breaches it? It depends on how the contract is wired. A compliance breach commonly triggers an indemnity (the breaching party covers the resulting losses) and a termination right (the other party can exit, sometimes after a cure period). Without those links, a breach is just an ordinary breach of contract.

Does it cover future changes in the law? Only if it says so. Language like "as amended from time to time" keeps the covenant current as laws change over the term. Language tied to "laws in effect as of the Effective Date" freezes it at signing, shifting the cost of regulatory change to the relying party.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.