Your New Plant Comes with Dozens of Vendors Holding Remote Access – And Procurement Owns 7% of the Problem
Industrial organizations authorize an average of 77 third parties into their OT environment; a quarter...
READ ARTICLE →
For fifteen years, local content compliance on a capital project had a simple shape. The operator signed a plan with the regulator, the plan covered the contracts the operator awarded, and the evidence trail ran from the operator’s purchase orders to the operator’s annual return. Everything below the parties the operator actually paid was somebody else’s problem.
That shape has broken. Across a dozen jurisdictions now hosting large mining and hydrocarbons capital projects, the subcontractor has become a regulated person in its own right – with its own ownership test, its own registration, its own reporting obligation and, in several jurisdictions, its own penalty. And in the jurisdiction enforcing this hardest, the penalty for a non-compliant subcontractor land on the operator.
The Democratic Republic of Congo’s subcontracting regime is not new. Loi n° 17/001 du 8 février 2017 reserves subcontracting activity to Congolese-capital enterprises headquartered on national territory (Article 6), prohibits subcontracting more than 40% of the total value of a contract (Article 11), requires an advance of at least 30% of the subcontract before work begins (Article 16), and – critically – applies to all sectors of activity, not just mining.
What is new is the enforcement. Consider the record of the last twelve months, drawn from the regulator’s own published decisions and contemporaneous Congolese reporting:
Two features of this campaign deserve a procurement head’s full attention.
First, the instrument is contract cancellation, not a fine. No monetary penalty has been publicly recorded against a mining operator in the DRC in 2026. What ARSP does instead is order live contracts terminated and vendor files purged, mid-execution, on packages already awarded and mobilized. For a project in construction, that is a schedule and continuity-of-supply event, not a cash event – and it arrives without a remobilization window.
Second, the statutory liability sits on the buyer. Article 28 of Loi 17/001 attaches a fine of 50 to 150 million Congolese francs, administrative closure of the enterprise for up to six months, and automatic nullity of the offending contract – to the enterprise principale. The operator carries the penalty for the supplier’s defect. Congolese press reporting indicates the fine band was raised to 200–300 million CDF by an amending law of 30 June 2026; that amendment is reported by two independent Congolese outlets, but no gazette text could be obtained, so treat the new band as reported rather than settled.
The ground is also about to move again. On 30 June 2026 the DRC promulgated Loi n° 26/018 sur le contenu local, a cross-sectoral local content framework whose Article 40 sets entry into force six months after promulgation; ARSP and the public procurement regulator ARMP are working to 1 January 2027 and are still drafting harmonized implementing texts. Anyone scoping a DRC capital project today is scoping against rules that will change before first concrete – and the operative percentages are not yet verifiable from statutory text, which is itself the planning problem.
The pattern generalises, and it splits into four distinct legal mechanisms that should not be conflated.
Direct binding – the statute names the subcontractor as a duty-bearer. Senegal’s mining local content law, Loi n° 2022-17 du 23 mai 2022, Article 2: “Tout contractant, sous-traitant, prestataire de services et fournisseur, participant aux activités minières, est soumis aux dispositions de la présente loi.” Every contractor, subcontractor, service provider and supplier participating in mining activities is subject to the law. Article 7 then prescribes a sanction aimed at the subcontractor personally – exclusion from the tendering platform and a prohibition on concluding any contract connected with mining activities. Senegal’s implementing decree goes further still, defining sous-traitant de rang 1 and sous-traitant de rang 2 as separate regulatory categories.
Nigeria has had the same architecture since 2010, and it is still the bluntest text in the field. NOGICD Act section 68: “An operator, contractor or sub-contractor who carries out any project contrary to the provisions of this Act, commits an offence and is liable upon conviction to a fine of five per cent of the project sum for each project in which the offence is committed or cancellation of the project.” Note the base: not the offender’s own contract value, but the project sum. And section 65 requires the operator to ensure its partners, contractors and subcontractors are contractually bound to report Nigerian content information – the flow-down template that Ghana and Tanzania later copied almost word for word.
Flow-down with joint and several liability. Mozambique’s Lei n.º 9/2026, published 3 June 2026 and in force on publication, requires covered entities to ensure through contractual mechanisms that their subcontractors comply, “sob pena de responsabilidade solidária pelo incumprimento” – failing which they are jointly and severally liable. The 90-day deadline for implementing regulations expired around 1 September 2026 and, as at late September, no decree had been published. Operators are therefore bound by an in-force joint-and-several liability with no procedural rules governing how it will be assessed.
Licensing as a precondition to engagement. Côte d’Ivoire’s Loi n° 2022-408, Article 7, subordinates the carrying on of petroleum subcontracting to an agrément issued by ministerial order, valid a maximum of three calendar years. Congo-Brazzaville’s Décret n° 2019-343 requires an autorisation d’exercer from the hydrocarbons minister after administrative enquiry, valid two years – and its Article 16 states plainly that any contract awarded in breach is void. Guinea’s Loi L/2022/0010/CNT requires cotraitance and subcontracting agreements in road works to be submitted to the regulator for approval before they take effect.
And a mandatory floor, not a cap. Cameroon’s Loi n° 2025/010 du 15 juillet 2025 is the most aggressive instrument found anywhere. It is a general subcontracting statute – not a sectoral local content law – and Article 6 expressly extends it to contracts in the mining, gas, petroleum and energy sectors. Article 10 reserves subcontracting to Cameroonian SMEs at least 51% nationally held. Article 18(1) obliges any large Cameroonian or foreign bidder to reserve at least 40% in value of the service for subcontracting above a regulatory threshold. Article 12 makes the regime recursive: “le sous-traitant de second rang est soumis lui-même aux mêmes conditions” – the tier-2 subcontractor is subject to the same conditions, and the tier-1 subcontractor is treated as a prime toward its own suppliers. Sanctions under Article 51(2) run to 25–50% of the value of the contract, rising to 50–75% under Article 52 for concealed subcontracting, with 12–24-month debarment on repetition.
Tanzania quantifies the failure precisely. The Mining (Local Content) Regulations 2018 require each contractor, subcontractor or licensee to bind its own downstream parties to report local content information to it, and to open its records to the Commission (Reg. 39). Failure to do so carries an administrative penalty of TZS 100,000,000 in the first instance plus 5% per day of continuing contravention; failure to furnish records on request carries TZS 2,000,000,000 plus 10% per day. The 2025 amendments (GN 563 of 2025) lowered the sole-source notification threshold to the equivalent of USD 10,000 and now require contractors and subcontractors to submit their joint venture agreements to the Mining Commission for approval before operations commence. Reg. 8(6)’s 20% indigenous JV equity rule bites on anyone supplying a subcontractor – that is tier three.
Guyana’s Local Content Act 2021 imposes on a Sub-Contractor, in its own name, the duty to file a Local Content Master Plan within four months of entering an agreement with a Contractor or another Sub-Contractor – and the penalty schedule runs to GYD 50 million for operating without the minimum local content requirement.
Here is what makes this genuinely difficult rather than merely tedious. There is no published benchmark for how much of a refinery or mine build sits below tier one, or how many tiers deep it goes. Searches across the construction and project research literature – CIOB, Build UK, McKinsey, the Construction Industry Institute, IPA – produce nothing sector-specific. The nearest credible figure is a 2013 UK government study of building construction which found that 50–75% of total project value sits with tier-2 subcontractors and the main contractor’s site team, that delivery commonly runs at least three tiers deep, and that 50–70 tier-2 packages on a large project “is not uncommon.”
That is UK buildings, not an EPC refinery. Which means a procurement head in Kinshasa, Dar es Salaam or Douala cannot presently answer, from any published source, the question the law now puts to them: what percentage of my project value is exposed to subcontractor-level local content liability, and who are those parties?
Regulators in eight jurisdictions have made the subcontractor a duty-bearer while the industry has no agreed measure of the population being regulated. That gap is the exposure.
The obligations converge on a single operational requirement, and it is a data requirement before it is a legal one. A capital project now needs, maintained and current rather than collected once at award:
Most vendor master files were never built to hold any of this. They hold the parties the buyer pays, the certificates those parties held on the day they were onboarded, and a spend total. They do not hold the tier below, they do not hold expiry dates as live obligations, and they cannot produce, on 30 days’ notice from a regulator, a defensible file showing which subcontractors were engaged on which packages under which eligibility test. This is the problem Dharas was built for carrying supplier eligibility, certificate validity and sub-tier relationships as maintained data across the project lifecycle, rather than as a document folder assembled after the fact.
One closing distinction, because getting it backwards is expensive. These regimes do not all put liability in the same place. Congo-Brazzaville’s hydrocarbons code, Article 22, provides that the contractor “reste seul responsable” – remains solely responsible – for performance, leaving the subcontractor invisible to the regulator. Mozambique and Saudi Arabia impose liability on the prime alongside the subcontractor. The DRC imposes the Article 28 penalty on the principal in place of its supplier. Senegal penalizes the subcontractor personally, by excluding it from the market.
Same trend, four different answers to the question of who pays. The only defence that works in all four is knowing, at all times, who is actually working on your project and on what evidence they were allowed to.
Industrial organizations authorize an average of 77 third parties into their OT environment; a quarter...
READ ARTICLE →
A steel importer settled at $19 million in May 2026 for declaring Chinese and Turkish...
READ ARTICLE →
Local content workforce quotas now gate bid award and carry buyer liability. A 2026 review...
READ ARTICLE →