Internal investigations have become a cornerstone of corporate governance for international businesses. For foreign companies operating in Ukraine – whether they have Ukrainian subsidiaries, counterparties, assets, employees, or participate in projects with Ukrainian public or private partners – this tool is of paramount importance.

The Ukrainian legal and business landscape differs significantly from that of many Western jurisdictions. A commercial dispute, tax claim, conflict with a counterparty, pricing issue, or corporate fraud can swiftly escalate into criminal proceedings.

Amid the ongoing war, this risk has intensified: law enforcement agencies are paying heightened attention to public funds, defense procurement, sanctions-related ties, transactions with non-residents, origin of goods, logistics, humanitarian aid, and interactions with the public sector.

Consequently, an internal investigation in Ukraine cannot be viewed merely as a formal compliance procedure. It is a practical defense mechanism for the company, its management, shareholders, employees, assets, and reputation. Its primary objective is not only to establish the facts but also to enable the company to properly assess risks, preserve evidence, prepare for potential scrutiny from law enforcement, and formulate its own reasoned position before investigative authorities shape it on the company’s behalf.

Why Do Internal Investigations in Ukraine Have Their Own Specifics?

In classic international practice, an internal investigation is typically limited to reviewing potential fraud, corruption, conflicts of interest, or violations of internal policies. In Ukraine, a white-collar criminal defense risk is invariably added to this list.

A foreign company may view a certain situation as an internal corporate incident, whereas Ukrainian investigators may see signs of overstatement of the value of goods, tax evasion, money laundering, abuse of office, embezzlement, aiding and abetting a corruption offense, or sanctions circumvention. This is particularly true when a company operates through intermediaries, participates in public procurement, supplies goods to the defense sector, deals with counterparties that have non-transparent ownership structures, or makes payments to non-residents.

The experience of Ilyashev & Partners Law Firm in defending international businesses shows that law enforcement agencies do not always comprehend the specifics of foreign business models. Agent fees may be perceived as a hidden bribe, commercial margins as artificial price inflation, the involvement of a foreign trader as a sham intermediation, and a complex corporate group structure as a method to conceal ultimate beneficial owners. An internal investigation must not only determine whether a violation occurred but also explain the economic substance of the transactions.

When Should a Company Initiate an Internal Investigation?

The most common mistake businesses make is waiting for an official inquiry, a subpoena for interrogation, or a search warrant. In Ukraine, this often means the company has already lost critical time. By the time of the first procedural contact, law enforcement may already have developed its own version of events, obtained documents from banks or counterparties, secured orders from an investigative judge, gathered materials from covert investigative actions, or taken statements from individuals (frequently competitors).

Therefore, an internal investigation should be conducted well before any contact with investigators occurs, or at the very least, immediately upon the appearance of the first signs of scrutiny targeting the company.

Situations involving public funds, the defense sector, critical infrastructure, energy, pharmaceuticals, agriculture, logistics, imports of dual-use goods, or charitable and humanitarian aid require an exceptionally rapid response. In these sectors, even a routine commercial transaction can be subject to criminal-legal assessment.

Conducting Internal Corporate Investigations: A Step-by-Step Algorithm

Ukraine does not have a separate comprehensive law regulating internal corporate investigations; however, this does not mean a company can act arbitrarily. On the contrary, every action taken during an investigation must be evaluated through several legal regimes simultaneously.

An internal investigation in Ukraine must begin with legal planning. The company must define the subject matter, the scope of the investigation, the circle of individuals involved, sources of information, procedures for evidence preservation, rules for accessing materials, and the role of external counsel. For example:

  • access to work email: permissible only if clear corporate IT policies are in place and the employee was notified of them in advance;
  • inspection of gadgets: analyzing a personal phone without the employee’s consent creates a direct risk of allegations of privacy violations;
  • cross-border data transfer: transferring investigative materials to a parent company abroad requires a thorough assessment of personal data processing regulations.

This involves employment law, data protection legislation, criminal law, anti-corruption regulations, corporate law, sanctions restrictions, banking and commercial secrecy, as well as the company’s own internal policies.

The Role of External Counsel in Corporate Investigations

For foreign companies, safeguarding the confidentiality of investigative materials is a critical issue. In many Western jurisdictions, companies are accustomed to working within the framework of legal privilege. Ukraine lacks a full equivalent of common law privilege; however, the institution of attorney-client privilege exists.

This is precisely why external counsel is retained to coordinate sensitive internal investigations. This not only guarantees the independence of the review from local management but also protects legal analysis, defense strategies, interview notes, and draft reports from seizure by law enforcement.

Important Caveat: Source business documentation (contracts, invoices, certificates of acceptance, internal orders) does not become privileged solely because an attorney has reviewed it. The structure of the investigation must clearly separate legal analysis from ordinary commercial documents.

Preservation of Evidence in Corporate Investigations

Once the decision to initiate an investigation is made, the company must ensure the preservation of relevant evidence. In international practice, this is known as a legal hold. In Ukraine, this stage is of particular significance, as documents, electronic correspondence, messenger chats, accounting databases, and corporate devices may subsequently become vital not only for the internal report but also for criminal proceedings, litigation, audits, or communication with banks.

A legal hold must cover:

  • corporate email, cloud storage, and document management systems (CRM, ERP);
  • work communications in messengers (Telegram, WhatsApp, Signal, Slack, Teams), where in Ukrainian practice, key commercial terms and logistics chains are frequently coordinated;
  • server backups and corporate devices.

Ukrainian business practice possesses a distinct feature: a substantial portion of communication occurs not only via email but also through messengers, which are often used to agree on commercial terms, discuss payments, logistics, meetings, procurement, or interaction with counterparties. Consequently, a significant volume of evidence that law enforcement believes confirms the commission of financial crimes is obtained by seizing personal phones and other personal equipment.

The optimal approach depends on whether the device is corporate, whether a corporate device usage policy exists, whether the employee was warned about potential monitoring, whether they consented to personal data processing, and whether there is a risk of violating their privacy.

How to Correctly Conduct Employee Interviews?

Interviews are among the most critical components of an internal investigation. It is during conversations with employees that the true logic of events, the roles of specific individuals, informal agreements, reasons for decision-making, and details absent from documents are often uncovered.

At the same time, interviews in Ukraine must be conducted with extreme caution. An employee may simultaneously be a source of information, a potential wrongdoer, a future witness, or even an individual who will later receive the status of a suspect in criminal proceedings.

Before the interview, it is advisable to explain to the employee that the conversation is being conducted in the company’s interests, that the attorneys represent the company rather than the employee personally, that the information provided may be used by the company to protect its rights, and that in certain instances, the company may decide to disclose specific information to auditors, regulators, or investigative authorities.

If there is a risk that the employee may disclose information indicating their own involvement in an offense, it is prudent to advise them to obtain independent legal counsel. This is important not only for the protection of the employee but also for the quality of the investigation: information obtained under pressure or without proper clarification of roles can subsequently be called into question.

Which Law Enforcement Agencies Might a Foreign Business Encounter in Ukraine?

The greatest distinction between Ukraine and many other jurisdictions is the close link between corporate incidents and the criminal process. Foreign companies can fall within the purview of any investigative authority in Ukraine: the Economic Security Bureau (ESB), the National Anti-Corruption Bureau (NABU), the State Bureau of Investigation (SBI), the National Police, the Security Service of Ukraine (SBU), or the Prosecutor’s Office.

  • The ESB typically focuses on tax and economic matters.
  • NABU focuses on corruption risks, public funds, state-owned enterprises, defense procurement, and high-ranking officials.
  • The SBI may become involved if the case concerns public officials, law enforcement officers, or military personnel.
  • The SBU intervenes if there is an element of national security, sanctions, collaboration risks, critical infrastructure, or the defense sector.

The golden rule of interaction is to prevent the investigation from being the first and sole party to shape the version of events. Documents explaining the economic logic of transactions, the reality of deliveries, and pricing transparency must be systematically compiled well before an investigator issues the first subpoena.

Searches and Asset Seizures of Foreign Businesses in Ukraine

For businesses in Ukraine, a search remains one of the most intrusive tools in the criminal process. It can serve not only an evidentiary purpose but also a factual operational one: the seizure of equipment, servers, phones, and documents, or blocking office access can significantly disrupt company operations.

Any foreign company operating in Ukraine must have an action plan for such an eventuality. This is a practical instruction manual for staff:

  • who is the first to meet the investigators and verify the court order (validity period, exact address, company name, and the list of items authorized for seizure);
  • who immediately contacts the attorneys;
  • how to record the actions of law enforcement officers (all violations must be entered into the search record).

During a search, employees must remember that a search is not an interrogation. They are under no obligation to answer any questions from investigators without an attorney present. The seizure of equipment must be monitored separately. It is critical for the business that the search record specifies the exact names of devices, serial numbers, quantity of documents, data carriers, and other identifying features. Regarding seized cash, the serial numbers of all banknotes must be listed in the record.

Following a search, the company must immediately assess the possibility of challenging the investigators’ actions, filing motions for the return of property, or lifting the seizure.

Asset Seizure and Business Continuity

Within criminal proceedings, accounts, real estate, vehicles, equipment, inventory, corporate rights, or other assets may be seized. For a foreign company, this can be even more hazardous than the investigation itself, as asset seizure can paralyze operations, breach contracts, and disrupt supplies.

Therefore, an internal investigation must include an asset vulnerability assessment. The company must understand where critical data is stored, whether backups exist, whether operations can continue if servers are seized, whether documents proving the lawful origin of funds and property are available, and what legal actions will need to be taken in the event of a seizure.

Practice demonstrates that returning seized property or lifting an asset seizure in Ukraine often requires prolonged and systematic litigation. This is why preemptive preparation is substantially more effective than reacting after an actual business shutdown has occurred.

Sanctions Risks for Foreign Businesses in Ukraine

Since 2022, the sanctions block has become a central element of internal investigations in Ukraine. Foreign companies must verify not only the formal ownership structure of counterparties but also actual control, the history of beneficial ownership changes, supply chains, ultimate recipients of goods, logistics, payments, use of intermediaries, and potential diversion of products.

Particular attention should be paid to dual-use goods, technologies, equipment, electronics, components, vehicles, energy equipment, and products that could potentially be used for military or sanctions-sensitive purposes.

The Reputational Dimension

In Ukraine, reputational risk frequently arises long before any judicial decision is reached. Law enforcement agencies actively utilize press releases, official websites, Telegram channels, and public statements. Such announcements sometimes employ phrasing that creates an impression of proven guilt prior to the conclusion of the investigation.

For a foreign company, this can have severe consequences. A negative publication in Ukraine may be noticed by a bank in the EU, an auditor, an insurer, an investor, a parent company, or a regulator in another jurisdiction. Therefore, an internal investigation must incorporate a reputational strategy. The legal position must explain the facts, while the communication strategy must not compromise the white-collar defense.

The Final Report of an Internal Investigation

The outcome of an internal investigation is typically a report. The objective of the report is to record the methodology, facts, sources of information, legal assessment, risks, and recommendations. The phrasing must be cautious. If a certain circumstance is not conclusively proven, it should not be stated categorically.

This is especially critical if the report might potentially be disclosed to auditors, banks, foreign regulators, the parent company, or investigative authorities. Inapt phrasing can generate greater risks for the company than the facts themselves.

Following the conclusion of the investigation, the company must decide how to handle its findings. In some cases, it is advisable to notify the parent company, shareholders, auditor, bank, insurer, foreign regulator, or Ukrainian law enforcement. In other instances, disclosure may create additional risks.

Coordination with Foreign Legal Counsel in Internal Investigations

Most serious investigations involving foreign companies possess a cross-border dimension. Facts established in Ukraine may have implications under the FCPA, UK Bribery Act, US, EU, or UK sanctions legislation, AML rules, export control, or group internal policies.

Therefore, Ukrainian lawyers must explain Ukrainian criminal procedural risks, rules of search and seizure, interrogations, personal data, employment law, and interaction with investigative bodies to foreign counsel. Foreign lawyers, in turn, must assess the consequences for the group in other jurisdictions. It is precisely this coordination that prevents a situation where a decision that is correct from the perspective of one jurisdiction creates a problem in another.

The best strategy for international business in Ukraine is to act preemptively. A company that identifies internal vulnerabilities promptly, retains professional local attorneys, and coordinates its actions with foreign counsel stands a significantly better chance of maintaining control over the situation and protecting its assets than a business that only begins to react after a visit from law enforcement.

Volodymyr Adonin, Attorney at Ilyashev & Partners Law Firm