How to prepare for searches and other investigative actions: a checklist for defence companies from lawyer Anastasiia Didenko

In the past month alone, several high-profile searches have taken place at Ukrainian defence technology companies. On 7 July, the State Bureau of Investigation (SBI) conducted searches at more than 40 locations linked to Vyriy Industries and its founder and CEO, Oleksii Babenko. On 9 July, Ukrainian Armor reported that its deputy director had been searched and assaulted. During the final week of the month, the Prosecutor General’s Office searched the offices of the ARMADA Association and the homes of individuals involved in organising a defence event whose participants were caught in a Russian missile strike.

In this column for Defender Media, Anastasiia Didenko, Head of the Anti-corruption & Compliance Practice at LCF Law Group, explains how defence companies should respond to investigative actions and how to prepare for searches.

Recently, companies operating in Ukraine’s defence industry have come under particularly close scrutiny from law enforcement agencies. The reasons are clear. Today, the defence sector involves enormous budgets, is of strategic importance to the state, and therefore attracts heightened scrutiny of every transaction—from the procurement of components to payments to suppliers. Authorities monitor not only whether a contract has been fulfilled, but also every step taken to fulfil it.

At the same time, defence companies operate under objectively challenging conditions. Legislation changes almost every month. Government contracts must be completed within tight deadlines. Supply chains involve dozens of companies, many of them foreign, operating under different jurisdictions and documentation standards. Financial flows are substantial and move quickly. Taken together, all of this can become the subject of a pre-trial investigation—even when every aspect of a company’s business has been conducted entirely lawfully.

It is important to distinguish between two separate issues.

The first is whether an actual offence has occurred.

The second is whether the company is prepared for unexpected investigative and procedural actions.

Practice shows that searches, account freezes, document seizures, questioning of executives, and, in some cases, formal criminal charges are a reality for defence companies. When investigators arrive at a company’s premises, what matters is not only how impeccably the business has been run, but also whether the company knows exactly what to do in the first few minutes.

Proper preparation should therefore be viewed as an essential element of a company’s risk management system, helping minimise both legal and reputational damage.

First and foremost, companies should know that a search must generally be conducted on the basis of a court warrant, which remains valid for no longer than one month. The warrant must clearly specify the correct address, the company’s legal name and its registration number in the Unified State Register (EDRPOU). Moreover, the court must provide an exhaustive list of the items, documents or persons for which the search has been authorised.

A search without a warrant is permissible only in exceptional circumstances, such as an immediate threat to life, the risk of evidence being destroyed, or the hot pursuit of a suspected offender. However, companies should remember that the absence of a genuine emergency does not always prevent law enforcement officers from relying on this formal justification.

During searches, investigators are typically most interested in electronic devices (servers, laptops, mobile phones and flash drives), documentation (primary procurement records, lease agreements, company seals, financial records and client information), and cash, including both officially recorded company funds and unaccounted cash.

During a search, companies and their employees enjoy several important procedural safeguards that should always be kept in mind:

• Every individual has the right to legal assistance from a lawyer at any stage of the search, and investigators may not restrict this right.
• If a personal search is conducted, investigators must wait up to three hours for the lawyer to arrive. A personal search may only be carried out by an officer of the same sex as the individual being searched.
• Anyone subject to a search has the right to request official identification from every law enforcement officer present. Their identities must correspond to those listed in the court warrant.
• The search must be video recorded, and its results documented in an official search report.
• Company employees are not required to comply with any instructions from investigators except lawful requests to open premises or storage areas or to step away from the search location.
• Employees are under no legal obligation to answer investigators’ questions or provide explanations during the search itself. Questioning is a separate procedural action, and individuals must be notified of it no later than three days in advance.
• Investigators are strictly prohibited from preventing those present from using communication devices or from accessing food and water.

To prepare for a search, companies should take the following preventive measures:

• Appoint designated employees responsible for communicating with law enforcement officers during investigative actions.
• Conduct internal training for staff on how to respond during searches and questioning.
• Develop an internal response protocol specifying who makes decisions and who speaks on behalf of the company.
• Review and organise all primary documentation relating to defence procurement and financial transactions.
• Verify that all expenditure under government contracts is properly justified and that every business transaction is fully documented.
• Conduct due diligence on counterparties and suppliers to identify potential risks.
• Appoint legal counsel in advance and conclude a legal services agreement.
• Create an emergency contact list—including the company’s lawyer, CEO, owners and legal department—and designate individuals responsible for notifying them immediately if investigative actions begin.

It is also important to remember that electronic devices and data storage media are among investigators’ primary targets. To protect both corporate and personal information, companies should follow good digital hygiene practices: avoid storing business documents on personal devices unless absolutely necessary, minimise the use of unsecured removable storage devices, and regularly back up important data. Companies should also strictly follow a clean desk policy and never leave passwords to computers or information systems visible or written down in the workplace.

Under today’s conditions, a company’s readiness to interact with law enforcement agencies is just as important as its ability to fulfil government contracts properly. Even when a company’s activities are entirely lawful, the absence of internal response procedures, insufficient staff training or chaotic behaviour during a search can create unnecessary legal and reputational risks.

For this reason, preparing for possible investigative actions should not be viewed as a sign of distrust towards state authorities or an expectation of criminal prosecution. Instead, it should be regarded as an essential component of effective corporate governance and risk management. A well-developed response plan, properly organised documentation, regular legal risk assessments and a workforce that knows how to act allow a company to remain in control and minimise negative consequences even under the most challenging circumstances.

Assessing your company’s readiness for investigative actions

Check whether your company is prepared for possible investigative actions. If you cannot confidently answer “yes” to most of the questions below, it may indicate the need to strengthen your internal procedures and criminal risk management system.

Organisational readiness

☐ Responsible personnel have been designated to interact with law enforcement authorities.

☐ An internal search response procedure has been developed.

☐ Employees know whom to call if investigative actions begin.

☐ Contact details for the company’s lawyer, CEO, owners, and legal department are readily available to responsible personnel.

☐ A legal services agreement has been signed with external counsel.

Documentation

☐ Primary documentation is properly organised.

☐ Every business transaction is supported by documentary evidence.

☐ Documentation related to the performance of government contracts has been reviewed for completeness.

☐ Documents confirming the origin of the company’s funds, assets, and goods are available.

Counterparties

☐ Counterparties have undergone due diligence.

☐ Beneficial owners and sanctions risks have been verified.

☐ The actual performance of contracts is supported by documentary evidence.

Employees

☐ Employees have received training on how to act during a search.

☐ Employees understand that they are not required to provide explanations during a search.

☐ Employees know how to contact a lawyer.

☐ Employees know they should not sign any documents without consulting a lawyer or obtaining approval from company management.

☐ Employees know they should not disclose passwords for devices without consulting a lawyer or obtaining approval from company management.

IT and digital security

☐ Data backup procedures are in place.

☐ Multi-factor authentication is enabled.

☐ Passwords are not stored in unsecured or openly accessible locations.

☐ A clean desk policy is enforced.

☐ Access rights to corporate systems are reviewed regularly.

What to do during a search

☐ Verify the court warrant.

☐ Check the address, company name, and registration number specified in the warrant.

☐ Verify the validity period of the warrant.

☐ Review the list of items and documents authorised for seizure.

☐ Check the official identification of all law enforcement officers.

☐ Notify your lawyer immediately.

☐ Document any procedural violations.

☐ Do not obstruct lawful actions by investigators.

☐ Do not provide explanations without first consulting your lawyer.

☐ Review the search report carefully before signing it and ensure that all comments and objections are recorded.

Anastacia Didenko

Advisor, Head of the Anti-corruption & Compliance Practice at LCF Law Group

• LinkedIn