1. What are the laws relating to anti-corruption, bribery, and money laundering in your country?
The laws applicable to anti-corruption, bribery, and money laundering in Ukraine are as follows:
2. Do the following persons or bodies have the right to be informed, or is the company obliged to inform the following persons/bodies, about an internal investigation before it is commenced? Do they have the right to participate in the investigation (e.g., in interviews)?
a) Employee representative bodies, such as a works council or union
b) Data protection officer or data privacy authority
d) Other local authorities
What are the consequences of non-compliance?
Trade unions established within individual companies (so-called “primary trade union organizations”) will only have the right to be informed about and participate in an internal investigation when the investigation relates to accidents or occupational health of employees who are members of the respective trade union (i.e., an illness that occurs as a result of work or occupational activity). Violation of this right can result in a small fine.
Companies are obliged to notify the data protection authority in Ukraine (the Ukrainian Parliament Commissioner for Human Rights) about the processing of sensitive personal data, not related to employment issues, within 30 days after the start of processing. This obligation also applies to internal investigations where such data is being processed.
Non-compliance can lead to an administrative fine of up to UAH 6,800 (around US 242) for each violation and up to UAH 34,000 (around US 1,214) for repeated violations.
There are no obligations to notify the data protection officer(s) of the company being investigated.
Officials of state-owned companies (more than 50 per cent of state ownership) and the companies involved in public procurement procedures for projects equal to or exceeding UAH 20 million (around US 714,285), upon becoming aware of or receiving information about any corruption incident or possible incident, must take measures to stop the potential violation and immediately, but not later than within 24 hours, report to the responsible anti-corruption state authorities.
Non-compliance with the notification requirement by an official may lead to an administrative fine of up to UAH 6,800 (around US 242).
Financial institutions (e.g., banks and insurance companies), stock exchanges, and other companies conducting financial monitoring have to notify the State Financial Monitoring Service of Ukraine and the respective law enforcement authorities within one day when a financial transaction conducted or monitored by them is, or may be, related to a crime.
Non-compliance with the notification requirement by a financial institution may lead to several sanctions, including an administrative fine of up to UAH 340,000 (around US 12,140) up to the license cancellation, a requirement to suspend from work the responsible employee, and disgorgement agreement with a specifically identified disgorgement amount.
Private companies are not obliged to notify law enforcement authorities or involve them in internal investigations.
However, the company must notify the law enforcement authorities about the results of the investigation if a corruption offense is determined. Furthermore, under Ukrainian law, there is an obligation upon individuals to notify the authorities if they become aware of conduct that pertains to certain serious and/or particularly serious crimes.
3. Do employees have a duty to support the investigation, for instance by participating in interviews? Is there anything a company can do to require employees to support an investigation (e.g., advance consents)? Can companies impose disciplinary measures if an employee refuses to cooperate?
There is no explicit obligation under Ukrainian law for employees to support an internal investigation. However, the employee is obliged to fulfil any lawful order of the employer, which is in line with the designated job description. This can also include an order to support an internal investigation.
Based on data protection obligations and practicability reasons, we suggest including a separate clause in the employment agreement outlining in more detail employees’ obligations to support any internal investigation under the instruction of the supervising management. We further recommend obtaining an explicit consent to process the personal data of an employee during such an investigation, including the cross-border transfer of data to other countries.
Not supporting the investigation may trigger disciplinary penalties, including a dismissal.
4. Can any labor law deadlines or statute of limitations be triggered, or any rights to sanction employees be waived, by investigative actions? How can this be avoided?
There are no labor law deadlines/statute of limitations triggered or any rights to sanction employees waived by investigative actions. However, disciplinary actions against an employee can only be brought within six months from the violation. This time limit only affects labor law actions against the employee.
5. Are there relevant data privacy laws, state secret laws, or blocking statutes in your country that have to be taken into account before:
The provisions relating to personal data are contained in the Law of Ukraine on Personal Data Protection (Law No. 2297-VI Закон України про захист персональних даних). Currently, Ukrainian lawmakers are working on an update that will reflect the standards of the EU General Data Protection Regulation 2016/679.
Personal data includes all information that can be used to identify an individual. If a company or its representatives collect personal data of individuals during an internal investigation, the company is obliged to inform the respective data subjects about the purposes of the collection, the respective processing actions (e.g., transfer, retention, and use of the data), the persons involved in the processing actions, the data subject’s rights, and potential transfers of the data to foreign countries.
We suggest obtaining a waiver of data protection rights from the interviewee beforehand and/or asking to sign a commonly used privacy notice.
Ukrainian law prohibits the transfer of personal data from Ukraine to outside Ukraine if the relevant country does not reflect an adequate level of data protection compared to the one based on Ukrainian law. Under Ukrainian law, “safe” countries are, in particular:
Ukrainian law further prohibits the provision of data or information relating to state secrets or bank secrets, falling under a professional confidentiality obligation (e.g., doctor-patient, attorney-client), and specifically labelled as confidential information by the owning company. During the internal investigation, interviewees with access to such information are prohibited from disclosing such information. Ukrainian law only allows the release of such information when such information is officially requested by public authorities or such a transfer is based on a court ruling. We suggest assessing beforehand if the information requested from the interviewee falls into one of the above categories.
We suggest anonymizing the collected personal data as far as possible to avoid any potential violation of Law of Ukraine on Personal Data Protection No. 2297-VI and not to burden the investigating company with unnecessary notification obligations.
Reviewing private emails without a court ruling can constitute a violation of the constitutional right of secrecy of correspondence and can be a criminal offense.
The potential obligations for the investigating company in relation to data privacy, state secrecy, and confidentiality outlined above at question 5a also apply in relation to the collection and review and other use of emails of employees and/or third parties. The investigating company would have an obligation to inform each data subject about the processing actions and the purpose, as well as about safeguarding actions undertaken (e.g., in cases of data transfer abroad).
In this regard, we also suggest anonymizing the collected personal data as far as possible.
Collecting (electronic) documents and/or other information?
The potential obligations for the investigating company in relation to data privacy, state secrecy, and confidentiality outlined above at question 5a also apply in relation to the collection and use of other documents and information.
Analyzing accounting and/or other mere business databases?
Accounting or business databases may contain personal data or information constituting state secrets or bank secrets. In such cases, the restrictions and obligations as outlined above at question 5a would also apply here.
6. Do any specific procedures need to be considered in case a whistle-blower report sets off an internal investigation (e.g., for whistle-blower protection)?
Recent updates to the Law of Ukraine on Prevention of Corruption (Law No. 1700-VII) (the “Anti-Corruption Law“) brought several innovations regarding whistle-blowing. However, for the private sector, these new provisions only apply to companies participating in public procurement procedures for projects equal to or exceeding UAH 20 million (around US 714,285).
According to these recent changes, the company’s official shall conduct an initial assessment of the whistle-blower report within a term not exceeding 10 business days. The results of such evaluation shall be provided to the whistle-blower in writing within three days.
The full internal investigation shall be conducted within 30 days from the day the initial assessment has been completed. The period of the internal investigation can be extended to 45 days if necessary. The whistle-blower shall be kept informed.
Upon the completion of the internal investigation, the responsible official has to report any identified misconduct and the investigation results to the respective law enforcement authorities.
The initial assessment and the investigation should be documented in an adequate form. The record shall be kept by the company for three years since obtaining such data.
The officials receiving the whistle-blower reports and other persons responsible for conducting the internal investigation shall guarantee the confidentiality and anonymity of the whistle-blower and their close relatives.
For private companies that do not fall within the scope of the Anti-Corruption Law (please see above), only the general employment law principles apply. Based on these, employees cannot be dismissed or otherwise penalized for reporting even an indication of illicit behavior.
If the whistle-blower report is filed before law enforcement authorities (e.g., the prosecutor’s office, the Police, the National Anti-Corruption Bureau, the National Agency on Corruption Prevention), the whistle-blower can request protection from the authorities if a threat to their life exists.
Only companies falling within the scope of the Anti-Corruption Law (please see above), must have an anti-corruption program (the “Model Anti-Corruption Program“) in place. A template for such a program was published by the respective anti-corruption authority. Such programs must also include processes concerning the conduct of internal investigations, including, responsibilities, the timing of the investigation, internal and external reporting obligations, documentation, retention periods, and retaliation measures.
Where the internal investigation relates to potential criminal conduct, as a general rule, all companies are obliged to notify law enforcement authorities about “serious” and “particularly serious” crimes. A failure to notify is a crime.
7. Before conducting employee interviews in your country, must the interviewee:
Receive written instructions?
There is no obligation for a company to provide any instructions to its employees before interviewing them as part of an internal investigation.
Be informed that he/she must not make statements that would mean any kind of self-incrimination?
The right not to incriminate oneself is a constitutional right. An employee can assert it during any internal investigations.
There is no obligation of the employer to inform any employees about this right.
Be informed that the lawyer attending the interview is the lawyer for the company and not the lawyer for the interviewee (so-called Upjohn warning)?
There is no such concept in Ukrainian law and no obligations in this regard.
Be informed that they have the right to have their lawyer attend?
There is no such obligation for the employer. Such an obligation only applies to public criminal proceedings and not interviews conducted as part of an internal investigation. However, the employee, at its sole discretion, has a right to take a lawyer to the interview.
Be informed that they have the right to have a representative from the works council (or other employee representative body) attend?
There is no general obligation for the employer to notify the interviewed employees about such right. Further, such a right only exists where the investigation relates to accidents and/or occupational professional diseases of employees, who are members of the respective trade union.
Be informed that data may be transferred across borders (in particular to the United States of America)?
Yes. When transferring personal data outside of Ukraine, the employee must be provided with prior notification, also including the potential cross-border transfer. In cases in which the data will be transferred to “not safe” countries, like, e.g., the U.S. (for countries with an appropriate level of data protection, please see question 5a above), the employer would need to obtain prior explicit consent for the cross-border data transfer.
When the receiving country does not have the appropriate level of protection (e.g., the United States of America), the employer can only transfer personal data to such country if one of the following exceptions is met:
• it has received additional explicit consent from the data subject for the transfer
• to protect the public interest or perform legal requirements
The law requires the employer to inform its employees that their personal data has been passed to third parties within ten days after the transfer. This can be done by the prior signing of a privacy notice. Such notification is not required when a cross-border transfer is required by investigating authorities, or if the employee signed a waiver.
Sign a data privacy waiver?
Ukrainian law does not require employees to waive their data privacy rights before conducting employee interviews. However, the employer can ask the employee to sign such a waiver on a voluntary basis.
Be informed that the information gathered might be passed on to third parties, including local or foreign authorities?
Yes. The law requires the employer to inform its employees that their personal data has been passed to third parties within ten days after the transfer.
Be informed that written notes will be taken?
Ukrainian law does not provide such an obligation.
8. Are document-hold notices or document-retention notices allowed in your country? Are there any specific rules that need to be followed (point in time, form, sender, addressees)?
Yes. Although it is currently not common practice in Ukraine, we recommend to always use document-retention notices in connection with internal investigations and to include an adequately long period of retention. Such an approach can be very helpful in case of later investigations conducted by law enforcement authorities (e.g., the prosecutor department).
9. Can attorney-client privilege (legal advice privilege) be claimed over findings of the internal investigation? What steps may be taken to ensure privilege is maintained?
The attorney-client privilege can be claimed in Ukraine and has no time limitation. However, attorney-client privilege covers only attorneys who have a special attorney license and are independent.
The attorney-client privilege covers client information, substantive advice, consultations, clarifications, documents drafted by the attorney, and other documents and information received from the client as part of the provision of legal advice. It also applies to the information provided by a person who consulted an attorney but did not become a client.
We suggest trying to involve as many possible outside attorneys when conducting an internal investigation to secure the privilege rights, also with regard to foreign law regimes (e.g., the United States of America or the European Union).
In practice, Ukrainian public authorities occasionally still infringe the attorney-client privilege. However, there are court proceedings that can help to protect the privilege rights.
10. Can attorney-client privilege also apply to in-house counsel in your country?
Attorney-client privilege in Ukraine covers only attorneys who have a special attorney license and are independent. Most lawyers practicing in Ukraine, including in-house counsel, do not have such a license. In-house counsel (having an attorney license) can also act as attorneys for their employers on the basis of a legal assistance agreement.
However, an in-house counsel may not be seen to be independent as necessary to obtain attorney-client privilege. Therefore, attorney-client privilege may not apply to in-house counsel. It will have to be assessed based on future case law whether the formal requirements will be enough to obtain a solid attorney-client privilege also for in-house counsel.
Nevertheless, we suggest trying to involve as many possible outside attorneys when conducting an internal investigation to secure the privilege rights, also with regard to foreign law regimes (e.g., the United States of America or the European Union).
11. Are any early notifications required when starting an investigation?
To insurance companies (D&O insurance, etc.) to avoid losing insurance coverage.
D&O insurance is generally not provided by Ukrainian insurance companies. For other types of insurance (e.g., professional insurance, third-party insurance, product liability insurance), notification obligations are set by individual insurance contracts.
To business partners (e.g., banks and creditors).
Relations between business partners are usually regulated by contract. Notification obligations may be set out in such contracts.
The law does not specify an express obligation to inform shareholders when starting an internal investigation.
However, under Ukrainian law, the director has a fiduciary duty to act in the interests of the company, in good faith and reasonably. This obligation can also include an upfront notification of shareholders before launching an internal investigation. Such an obligation should be assessed on a case-by-case basis.
There is an additional obligation of the director to provide information about the company’s activity, also including an internal investigation, at the shareholder’s explicit request.
The Model Anti-Corruption Program establishes an obligation to notify shareholders if a corruption violation has occurred or is suspected. Although this obligation is only obligatory for companies that participate in a public procurement procedure for projects exceeding UAH 20 million (around US 714,285), and only for the time of participating in the specific tender procedure, state authorities recommend that other companies also should use such an approach. However, this recommendation is not binding.
Corporate governance rules in this regard are not well developed on a legislative level, although usually, companies develop detailed internal regulations. An obligation to notify the shareholders might also be based on the individual charter or policy of the respective company.
The Anti-Corruption Law and Model Anti-Corruption Program provide an obligation for the officials of the company to notify the respective public authorities about an administrative or criminal corruption offense known and discovered within an internal investigation. The anti-corruption program is obligatory for public companies and companies participating in a public procurement procedure for projects exceeding UAH 20 million (around US 714,285) and only with regard to the specific tender procedure. State authorities recommend that other companies also should adopt this approach, but this recommendation is not binding.
12. Are there any other immediate measures that have to be taken in your country, or would be expected by the authorities once an investigation starts, e.g., any particular immediate reaction to the alleged conduct?
Private companies have no obligation to take immediate measures with regard to an internal investigation. However, as a matter of practice, the company should try to stop any ongoing misconduct and consider remediation measures.
13. Is there a duty to self-report the discovered misconduct to prosecuting authorities?
As a general rule, all entities are obliged to notify law enforcement authorities about “serious” and “particularly serious” crimes, e.g., bribery, money laundering, and tax evasion. Failure to notify is a crime.
Private companies falling in the scope of the Anti-Corruption Law (please see above, under 6.) have the duty to self-report every discovered misconduct connected to corruption to the prosecuting authorities and other law enforcement agencies.
14. If local prosecuting authorities become aware of an internal investigation, would they interfere in it or ask for specific steps to be followed?
No. There are no specific steps required by prosecutors regarding internal investigations. However, the prosecutor department can investigate in parallel and request to support them.
15. Please describe the legal prerequisites for search warrants or dawn raids on companies in your country. If the prerequisites are not fulfilled, can the evidence gathered still be used against the company?
Searches can be conducted only within open criminal investigations. They are based on the mandatory ruling of the investigating judge. The initiators can be a prosecutor or an investigator together with a prosecutor.
The court ruling must be provided to the company. The scope of the search must be within its outlined purpose. When the search is at a company’s premises, the search record must be provided to the representative of the company.
Dawn raids without the prior approval of the investigating judge can be conducted by the investigator in exceptional cases, such as to save people’s lives or when chasing a suspect. Even in this case, the dawn raid must be authorized by the investigating judge, retrospectively. If the dawn raid is not subsequently authorized, its results are considered invalid and inadmissible.
16. Would voluntary self-disclosure or cooperation with state authorities help avoid or mitigate liability? What are the requirements to obtain the cooperation credit?
Ukrainian legislation does not explicitly identify the requirements on the reduction of penalties or conditions for avoiding liability.
Cooperation with state authorities can help to avoid or mitigate liability. However, it is left to their discretion to decide whether or not cooperation credit can be awarded. They do not have any obligation on this matter or any structured approach (guidelines, etc.) in this regard.
17. Are deals, non-prosecution agreements, or deferred prosecution agreements available and common for corporations in your jurisdiction?
Ukrainian law does not provide for deferred prosecution agreements or non-prosecution agreements. However, in criminal proceedings, there is the possibility to conclude:
– minor crimes, crimes with average weight, and serious crimes
– particularly serious crimes investigated by the National Anti-Corruption Bureau (in relation to corruption-related offenses by public officials) when the accused reveals other suspects in committing the similar crime which can be proven by evidence
– particularly serious crimes committed by prior conspiracy by a group of individuals, an organized group or criminal organization or terrorist group, provided that they are exposed by a suspect who is not the head of such group or organization and that the suspect reveals the criminal acts of other members of the group or of other crimes committed by the group or organization provided that such information will be supported by evidence
Criminal liability (currently, in the form of penalty fines of up to UAH 1,275,000 (around US 45,535), confiscation of property, and compulsory liquidation of the entity) can also apply to companies. In such cases, a settlement agreement or a plea agreement cannot be concluded.
A plea agreement requires the prior consent of the person whose private interests have been damaged. The agreement has to be approved by the competent court.
18. What types of penalties (e.g., fines, imprisonment, disgorgement, or debarment) could companies, directors, officers, or employees face for misconduct of (other) individuals of the company?
Under Ukrainian law, directors can face liability for tax evasion (fine up to UAH 425,000 (around US 15,178) with deprivation of the right to hold specific posts for up to three years and confiscation of assets), forgery of the documents submitted for the state registration of a legal entity (fine up to UAH 34,000 (around US 1,214) or custodial restraint for five years with deprivation of the right to hold specific posts for up to three years), contentious insolvency (fine up to UAH 51,000 (around US 1,821) with deprivation of the right to hold specific posts for up to three years), and violation of labor law.
Furthermore, directors can face liability claims from shareholders based on improper management, which causes damage to the company. This is based on the director’s obligation to act in the best interests of the company.
Criminal liability for the company can be based on employees’ (authorized representatives’) misconduct benefitting the company. These offenses may include, for example:
Criminal liability measures for private companies include a fine up to UAH 1,275,000 (around US 45,535), confiscation of property, or compulsory liquidation of the entity. The private company also has to compensate for all losses, and, in case of a corruption offense, the amount of illegal benefit received or which could have been received as a result of the offense.
Public authorities, public entities financed from state or local budgets, or by international organizations are as legal persons exempted from certain criminal liabilities. However, their public officials and executives can, as individuals, be penalized for committing corruption offenses, including potential imprisonment of up to 12 years.
19. Can penalties for companies, their directors, officers, or employees be reduced or suspended if the company can demonstrate an efficient compliance system? Does this only apply in cases where efficient compliance systems have been implemented prior to the alleged misconduct?
Yes, according to Ukrainian legislation, the existence of an implemented compliance system (in other words, measures taken by the company to prevent crime) may reduce potential penalties. However, Ukraine has no strong case law or administrative regulations for the courts on how to take an existing compliance system into account. Therefore, an existing compliance system may influence the liability decision of the court but more on a subjective level of the judge.
20. Please briefly describe any investigation trends in your country (e.g., recent case law, upcoming legislative changes, or special public attention on certain topics).
Recently, the Ukrainian Parliament has adopted the updated Law of Ukraine on Prevention and Counteraction of the Legalization (Laundering) of the Proceeds from Crime, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction. The new law ensures the implementation of international standards.
At the same time, the number of internal investigations is further increasing. For example, corruption offenses committed by the former top-management of the Ukrainian state concern Ukroboronprom are now subject to an internal investigation. Finally, Ukrainian subsidiaries of global companies and Ukrainian individuals have, in recent years, become subjects of official FCPA investigations relating to activities in Ukraine. The most notable examples are ADM, Dmytro Firtash, Teva, and IBM.