Corporate investigations: whenever they are needed

Corporate investigations: Practical Guidelines for Business Owners and Investors in Russia and CIS

Mainstream

Corporate investigation is not just about collecting compromising information. It is a tool for maintaining control over the business and recovering assets.

The key question is not who is to blame. The key question is how to protect assets and use the information obtained with maximum legal and commercial benefits.

An effective investigation begins with three checks:

• What is the real cause of the problem: Shareholder conflict, mismanagement or external attack?
• Where are the vulnerable assets: Money, shares, real estate, intellectual property, customer base?
• How the results will be used: for negotiation, dismissal, civil suit, criminal case or asset freeze?

Until these issues are resolved, any investigation risks becoming an expensive but futile undertaking.

When a corporate investigation becomes necessary

A corporate investigation is necessary if:

• There is a serious conflict between shareholders or participants.
• the partner blocks the company’s activities;
• A senior manager or partner is suspected of embezzlement.
• the withdrawal of assets to the detriment of the company;
• Management creates a parallel business.
• information about the raider seizure was received;
• the beneficiary of the counterparty or investee must be verified;
• M&A is pending and due diligence is required.
• there are suspicions of violation of sanctions or compliance legislation;
• Confidential information has been leaked;
• Evidence must be gathered for future litigation or arbitration;
• the hidden assets of the debtor within the corporate structure are to be found;
• A change of director is planned with a high risk of counteraction.

The mistake most owners make

Many people start with an emotional step:

Call the police or make a public scandal.

That's the wrong first step.

The right question is this:

What sequence of actions will give maximum protection to my interests and return control of assets?

Sometimes the best results come from quiet negotiations with the evidence gathered. Sometimes, sudden interim measures in court. Sometimes a parallel criminal case against an unscrupulous director. Sometimes it is a civilized way out through corporate procedures.

Corporate investigation requires not a quick reaction, but a cold strategy, where the legal result is primary.

Step 1. Determine the true purpose of the investigation

The first thing to understand is not who betrayed, but what you want to achieve.

The objectives may be different:

• Return stolen money or assets;
• remove an unscrupulous partner or manager;
• to obtain leverage for negotiations on the purchase of a share;
• to gather evidence for court or arbitration;
• initiate criminal prosecution;
• block the withdrawal of assets;
• protect against the capture of the raider;
• Strengthen your position in corporate conflict.

The purpose defines the design of the investigation. You can't collect information for information.

Step 2. Record primary signals

At this stage, it is important to prevent the destruction of evidence.

It is necessary to quickly and legally fix:

• suspicious transactions (bank statements, payments);
• corporate correspondence;
• minutes of meetings and decisions of the sole participant;
• commercial contracts with affiliated persons;
• movement of shares in the authorized capital and records in the USRLE;
• information on the issued powers of attorney;
• IP addresses and time of entry into the remote banking system;
• data of corporate mail and messengers (if allowed by the company’s policies);
• CCTV footage.

Even a small delay can allow the opponent to “clean up” the digital tracks.

Step 3. Conduct a legal audit of the situation

Before the beginning of active actions, it is necessary to get answers to legal questions:

• Who is de jure and de facto in control of the company?
• What is the scope of the suspect’s authority?
• Does the charter or corporate contract permit blocking of decisions?
• What is the structure of ownership of assets and are there no “gold shares”?
• What corporate procedures have been violated?
• Are there any signs of criminal offense under Russian law or CIS law?
• Can you challenge transactions on special grounds (major transactions, interest transactions)?
• What kind of interim measures are actually applied?

Legal audit allows you to separate emotionally unpleasant, but legitimate actions of the partner from actions that create real legal vulnerability.

Step 4. Form a team and plan

Corporate investigation is an interdisciplinary project.

The team may include:

• A lawyer specializing in corporate disputes;
• Specialist in digital forensics (forensic);
• auditor or financial analyst;
• Specialist in economic security;
• professional negotiator.

The investigation plan should answer questions: We look for where we look, how we record, how we protect privacy, and how we legalize evidence.

Step 5. Collect open and internal data

A significant amount of information can be obtained legally without attracting attention:

• data from the USRLE, USRN, registers of the FTS, FSSP;
• bases of court and arbitration cases;
• information on trademarks and patents;
• corporate reporting;
• data on related companies and beneficiaries;
• internal regulations, employment contracts, job descriptions;
• register of contracts and powers of attorney;
• logs of banking systems.

Step 6. Conduct interviews and surveys

Conversations with current or former employees often provide clues to the scheme.

This requires special care and compliance with the law, especially the rules on the protection of personal data and lawyer secrecy. Any interview should be conducted in such a way that the information obtained can be used safely in court.

Step 7. Digital forensics and analysis of electronic evidence

This is a critical stage in case of suspected theft and withdrawal of assets.

Includes:

• creation and certification of mirror copies of hard disks and servers;
• Recovery of deleted files and emails;
• analysis of transaction history in the bank-client systems;
• identification of atypical activity (entry into the system after hours, mass downloading of data);
• analysis of metadata of files confirming authorship;
• checking the use of personal mailboxes and instant messengers for business correspondence (subject to the rules on confidentiality of communications).

Digital evidence must be obtained so that the court can accept it. The slightest error in the chain of custody and the proof disappears.

Step 8. Identify assets and transaction chains

In parallel with the search for evidence, you need to look for assets that can be foreclosed.

It is important to establish:

• money chains;
• one-day firms and transit companies;
• the final purchasers of property;
• personal property of an unscrupulous partner or director;
• assets in friendly jurisdictions (Cyprus, UAE, Turkey, offshores).

Asset tracing inside and outside the holding is what turns a legal win into a real refund.

Step 9. Develop results and define a strategy for action

The results of the investigation should be packaged in legally relevant formats:

• lawyer's report or memorandum;
• expert opinion;
• evidence for law enforcement agencies;
• draft statements of claim;
• The reason for holding an extraordinary meeting.

It is at this stage that a key tactical decision is made.

Step 10. Implementation: Negotiations, dismissal, court, criminal case

The investigation does not end with a report. It ends with action.

Implementation scenarios:

• Force negotiations: presenting evidence to an opponent demanding the sale of a share or compensation.
• Change of management: A sudden meeting, the firing of the director, the revocation of powers of attorney.
• Civil suit: Dispute transactions, recover damages.
• Criminal case: a statement of fraud, appropriation or embezzlement.
• Interim measures of protection: seizure of assets, shares, accounts.

Consistency and surprise are the main tactical advantages.

Internal investigation or criminal case: pick

The choice is not based on emotions, but on where the assets are located, what the structure of the evidence is, and how vulnerable the opponent is to prosecution in a particular jurisdiction.

How to Protect Your Business Before a Problem

The best defense is a conflict prevention system:

• clear and consistent corporate contract with a deadlock mechanism;
• the statute limiting the powers of the sole executive body;
• mandatory notarization of protocols and decisions;
• Double payment control system (two signatures)
• Regular audit according to IFRS standards;
• Policy on the use of corporate mail and messengers;
• clear procedure for coordination of transactions with interest;
• Effective compliance control;
• timely storage of all corporate documents on paper;
• Prohibition of the issuance of general powers of attorney.

Without these elements, any conflict becomes a ruleless game, where the first person to seize the corporate seal and access to the bank wins.

Common Mistakes in Corporate Investigations

1. Procrastination. In a few days, you can remove all assets or destroy the server.
2. Emotional leaks. Public prosecution before collecting the full evidence deprives you of the factor of surprise.
3. Illegal collection of information. Hacking the mail, illegally tapping or bribing employees makes evidence null and void and puts you under criminal prosecution.
4. Ignoring digital evidence. In modern conflicts, the outcome is not determined by testimony, but by electronic traces.
5. Mixing roles. You cannot assign an investigation to a full-time lawyer or accountant if they are potentially loyal to an opponent.
6. Starting action without an execution plan. The evidence collected must be converted immediately into legal action.
7. Investigate for the sake of investigation. If there is no clear purpose, the investigation becomes endless and paralyzes the business.

Owner's checklist

Before launching the investigation, 15 questions must be answered:

1. Who exactly is the opponent? Partner, director, outside group?
2. What assets are under direct threat?
3. Where are the company’s servers and documents physically located?
4. What is the scope of the suspect’s authority?
5. Is there access to bank statements and IP logs?
6. Is the corporate contract valid?
7. What actions of the opponent have already been recorded?
8. What evidence can be obtained legally as soon as possible?
9. Where are the opponent’s affiliated companies registered?
10. Which jurisdiction is the easiest to arrest?
11. Are there any signs of a criminal offence?
12. Can I use the surprise factor (change of director, seizure of assets)?
13. Are you ready for a public corporate conflict?
14. Who will represent you in court and in court?
15. What is the ultimate goal: Get your money back, go out of business, or take full control?

What an Effective Investigation Strategy Looks Like

A strong strategy usually includes five levels:

1. Fixing Preservation of the status quo, blocking of accounts, revocation of power of attorney, creation of mirror copies of data.

2. Legal framework: Determination of applicable law, jurisdiction and potential offences.

3. Data collection Financial analysis, IT-forensic, interviews, analysis of open registers, identification of links.

4. Verification and analysis: Converting disparate facts into a single evidentiary picture, understandable to the court.

5. Tactical implementation Simultaneous launch: loss claim, criminal statement, asset seizure petition, extraordinary shareholder meeting.

Without the fifth level, all previous ones are just a consulting product that does not bring commercial results.

Can a corporate investigation be conducted in secret?

At the initial stage, this is not only possible, but necessary. Confidential data collection and analysis allows you to prepare a set of measures before the opponent learns about the investigation.

What if the suspicion fell on the CEO?

The first is to limit its powers, if the statutes and law allow it, to withdraw powers of attorney and to request the bank to block unauthorized transactions. In parallel, start collecting data on his transactions.

How to legally access an employee’s corporate email?

If the server and domain belong to the company, and this is enshrined in the policy of using IT resources, access to business correspondence can be obtained. It is necessary to strictly observe the procedure with the participation of IT specialists and a lawyer.

When should I contact the police?

Only after you have checked the collection and preservation of evidence and clearly understand what assets can be seized in the framework of a criminal case. An unprepared statement often leads to leakage of information and destruction of traces.

Can I use a private investigator?

In Russia, the activity of private detectives is very limited. Any operational-search measures are the exclusive prerogative of the state. It is better to focus on legal methods: Data analysis, audit and advocacy investigation.

What to do in a 50/50 conflict with your partner?

It's a dead end. The investigation should be aimed at finding facts of dishonesty of the partner to obtain leverage in negotiations for the purchase of a share or to exclude him from the membership of participants in court.

Related services

• Corporate Conflicts and Shareholder Disputes Protection of Business from Raider Seizures and Unfriendly Acquisitions Criminal Law Protection of Business Compliance and Anti-Corruption Due diligence
• International Asset Search and Seizure Support of M&A Transactions and Structured Ownership

Related material

• Shareholder conflict: step-by-step defense strategy
• How to recover assets taken by unfair management
• Digital evidence in corporate disputes: How to Collect and Legalize
• Challenges to Interested Transactions in Russia and CIS
• How to exclude a partner from an LLC for actions that destroy the business
• Asset freeze and interim measures in corporate disputes
• How to Protect Your Company from Criminal Prosecution in Conflict

Conclusion

Corporate investigation in Russia and the CIS is not a service, but a way of survival and preservation of business.

A strong position is not based on emotions, but on a symbiosis of legal analysis, digital forensics and thoughtful implementation tactics. The winner is not the one who louder declares violations, but the one who first provided the procedural levers with evidence - arresting accounts, blocking shares, controlling the registry and a ready-made claim for damages.

In corporate wars, victory is awarded to the one who is better prepared for the first move.