Protecting Company Assets from Raider Attacks: Practical Steps

In Ukraine, raiding stopped being a crowd at the factory gates long ago. Today a company is more often taken quietly: a forged set of minutes, a single registration action, and a changed entry in the state register in a matter of minutes. Asset protection is therefore not a single move but a system built on two loops — a preventive one, to spot an attack and make it as hard as possible to carry out, and a reactive one, to repel it once it has begun. Below are the practical steps I recommend to owners and later prove with numbers and documents in my expert work.

How modern raiding works: threat mechanisms

The classic picture of raiding is outdated. The attacker’s main instrument today is not force but a document and a registration action. You need to understand these mechanisms in order to know exactly what to monitor.

Document forgery

The foundation of most schemes. Attackers forge decisions and minutes of governing bodies, share- and asset-purchase agreements, transfer-and-acceptance acts, powers of attorney, and bank signature cards. Often this is not a crude fake but a document that is flawless in form yet records a transaction the parties never actually entered into.

Illegal registration actions

The key point of impact is the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organisations (EDR). A single registration action is enough to replace a director, “rewrite” a share, or change a beneficial owner. Because a register entry carries public trust, after such an action the attacker gains formal control of the company seal, bank accounts, and property — while the owner learns of it only after the fact.

Fake minutes of general meetings

A distinct and very common form of forgery. Attackers draft minutes of a meeting that never took place: the participants supposedly resolved to change the director, to increase the charter capital and dilute a minority stake, or to consent to selling real estate. On the strength of such minutes a registration action is carried out or a deal is signed. The authenticity of meeting resolutions is therefore a separate object of protection.

The preventive loop: seeing the attack in advance

The owner’s main advantage is time. If an attempted registration action becomes known on the day the documents are filed rather than a month later, the chances of stopping the takeover rise dramatically.

Monitoring registration actions: “SMS-Mayak” and Ministry of Justice services

The Ministry of Justice offers the “SMS-Mayak” alert service and an electronic-services cabinet. Through them you receive notice that documents have been filed for a registration action and that actions have been taken concerning your company or property — meaning you can react at the filing stage rather than after the fact. This is one of the cheapest and most effective safeguards: it is worth connecting such monitoring immediately to every key object — the legal entity, the shares, and the real estate.

Regular review of extracts from the EDR and the State Register of Property Rights

Alerts do not replace scheduled checks. I recommend obtaining and comparing extracts on a fixed schedule, paying attention to any change in the composition of participants, the director, or encumbrances.

Register / service	What to monitor	Why
EDR	participants, share sizes, director, beneficial owner	detect a change of control over the company
State Register of Property Rights	owner, mortgages, seizures, sale bans on real estate	detect an attempt to sell or lift encumbrances
”SMS-Mayak” / Ministry of Justice cabinet	the fact that documents were filed for a registration action	react on the day of the attack, not afterwards
EDRSR	new court cases involving the company	spot a “technical” lawsuit staged to justify a takeover

Separately, it is worth monitoring the Unified State Register of Court Decisions (EDRSR): a takeover is often preceded by an artificial court dispute in a remote region, whose ruling is then used as grounds for a registration action.

Corporate safeguards

Technical monitoring detects an attack; the corporate structure determines how easy it is to carry out in the first place. Many companies run on a “template” charter that contains no barrier at all.

A charter with safeguards

The charter is the first line of defence. Within the scope of the profile Law of Ukraine “On Limited and Additional Liability Companies”, it is sensible to build in:

• a higher quorum and a qualified majority for the most sensitive decisions — changing the director, disposing of significant assets, increasing charter capital, admitting new participants;
• mandatory notarisation of signature authenticity on general-meeting resolutions and minutes — this sharply complicates the use of forged minutes;
• pre-emptive rights and restrictions on transferring a share to third parties, plus a clear procedure and form for notifying participants of meetings.

A corporate agreement

Where there are several owners, a corporate agreement records understandings that the charter does not contain: an agreed voting order on key questions, a ban on disposing of a share under certain conditions, and exit and buy-out mechanisms (options). It makes the partners’ conduct predictable and denies an attacker the chance to “buy” the weakest link among the co-owners.

Separating ownership from operations

One of the most effective structural steps: do not keep valuable assets where daily operations run and risks accumulate. Real estate, equipment, and trademarks logically belong in a separate holding company that leases them to the operating one. Then an attack on the operating business — with its contracts, debts, and counterparties — gives the attacker no automatic access to the assets themselves.

Structuring and encumbering assets

It is profitable to seize what is “clean” and liquid. Real, economically justified encumbrances make an asset unattractive to an attacker and complicate a quick resale:

• a registered mortgage or pledge in favour of a bank or a related financing company under a genuine credit obligation;
• long-term registered lease agreements that “follow” the property when ownership changes;
• a ban on disposal entered into the register as an encumbrance.

I stress this as a matter of principle: these must be real transactions with genuine economic substance. Fictitious encumbrances and “technical” debts created merely for appearances are not protection but a vulnerability: in a dispute, creditors, law enforcement, or a forensic economist can readily prove them commodity-less, and the construction turns against the owner.

The reactive loop: if the registration action has already been done

Once an attack has happened, speed decides everything. Two parallel paths work here — administrative and judicial — and you cannot delay on either: the time limits for challenging are short.

Challenging via the Anti-Raiding Board at the Ministry of Justice

An illegal registration action can be challenged out of court — before the Ministry of Justice, where complaints are heard by a dedicated body known as the Anti-Raiding Board. Following its review, the Ministry is empowered to cancel the illegal registration action and restore the previous entry. This is faster and cheaper than court, but it has its own time and procedural limits — in particular, a complaint is left unexamined if a court dispute over the same matter is already under way. So you should react immediately after being notified of the action.

Court interim measures

In parallel with, or instead of, the Board, you file a lawsuit and — most importantly — an application for interim measures. Depending on the nature of the dispute and the procedure (the Commercial Procedure Code (HPK), the Civil Procedure Code (TsPK), or the Code of Administrative Procedure (KASU)), the court may, among other things:

• prohibit the state registrar from taking any registration actions concerning the company or property;
• impose a seizure on the disputed property or share;
• bar the governing bodies from taking certain decisions until the case is heard.

The aim of these measures is to “freeze” the situation so the attacker cannot resell the assets through a chain of “good-faith purchasers”, after which recovering the property becomes far harder. On the criminal side, seizure of property is imposed by an investigating judge under the procedure set out in the Criminal Procedure Code of Ukraine (KPK) — on a motion within an open proceeding.

In parallel, it is advisable to file a criminal complaint with the National Police or the Bureau of Economic Security (BEB) — on the elements of document forgery, fraud, or arbitrariness. The legal classification of the act is determined by the investigator and the court; the owner’s task is to record the facts fully and in time.

The role of forensics: documenting and proving the takeover scheme

This is where forensic economic examination and financial forensics turn an owner’s outrage into evidence. A complaint or lawsuit that describes the takeover with the words “illegal” and “deliberate” but is not backed by a documentary analysis is weak in court. In my practice I reconstruct the scheme step by step:

• the timeline of the takeover — who gained control of the company or property, when, and on the basis of which documents exactly;
• the chain of transfers — how the asset moved on, through which persons, and at what price relative to market and book value;
• the connectedness of the parties — from EDR data on founders, directors, and beneficial owners, from shared addresses, and from the nature of the transactions;
• the amount of loss — a figure supported by calculation and primary documents.

Such an opinion is prepared within the scope of the Law of Ukraine “On Forensic Examination” and the Instruction on Ordering and Conducting Forensic Examinations (Ministry of Justice Order No. 53/5), under economic specialties 11.1, 11.2, and 11.3. It serves both a civil or commercial claim to recover property and as grounds for a complaint to law enforcement. The key is to bring in an expert and secure documents as early as possible: evidence gathered while the trail is fresh is far more persuasive than anything reconstructed later.

Typical owner mistakes

• A “template” charter with no safeguards — decisions pass by a simple majority, signatures are not certified, and there is no barrier to changing the director.
• No monitoring — the registration action is discovered by chance, once the window for a fast challenge has already closed.
• All power in one pair of hands — the director alone holds the seal, the key, and the original charter documents; replacing him means instant loss of control.
• Betting on fictitious encumbrances instead of real ones — this creates the appearance of protection but collapses at the first review.
• Delay — weeks spent “thinking it over” after an attack often cost more than the amount of the dispute itself.

---

Protecting assets from raiding is systematic work done ahead of time, not a heroic last-minute defence. If you sense a risk to your company or property, or have already encountered a suspicious registration action, I advise you not to delay: I am ready to help assess the vulnerabilities in your structure and, where needed, to document and prove the takeover scheme through a lawful forensic economic examination.