How an international asset map worth 7.2-8.1 million euros was restored after corporate misconduct
An investor lost control over investments in a project, with payments passing through several companies and jurisdictions. The work focused on reconstructing the flow of value, verifying connected assets and preparing a lawful recovery route.
- 5 million € - the volume of the client's investment
- 5 jurisdictions - Ukraine, Poland, Cyprus, UAE, Switzerland
- 34 days - engagement duration
- 7.2-8.1 million € - estimated order of related assets
A composite example based on typical engagements; details have been altered. The material does not disclose the client, counterparties, connected persons or the circumstances of a specific project. Banking and trust information, identifying details, structure identifiers, property addresses, sources and operational methods are not published in any form.
Проверено: 3 августа 2026Время чтения: 17 минутBLACKFILE Editorial & Investigations Team

The task was framed as restoring a verifiable picture of the movement of invested funds and the assets connected to them - not as establishing guilt and not as preparing accusations, which is a matter for the courts.
The range of jurisdictions in which counterparties, structures and objects of verification were recorded. Cities, addresses, identifying details are not disclosed.
From agreeing the scope and legal framework to delivering the client and their legal counsel a summary conclusion and a jurisdictional matrix of available measures.
The volume of the client's investment in the project according to the documents provided by the client. The parties, subject matter and structure of the investment are not disclosed.
The range of assets and economic interests connected to the flow of invested funds has been established, and the measures available in each jurisdiction are described. The origin of a specific asset is not asserted as proven - this requires forensic examination and a court decision.
Reconstruction of the movement of value based on the client's documents and publicly available data, verification of connected structures and assessment of the degree of actual control.
The material is based on typical engagements in this area. The client, counterparties, connected persons, banking and trust information, addresses and identifying details are excluded entirely and deliberately.
How an investor lost visibility into a project
Transparency in such cases does not disappear in a single day. First reporting arrives late, then it becomes generalized, then explanations take up more space than figures. By the time of the enquiry, the client had already spent several quarters without understanding what was happening to their investment, yet formally no obligation had been breached.
The structure of the project made matters worse. Funds were contributed under agreements with several companies in different jurisdictions, each responsible for its own part. This arrangement is common and does not in itself indicate anything - but it makes the picture opaque to anyone who sees only their own segment.
The enquiry was framed as two questions. First: where did the contributed funds actually go. Second: are there assets connected to this flow, and in what form.
We reframed the task immediately and explained why. Reconstructing the movement of invested funds and describing related assets is possible. Establishing fault, proving intent, or characterizing anyone's actions as unlawful is not - that falls within the competence of a court, not a private investigation.
We separately addressed a question the client raised directly. We made no statements about theft, corruption or bad faith - not in the report, not in correspondence, not in this material. Such statements without a court judgment create legal risk for the client and undermine the value of all the evidence gathered.
Reconstructing the movement of funds and describing related assets is possible. Establishing fault is not - that falls within the competence of a court, not a private investigation.
Recording the initial payments and documents
Reconstruction does not begin with a search but with putting in order what the client already has. Below is what was included in the initial base and what was not, and could not have been.
- 01
Documents provided by the client
Contracts, appendices, deeds, the client's own payment records and project correspondence to the extent lawfully held by the client. This is the basis for all further work: without it, reconstruction turns into speculation.
- 02
Timeline of fund transfers
Each payment was broken down by date, basis and recipient. Discrepancies between what was agreed and how it was executed usually surface already at this stage - this is an observed fact, not an assessment.
- 03
Publicly available corporate data
Registration information, participation, officers, and filings in those jurisdictions where such filings are public. Everything accessible to any person by lawful means.
- 04
Property and industry registers
Information on rights and encumbrances where registers are open, and industry information on projects of the relevant type.
- 05
What the basis did not and could not include
Bank statements on third-party accounts, trust documents, and any information not obtained from a lawful source. Such materials were not requested, would not have been accepted, and would not have been used even if offered.
- 06
Perimeter fixed in writing
The scope of structures and entities subject to verification was defined before work began and was not expanded along the way without separate agreement. Expansion "just in case" falls outside the bounds of a legitimate purpose.
Reconstructing the cross-border flow
The reconstruction was carried out not by tracing money, but by tracing obligations and corporate events. This is a fundamental distinction worth explaining: a private investigation has no access to, and cannot have access to, the movement of funds through third-party accounts, yet the picture can nonetheless be reconstructed.
It is reconstructed from observable events: who entered into relations with whom and when, what changes occurred in the structures of the participants, what projects were launched and acquired, how the composition of participants and officers changed. The sum of these events over time produces the line along which value can be traced.
The economic logic of each transfer was assessed separately. Not every movement between related companies means diversion: most transfers have an ordinary business explanation, and until that explanation is ruled out on independent grounds, the conclusion remains a hypothesis.
It is precisely this distinction that produced the bulk of the result. Some transfers received a convincing ordinary explanation and were set aside. Some remained without such an explanation while an observable connection was present - and were placed in a separate group requiring procedural verification.
Two qualifications are necessary here. First: reconstruction based on corporate events shows connections and their probable nature, but does not replace a judicial financial expert examination. Second: we do not assert the origin of a specific asset as proven - this requires forensic examination and a court decision, and substituting one for the other appears too often in materials of this kind.

The project did not use bank statements on third-party accounts, trust documents or any information obtained from unlawful sources; no actions were taken to gain access to third-party systems, devices or correspondence. The client, counterparties, related parties, details, property addresses and structure identifiers are not disclosed in this material.
Verification of related companies and individuals
Connectedness was assessed by observable indicators and broken down by degree, rather than on a «connected or not» basis. Formal connection: participation, positions, representation in public records. Economic connection: receipt of benefit, financing, use of shared resources. Operational connection: actual involvement in management and in dealings with counterparties.
This distinction matters more than it appears. A formal connection is easy to find and proves almost nothing; an operational connection is harder to find and says considerably more. A report in which these levels are mixed looks convincing and falls apart at the first review in proceedings.
Each conclusion was accompanied by an indication of its basis and confidence level. Where the basis was single and indirect, the conclusion was marked accordingly - as a working hypothesis. Few hypotheses remained in the final report, and all of them were flagged.
Personal data of related persons was not collected beyond what was necessary to establish the fact of connection, and is not published in any volume. There are no names, addresses or any identifiers in this material.
And a fundamental limitation of this section. Establishing a connection is not establishing guilt. We did not and do not claim that any person or organization acted in bad faith or unlawfully. Such a determination falls within the competence of a court, and any other formulation would exceed our mandate.
A report in which formal and operational connection are mixed looks convincing and falls apart at the first review in proceedings.
How an investment turns into a verifiable map of value
Five stages of the work. The moment that changed the client's decision is marked in red. Schematic representation: structures, amounts, sources and methods are not disclosed and may not be reproduced.
Факт. Investments of EUR 5 million were made under agreements with several companies in different jurisdictions.
Решение. The client's documents, not assumptions about counterparties, were taken as the starting point.
Факт. The payment timeline revealed discrepancies between what was agreed and what was executed.
Решение. The discrepancies are recorded as fact, without characterizing the actions.
Факт. The flow was reconstructed from corporate events, not from the movement of funds through accounts.
Решение. An ordinary business explanation was formulated for each transfer; some transfers were dismissed.
Факт. Objects are divided into three levels of evidentiary strength, with the degree of confidence indicated.
Решение. The conversation shifted from searching for funds to describing related assets and control.
Факт. For each jurisdiction, the available measures, conditions, timeframes and costs are described.
Решение. Further steps are handed over to the client's legal counsel; compensation amounts are not published.
Факт. Investments of EUR 5 million were made under agreements with several companies in different jurisdictions.
Решение. The client's documents, not assumptions about counterparties, were taken as the starting point.
A diagram of five stages: investment, counterparties, cross-border flows, related assets, legal route. A turning point that changed the client's decision is marked at the fourth stage.
Asset map and levels of evidentiary support
The final map was built not as a list of findings but as three groups, divided by level of proof. This is the main result of the work: without such a division, an asset map is of no use to lawyers.
The first group - objects with documentary basis: the existence of the object, the nature of rights and encumbrances are confirmed by records in accessible registers. There is nothing to dispute here, but the connection to the flow of invested funds in this group is not always direct.
The second group - objects with an observed connection and an analytical conclusion on the degree of control. There is a basis, it is described, and the confidence level is stated. This group usually determines practical decisions.
The third group - positions on which no confident conclusion can be drawn. They are always a minority, and are flagged directly. The temptation to dissolve this group into the first two is strong, and it is precisely this that turns a report into a document that cannot be shown to opposing counsel.
The estimated range of connected assets - EUR 7.2-8.1 million - is published precisely as an estimate. It is a benchmark based on open market data, not a confirmed value, not a recoverable amount, and not a promise of what may be obtained. The difference between the ends of the range reflects differing interpretations of disputed positions, not a margin of measurement error.
And the key limitation, repeated in the evidence panel: the origin of none of the objects is asserted as proven. An observed connection to the flow of funds and a proven origin of an asset are different things; the latter is established by a court on the basis of expert examination, not by a private investigation.

Legal options in Cyprus and the EU
An asset map without a legal route remains a reference document. For this reason the result was structured as a matrix: what is available in each jurisdiction, under what conditions, within what timeframe and at what cost.
The same set of points was described for each direction: what interim relief mechanisms are available in principle and what is required to apply them; how foreign court judgments are recognized and enforced; what the realistic duration of the procedure is; what costs it entails. Without the last point, comparing options is meaningless.
In projects of this kind, the Cypriot direction is usually considered first - not because it is «simpler», but because corporate information there is more substantive and procedural mechanisms are well established. This does not make the outcome predetermined: the existence of a mechanism and its applicability to specific circumstances are different questions.
The matrix regularly shifts the client's priorities. The jurisdiction with the largest volume of findings often turns out to be the least promising procedurally, while the direction with a smaller volume proves the most enforceable. The decision is made on the totality of factors, not on the volume of findings.
Documented in writing and repeated here: neither an attachment, nor an interim measure, nor a recovery of funds is a result of our work. All of these are the result of procedural actions conducted by the client's lawyers and decided by the court. We did not assess the prospects of any specific matter and did not provide legal advice: the choice of strategy remains with the client's legal advisors in the relevant jurisdictions.
What is confirmed, what is assessed, and what remains a limitation
Confirmed
documentary or official basis- volume of investment: EUR 5 million per client documents
- duration of work: 34 days
- jurisdictions covered: Ukraine, Poland, Cyprus, UAE, Switzerland
- a written record of the perimeter and a list of excluded actions
- chronology of fund contributions based on client payment documents
- records of rights and encumbrances in available registers
Assessed
analytical conclusion with an indication of confidence level- discrepancies between what was agreed and what was actually performed - high confidence
- presence of an ordinary business explanation for part of the transfers - high confidence
- connection of some objects to the flow of invested funds - medium confidence
- degree of actual control over related structures - medium confidence
- estimated order of magnitude of related assets EUR 7.2-8.1 million - assessment based on open market benchmarks, not a confirmed value
Limitation
what cannot be stated publicly- the origin of a specific asset is not asserted as proven: this requires forensic examination and a court decision
- theft, corruption, bad faith and unlawful conduct by anyone have not been established and are not presumed
- banking and trust information was not used: a private check has no access to it
- neither seizure, nor an interim measure, nor recovery of funds is a result of the check
- amounts of agreed compensation and actual receipts have not been verified and are not published
- no disclosure of any materials to authorities is reported: this is a decision for the client and their counsel
The public version of the panel is anonymized. Client, counterparties, related persons, structures, objects, details and sources and methods are not published; the wording provided describes the structure of the work, not its content.

How the compensation route was agreed
The transition from findings to negotiations was conducted by the client's legal advisors. We did not take part in this stage: we did not contact counterparties or related parties, did not act on behalf of the client, and did not conduct negotiations. This separation of roles is not a formality here - contact from the reviewing organization would have devalued both the client's position and the review itself.
In substance, the conversation became possible for the same reason as in other similar cases: one side now had a described picture instead of general grievances. Not allegations of bad faith, but a statement of the factual position and the legal mechanisms available.
The practice of formalizing such arrangements comes down to a few elements, and they are the same regardless of the amount. A schedule with specific dates and amounts, not with intent. Acknowledgment of the obligation in a procedurally usable form. Security where it is attainable. Consequences of delay described in advance, taking effect automatically.
The procedure for confirmation is recorded separately. The only confirmation of receipt of funds is the client's bank statements: neither the arrangement, nor the schedule, nor a party's statement constitutes payment. The same applies to the realization of assets - confirmation is the transaction, not the intention to carry it out.
This is why we do not publish either the amount of the agreed compensation or the amount of funds actually received. These figures lie within the client's own scope and reporting; we did not verify them and could not have verified them. The amounts stated by the client are not given in this material.
And one more thing usually left unmentioned in such materials. We do not report on the transfer of any materials to competent authorities. Such a transfer is a decision of the client and its legal advisors, and publishing such information without confirmation and permission is not permissible.
What the company changed in its investment controls
First. The reporting requirement was moved from a format of "provided regularly" to a format with a specific list of indicators and deadlines, breach of which triggers consequences described in advance. Delay in reporting is the earliest and most frequently ignored signal.
Second. The right to verification was fixed in the agreements: access to primary documents, the right to engage an external specialist, an obligation on the counterparty to cooperate. Without such a provision, any subsequent verification begins with negotiations over the very possibility of verification.
Third. Verification of counterparties before investment, not after transparency is lost. Corporate structure, composition of participants, history and connections - all of this is available in advance and costs incomparably less than reconstructing the picture after the fact.
Fourth. Separation of roles within the client itself: the person running the project should not simultaneously assess its condition and present it to the investment committee. Combining these roles is the most common reason signals are noticed too late.
Fifth, and this is a limitation. None of these measures guarantees the safety of investments. They reduce reaction time and preserve evidence, but they do not eliminate risk.
And finally. Thirty-four days and the described procedure are the circumstances of this example, not a norm. A different situation may require substantially more time, and an honest result of such a review is often the conclusion that no related assets available for enforcement were found.
Does this apply to your situation
Signs of a task that is resolved by reconstructing the flow of value, not by strengthening claims. This is not a diagnosis and not a promise of a result.
- project reporting has become generalized or arrives with delay
- payments passed through several companies and jurisdictions
- obligations are formally not breached, but transparency has been lost
- the need is to understand what the value turned into, not who is to blame
- materials will be needed by legal counsel in several countries
- there is a risk that time works against the position and evidence disappears
If proceedings or a dispute are already underway on the project, agree the perimeter with legal counsel before starting an external check: the frame must correspond to the procedural position, not be adjusted to fit it later
Questions and answers
With putting in order what the client already has: contracts, appendices, acts, the client's own payment documents and correspondence on the project. On this basis a chronology of fund contributions is built, and this chronology usually reveals discrepancies between what was agreed and what was performed. The search in external sources begins afterward, otherwise it is conducted blindly and wastes time.
By observable indicators of connection, arranged by degree: formal - participation and positions in open data; economic - benefit, financing, shared resources; operational - actual involvement in management. These levels must not be mixed: a conclusion in which they are mixed collapses at the first challenge in proceedings. Ownership of an asset, meanwhile, is established by a court, not by a check.
Yes, if they are explicitly identified as indirect and accompanied by a level of confidence. An indirect indicator is acceptable as grounds for a working hypothesis and unacceptable as grounds for a statement of fact. The practical value of a conclusion is determined precisely by the honesty of this distinction: a document in which hypotheses are presented as conclusions cannot be shown either to a court or to an opposing party.
A summary conclusion separating what is confirmed, estimated and unestablished; a description of the range of objects and structures without identifying details; a chronology of fund movement based on client documents; an assessment of the degree of control with an indication of confidence; and a separate list of what could not be established. Specific procedural requirements are determined by Cypriot counsel: they depend on the mechanism chosen and the circumstances of the matter.
By open market benchmarks for objects of the relevant type and class. This is an order-of-magnitude estimate, not a confirmed value and not a sum to be recovered: the actual price is determined by the transaction, encumbrances and condition of the object. The range in such estimates is usually wide, and its boundaries reflect differing interpretations of disputed positions, not a margin of measurement error.
It is possible, and this scenario occurs often, but it depends on the position of the other party and is not guaranteed. An arrangement has value only in documented form: specific dates and amounts, acknowledgment of the obligation in a procedurally usable form, security where achievable, and consequences of delay described in advance. Only bank statements serve as confirmation of receipt of funds.
How to read this material
BLACKFILE works with documents provided by the client on a lawful basis and with publicly available data. The company distinguishes between confirmed, assessed and unestablished information and indicates the limitations of the data obtained. BLACKFILE does not establish guilt and does not qualify actions as unlawful, does not use banking or trust information, does not access third-party systems or correspondence, does not contact the client's counterparties, does not conduct negotiations on the client's behalf, and does not substitute for the courts or authorised bodies.
A composite example based on typical matters; details have been altered. The material does not disclose the client, counterparties, related persons or the circumstances of a specific project. Banking and trust information, identifiers of structures, addresses of assets, sources and operational methods have been excluded entirely and deliberately.
The result depends on the documents, the jurisdiction and the actual circumstances. The timeframe and procedure described are not a standard and do not carry over to other situations. An honest outcome of such a check is often a conclusion that no connected assets are available for enforcement.
This material is informational in nature, does not constitute legal advice and does not contain an assessment of the prospects of a specific matter. BLACKFILE does not guarantee recovery of funds, discovery of assets or the outcome of any legal proceedings.
Similar cases
What to read next if your situation is closer to another type of task.
BF-014Tracing a bank debtor and mapping assetsif the obligation is a loan and the counterparty has stopped responding950 million RUBcredit line21 daysengagement duration4 jurisdictionsгеография
BF-010Corporate fraud and misstatement of accountsif the doubts concern the company's own accounting recordsEUR 620-890 thousanddamage assessment19 daysengagement duration4 jurisdictionsгеография
BF-005Establishing a hidden beneficial ownerif the main question is who actually controls the structure9 structuresscope of verification23 daysengagement duration5 jurisdictionsгеография
Has project transparency been lost while everything appears formally in order?
Describe the situation in general terms: the nature of the investments, the point from which the accounting ceased to be meaningful, and the countries where the payment recipients were located. Do not send agreements, statements or personal data through the initial enquiry form. BLACKFILE will assess the legal basis for the matter and the possible scope of work.
The work is agreed with your legal advisers and does not substitute for the courts or authorised bodies. Do not send documents or personal data through the initial enquiry form.