Article 114-1 of the Criminal Code has turned booking into a source of criminal risks even for honest enterprises: searches, seized equipment, and suspicions served to employees. How to build a defense before the investigators' visit.
The criticality of enterprises was created as a safeguard for the economy: the state allows employees without whom the energy sector, defense industry, or logistics cannot function to be exempted from mobilization. But «employment for money» schemes have given law enforcement officers a reason to open proceedings under Article 114-1 of the Criminal Code, and the consequences are felt not only by those who abused this right. According to the Office of the Prosecutor General, there were 1,144 such proceedings in 2025—36.2% more than the previous year.
How criticality is related to the Criminal Code article on obstructing the Armed Forces of Ukraine
The reservation procedure (CMU Resolution No. 76 of January 27, 2023) requires a company to meet at least 3 out of 8 criteria, two of which are mandatory: no budget arrears and a salary of no less than three minimum wages (approximately UAH 25.9 thousand; for frontline territories — approximately UAH 21.6 thousand). As a rule, up to 50% of employees can be reserved. Exceeding the limit results in the cancellation of excess deferrals within 10 working days and the risk of revocation of status with a repeated application allowed only after six months.
Art. 114-1 of the Criminal Code provides for liability for obstructing the lawful activities of the Armed Forces of Ukraine during a special period: from 5 to 8 years of imprisonment, and for the death of people or other grave consequences, from 8 to 15 years. The law does not explain what «obstruction» means, and the Supreme Court interprets it broadly: in its ruling of June 16, 2026, in case No. 183/12045/24, the Criminal Cassation Court recognized the TCR as a structural unit of the Armed Forces of Ukraine, and obstruction as any actions that complicate their work. Investigators eagerly interpret these concepts at their own discretion and also fit fictitious employment under this formula: if a person without grounds received a deferment, the mobilization resource allegedly decreased.
Such proceedings fall under the jurisdiction of the SBU (Part 2 of Article 216 of the CPC), but the prosecutor can instruct another agency to conduct the investigation, which is why the police, the ESBU, and the SBI all come to enterprises, often from another region. The line between an honest mistake (exceeded limit, civil contracts instead of employment agreements, business trips without documents) and «fictitiousness» runs through intent, which will have to be refuted already in the status of a witness, or worse—a suspect.
In judicial practice, we see, in particular, the following typical situations. For example, «selling military exemptions» — when, according to the investigation, individuals associated with companies holding critical status offer clients to formally employ liable-for-military-service individuals on their staff for a fee (Case No. 760/14730/26). Or when a small enterprise has a small number of employees, and according to the investigation, part of the staff does not actually work (Case No. 523/9902/25). However, the exact same factual allegations are also used when a company operates honestly and has no abuses whatsoever, but investigators, knowing there is no liability, simply come in with searches.
What it looks like: from temporary access to suspicion
Everything begins without the enterprise's knowledge—with a «factual» proceeding, when no one has yet been notified of suspicion. Investigators are getting temporary access to reservation data: in one of the rulings dated September 4, 2026, No. 727/12322/26, the SBU obtained a complete list of reserved employees of a defense enterprise for 3 years, as well as the IP addresses and electronic keys used to make changes. The documents were held by a third party, so the owner was not summoned, and the ruling cannot be appealed—the enterprise finds out about this after the fact.
Next is a search, also in a «fact-based» proceeding. The ruling allows a one-time entry for a search within the one-month period of its validity (Article 235 of the CPC). If the CPC is followed, computers and phones should only be seized where they are explicitly named in the ruling.
In practice, equipment is almost always seized and then subjected to an asset freeze. A motion to freeze must be filed within 48 hours after the seizure, otherwise the property is returned, but the courts consider it almost automatically using the formula that the seized item is «physical evidence that may contain information» – without assessing proportionality and often without the owner present. This was the case in proceedings No. 760/14730/26 and No. 523/9902/25. In the first case, a warrantless search conducted on May 14, 2026, during an arrest, was «legalized» by the court only on June 12, 2026, even though the law requires applying without delay.
Next, suspicion and a preventive measure are possible. Detention without a court order is permissible only in clearly defined cases, so its grounds should be verified separately. For Articles 109–114-2 of the Criminal Code under martial law, Part 6 of Article 176 of the Criminal Procedure Code provides for detention in the presence of risks defined by the Criminal Procedure Code associated with evading the investigation and obstructing the investigation.
The Constitutional Court recognized this provision as constitutional, but obliged courts to realistically assess risks, and did not rule out bail (Decision No. 7-r(II)/2024 dated 06/19/2024). Therefore, there is no «automatic pre-trial detention facility,» but evidence of the absence of risks must be prepared for the first hearing.
Is this pressure?
There are signs that distinguish an investigation from pressure: a request for the entire list of reserved persons over the years without a specific episode, seizure instead of copying, property without a timely motion for arrest, «fact-based» proceedings for years without a suspicion, systemic summons of management and employees as witnesses, and refusal to return seized property for months after the seizure. Such actions by law enforcement, provided there are no real grounds for an investigation, constitute pressure.
Branches in different regions: the lawyer must be wherever the search is
A separate risk for businesses with branches is simultaneous searches at the head office and in several regions. A single lawyer can only be present in one place, and if the search is followed by a notice of suspicion and detention, the initial investigative actions and the pre-trial detention hearing take place within hours, often in the court at the location of the investigation in another region. Detention lasts up to 72 hours, so the local lawyer must arrive first, while the lead lawyer must join remotely and arrive by the time of the hearing.
Recommendation: framework agreements with attorneys in the regions of presence, a memo for branch directors, templates of powers of attorney and applications, a single coordinator at the head office, and coordinated dispatch of attorneys to search locations.
How to protect oneself in such cases?
Demonstrate the absence of abuse
For each reserved person, keep an order, employment contract, job description, information about system accesses, timesheet, and non-cash salary: this allows you to quickly refute the version of «fictitiousness.» If you use employee recruitment services by other companies, such cooperation must be documented. If there are signals of violations, conduct an internal audit with a lawyer.
During the search
We need a written «first 15 minutes» protocol: which management representatives speak with investigators, who to call, what to check in the court order (court, date, duration, address, list of items, whether computers and phones are named). Demand audio and video recording, enter statements into the protocol, and request copies of the information from the seized equipment.
Passwords and explanations — only after a lawyer's decision: every unprepared word can become grounds for suspicion. All summons, requests, and interrogations — through a lawyer who will clarify the person's status and the right not to testify against oneself (Article 63 of the Constitution).
Additional channels
The Business Ombudsman Council considers business complaints against the actions of authorities, particularly law enforcement agencies, but does not interfere with the course of investigations. It requests explanations, provides recommendations, and raises issues at the agency level. The Council spends only 10 working days on the preliminary assessment of a complaint, and the entire review process takes an average of about 90 days. Since September 2025, the Prosecutor's Office has been accepting complaints via the «Stop Pressure» portal (authorization via Diia, review within up to 30 days). It is useful where violations can be proven with documents—searches conducted without admitting a lawyer, seizure of equipment outside of a court warrant, and property held without seizure for more than 48 hours. This serves as an additional recording of the enterprise's position.
Conclusions
Due to the vagueness of Article 114-1 of the Criminal Code and abuses related to military service reservation, which do indeed occur, conscientious, critical businesses may end up in the crosshairs of law enforcement even without having any connection to illicit schemes. Therefore, defense should be built in advance. A company must be prepared for both searches and any other communication within the framework of a pre-trial investigation—summons, document requests, and interrogations.
Source: The Legal Newspaper
