The First Independent Audit of NABU: What Conclusions Did the Commission Reach?

On 6 May 2025, the Commission for the External Independent Audit released the findings of Ukraine’s first-ever independent assessment of the effectiveness of the National Anti-Corruption Bureau of Ukraine (NABU). This audit marked an unprecedented event in the Ukrainian criminal justice system, as it was the first time an anti-corruption body within the criminal justice sector underwent such a comprehensive external assessment based on international standards.

According to the audit, which covered the period from March 2023 to November 2024, NABU’s performance was assessed as moderately effective. Despite the Bureau’s extensive preparation for the process, the Commission identified significant areas for improvement. Many of the problematic aspects highlighted in the report align with the findings of earlier analytical studies conducted by Transparency International Ukraine.

Particular attention should be paid to the fact that the Commission issued 26 recommendations for NABU regarding activity planning, data collection and use, progress monitoring, and other operational aspects. Implementing these recommendations will require joint efforts from both the Bureau and the Verkhovna Rada, as some of them pertain to legislative changes. It is worth emphasizing that the implementation of the audit findings is a key component of the Rule of Law Reform Roadmap on Ukraine’s path to the European Union. The completion of this audit and the publication of its results also constitute a structural beacon for Ukraine under the IMF Memorandum, with a deadline set for February 2025.

Given the scale of the work performed and the resources invested, it would also be reasonable to revisit the timeframe for future audits. A comprehensive annual assessment may place excessive strain on both the donors supporting the audit and NABU itself. Instead, efforts should be focused on the thorough implementation of the current recommendations and on enhancing the institution’s effectiveness; while conducting independent audits every two years would allow for meaningful monitoring of progress.

On 18 November 2024, the Commission approved the criteria and methodology for conducting the audit. NABU’s performance was evaluated across five key areas: 

• Detection and investigation of high-level corruption 
• Integrity, accountability, and transparency 
• Leadership, strategy, and resource management 
• Interagency cooperation 
• International cooperation. 

As a result of the assessment, the Commission highlighted the following key recommendations:

• Revise the procedures for protecting internal reporters and whistleblowers who disclose misconduct or offenses, including the option to remove the identity of the whistleblower or reporter from records submitted to the NABU Director and the Disciplinary Commission, unless otherwise required by law.
• Procure official mobile phones or develop a program for the secure use of personal devices, with appropriate mobile device security policies and software solutions.
• Establish procedures for objectively verifying the accuracy and completeness of publicly disclosed data submitted by the main detective units and the internal control division.
• Develop, publish, and implement a comprehensive strategic work plan for the Bureau that includes goals, objectives, and measurable performance indicators.
• Develop a Bureau-wide human resources management strategy with timelines and metrics. This plan should align NABU’s human capital program with the institution’s goals and mission, and include long-term strategies for recruiting, developing, and retaining staff to fulfill its mandate.

In this material, we will take a closer look at how NABU’s work was evaluated and consider what was left out of the spotlight.

Detection and investigation of high-level corruption

The detection and investigation of high-level corruption is a core function of NABU, and the Commission concluded that this function is performed sufficiently effectively. To reach this conclusion, the Commission assessed NABU’s performance across the following ten areas of activity:

• Proactive crime detection
• Complaints from third parties
• Gradual escalation of investigative efforts
• Alignment of investigative outcomes with strategic priorities
• Successful investigations 
• Asset recovery
• Investigative resources 
• Fulfillment of statutory duties
• Oversight of investigations
• Institutional and organizational independence.

The Commission confirmed that NABU has, overall, largely achieved the expected results in detecting and investigating high-level corruption; however, some of the evaluated areas require improvement.

NABU demonstrated positive progress in the proactive (self-initiated) detection of crimes, supported by the expansion of the Analytical Department and reallocation of resources. However, the Commission noted that the proportion of such cases should continue to grow steadily, as currently less than half of criminal proceedings were initiated based on offenses independently identified by NABU detectives.

The Commission positively assessed the quality of NABU’s intake and processing of corruption-related reports, particularly those received from other agencies. Instances where NABU detectives failed to conduct sufficiently thorough investigations based on third-party reports were rare and not indicative of a systemic issue. 

Overall, the quality of investigative work by NABU detectives was rated fairly high. During the assessment period, no indictments were returned by the courts, and only one notice of suspicion was cancelled, followed by the issuance of a new one. Since 2023, NABU has introduced the prioritization of criminal proceedings by sector, and most of these have seen an increase in the number of notices of suspicion and indictments. However, the Commission emphasized that this positive trend was not observed in the defense and law enforcement sectors.

The Commission positively evaluated the success of NABU’s investigations. The number of guilty verdicts increased, while acquittals declined. This is attributed to corrections made by the NABU and SAPO in response to earlier investigative errors. Auditors also noted that the rise in guilty verdicts was partly due to the more frequent conclusion of plea agreements.

Nonetheless, asset recovery remains a problematic area. The Commission lacked sufficient data to conduct a comprehensive evaluation of NABU’s success in identifying, tracing, and initiating the seizure of illicit assets, as the materials provided omitted information on the grounds for asset seizure and the value of the property involved. According to the auditors, the absence of this data negatively affects the ability to assess NABU’s effectiveness in this area. 

Despite the recommendations provided in the 2023 Technical Assessment, the NABU still lacks joint guidelines with SAPO on the application of seizure and confiscation (including special confiscation), as well as a registry of parallel financial investigations or criminal proceedings that would allow for a thorough verification of suspects’ assets. The auditors also noted that a number of legislative initiatives required by the Asset Recovery Strategy have not yet been coordinated between the NABU and ARMA. In our view, this issue is largely due to the quality of the legislative proposals coming from ARMA, which are often problematic. 

The report supports our earlier concern that confiscation as a form of criminal punishment is most often applied instead of special or extended confiscation. As a result, it cannot be enforced abroad. To date, based on materials submitted by the NABU and SAPO, only one HACC verdict involving special confiscation has been forwarded for enforcement in a foreign jurisdiction.

Overall, the Commission gave a positive assessment of NABU’s resource base. In most cases, personnel are provided with the necessary technical equipment, receive regular training, and engage in the exchange of best practices. The NABU has its own user-friendly system—Memex—for collecting operational and investigative data among detectives and analysts. However, the system cannot be used to process classified information, which limits its applicability. A key challenge for the NABU in this area remains a shortage of personnel, particularly analysts.

The auditors also assessed the extent to which detectives comply with legal requirements in their work. Representatives of SAPO and HACC interviewed during the audit confirmed the absence of intentional or systemic unlawful actions by NABU detectives. Isolated unintentional violations, when they do occur, are carefully reviewed by Bureau leadership and communicated back to staff along with the relevant findings. 

The system of oversight over detectives’ work did not present significant deficiencies. The Commission concluded that immediate supervisors are proactively involved in investigations and are accessible for collaboration. Concerns expressed by former NABU employees regarding oversight were not substantiated by the auditors.

In the area of investigative oversight, eCase case management system plays a critical role, as it facilitates and accelerates daily communication between detectives, their supervisors at NABU, and SAPO prosecutors. However, the Commission stressed that a similarly effective system should be introduced for the management of operational and investigative cases.

Institutional and organizational independence of the NABU was a particularly important element in the Commission’s assessment of investigative effectiveness. In this regard, auditors noted concerns highlighted in the Shadow Report, including the lack of independent expert analysis in top-level corruption cases and NABU’s dependence on the SSU for wiretapping operations. NABU’s independence is further undermined by its need to obtain SSU-issued access to classified materials related to operational and investigative activities, which are considered state secrets. This creates risks of disclosing sensitive information and exposing NABU undercover operatives. 

To assess NABU’s level of independence, the Commission surveyed 13 civil society organizations, of which 11 fully or partially agreed that NABU is institutionally and organizationally independent. 14 out of 15 members of the Civil Oversight Council confirmed this assessment.

Finally, in this section, the Commission echoed our observation that investigating systemic high-level corruption is time-consuming and that the “Lozovyi amendments” have negatively impacted NABU’s ability to investigate such cases, particularly following the Supreme Court decision in October 2022. Despite NABU’s efforts to introduce relevant legislative amendments, the issue remains unresolved.

To enhance the detection and investigation of high-level corruption, the Commission outlined three recommendations for the NABU:

• Collect and monitor statistics on the proactive detection of corruption offenses, investigative actions (including motions submitted, particularly motions for asset seizure), parallel financial investigations, court rulings on asset recovery, actual asset recovery outcomes, and their alignment with NABU’s strategic priorities (including priority sectors and other key focus areas)
• Prioritize and actively pursue the alignment with ARMA on legislative initiatives that will facilitate the effective implementation of the asset recovery strategy
• Assess ways to improve the usability and functionality of the Memex system, including the provision of additional guidance or staff training.

The Commission also issued five recommendations addressed to the Verkhovna Rada and other authorities:

• To meet NABU’s immediate needs, consider urgent measures to initiate action plans for enabling NABU to conduct autonomous wiretapping
• To ensure NABU’s institutional independence and provide a sustainable solution to its need for autonomous wiretapping, consider legislative amendments or implement other institutional measures to eliminate existing technical obstacles
• To guarantee NABU timely and impartial access to forensic expertise, consider introducing additional legal safeguards and mechanisms to ensure the availability and impartiality of independent forensic services
• To avoid undermining NABU’s ability to seize assets in Ukraine and abroad, refrain from amending Ukrainian legislation in a way that would require a review of all asset seizure orders every two months, as such a requirement is impractical
• To provide NABU and other law enforcement bodies with sufficient time to conduct pre-trial investigations and to remove additional barriers in combating high-level corruption, consider repealing the “Lozovyi amendments.”

Integrity, accountability, and transparency

According to the Commission’s findings, NABU’s activities related to integrity, accountability, and transparency during the assessment period were moderately effective. The Commission assessed the following areas: 

• Mitigation of information leakage risks
• Engagement with the Civil Oversight Council (COC)
• Processes for detecting, investigating, and reviewing potential misconduct by staff
• Whistleblower protection
• Response to citizen inquiries and other information requests
• Follow-up on recommendations
• Public outreach 
• Public reporting on activities
• Integrity culture 
• Oversight of the Second Chief Detective Division (D-2).

The Commission noted that during the assessment period, NABU undertook certain steps to strengthen its control mechanisms and reduce the risk of information leaks. In particular, the Director approved guidance on mitigating leakage risks. However, the Commission pointed out that NABU failed to clearly demonstrate who is responsible for monitoring the implementation of these new guidelines. 

The NABU was unable to demonstrate the effectiveness of these control mechanisms, as the relevant measures had either not yet been implemented or had only been introduced recently. The Commission observed that the shared responsibility for data protection between the Information Security Division of the Internal Control Department (ICD) and the Information Technology Department may lead to confusion regarding authority, urgency, and the need for corrective actions concerning technical control mechanisms. 

The Commission stated that information leaks remain a chronic problem for NABU, and the Bureau should continue to focus on implementing and monitoring effective control mechanisms to prevent and detect such leaks. These recommendations are also consistent with our analysis of the leakage issue.

The Internal Control Department is responsible for detecting, investigating, and reviewing potential misconduct by NABU personnel. The Commission found that, overall, the procedures governing the ICD’s authority to identify possible wrongdoing appropriately empower the department to take necessary action while balancing it with employees’ right to privacy. 

Notably, the report states that the head of the ICD submitted a memorandum to the NABU Director, asserting that existing management practices align with international standards and that the 2023 Technical Assessment recommendation on integrity testing through scenario-based checks could be considered implemented. The Director endorsed the memorandum, and the recommendation was marked as completed. However, the Commission determined that the information in the memorandum was inaccurate, lacked an assessment of employees’ rights compliance, and that the review process was not objective, despite partial approval by internal auditors in 2025.

The ICD has an annual work plan that includes general key performance indicators (KPIs) for its activities, including the detection of misconduct. However, these indicators should be further refined to improve the department’s performance. NABU should not only publicly report the number of ICD activities aimed at detecting violations and how many resulted in investigations, but also regularly assess the effectiveness of these actions.

At the same time, in our research, we highlighted specific issues related to the exercise of the ICD’s powers concerning integrity checks and lifestyle monitoring of NABU employees.

With regard to internal investigations, the Commission identified several issues: the ICD does not investigate all reports in a timely manner, applies investigative powers inconsistently, gives insufficient attention to requests from SAPO prosecutors, has inadequate reporting procedures, and sometimes produces incomplete investigative files. The ICD’s work plan contains inaccuracies, and the combination of prevention and investigative functions creates a conflict of interest. This raise concerns that oversight by the NABU Director may obstruct legitimate investigations to avoid reputational damage. While the Disciplinary Commission has adequate procedures in place, the Director occasionally overrides its decisions. Overall, there is a lack of public trust in the objectivity of disciplinary proceedings within the NABU.

With regard to whistleblower protection, the Commission partially relied on the findings of the UNDP evaluation, presented in the report on compliance with whistleblower protection requirements published in January 2025. According to a 2024 survey, 46 employees reported that they or someone they knew had personally experienced, or had witnessed, negative consequences as a result of reporting misconduct or raising concerns within the NABU. The Commission identified as a practical gap the fact that few NABU employees report internal violations. Notably, the Commission received several complaints from detectives stating that unit managers reproached them for filing such reports. The Commission emphasized that procedural shortcomings and an inappropriate tone “at the top” among NABU’s leadership and unit heads discourage potential whistleblowers and internal reporters.

The Commission also assessed NABU’s responsiveness to recommendations. It found that the Bureau’s internal written procedures regulating the response to internal audit findings function effectively in practice. NABU reported that it had implemented 24 of the 90 recommendations issued following the 2023 Technical Assessment. The Commission acknowledged NABU’s commitment to implementing the recommendations but noted that the processes for evaluating, monitoring, and closing recommendations remain somewhat non-transparent. As a result, the Commission was unable to verify the implementation of certain items. 

At the same time, the Commission praised the NABU’s high level of public outreach. However, during the audit, it was discovered that although the new statistical data collection process allows for more up-to-date reporting, particularly on NABU’s website, the fact that most investigative statistics are still collected manually introduces a risk of error in certain areas. The Commission expressed particular concern about the reliability of asset recovery data.

The Commission also paid special attention to the D-2, noting that its procedures are properly developed and in line with modern international standards. However, practical gaps remain: there are no annual ethics training requirements for D-2 staff, and D-2 personnel do not fall under the jurisdiction of the ICD for internal misconduct investigations. While auditors recognize that limited public information on D-2’s activities is justified, the Commission noted that additional public reporting, such as summaries of audit results or other accountability efforts, would enhance transparency and help build public trust.

In this section, the Commission identified the following key recommendations: 

• Revise procedures to protect the identity of whistleblowers and internal reporters who disclose misconduct or violations, including allowing the removal of a whistleblower’s or reporter’s identity from records submitted to the NABU Director and the Disciplinary Commission, unless otherwise required by law
• Procure official mobile phones or develop a program for the secure use of personal devices, with appropriate mobile device security policies and software solutions
• Develop procedures for the objective verification of the accuracy and completeness of public data provided by the main detective divisions and the ICD. 

The Commission also recommended the following: 

• Integrate a monitoring component into NABU’s whistleblower program, including the confidential collection of feedback from whistleblowers and reporters, where appropriate
• Appoint a senior official responsible for overseeing the implementation of the leakage risk mitigation plan, and ensure regular monitoring with measurable performance indicators
• Introduce restrictions or compensatory controls over the use of social media and private email accounts for conducting NABU business
• Develop training materials or guidance for managers on the appropriate leadership tone needed to ensure the protection of whistleblowers and internal reporters
• Conduct an objective review of current ICD practices related to integrity testing through scenario-based checks, and develop a policy to regulate such practices
• Develop meaningful KPIs to assess the effectiveness and impact of ICD’s misconduct detection and investigation efforts—these indicators should be specific, measurable, achievable, relevant, and time-bound (SMART)
• Conduct an objective review of procedures and practices for initiating internal investigations and, if necessary, revise them to ensure timely and impartial assessments and investigations of all credible allegations of serious misconduct by NABU personnel
• Review procedures to ensure that differences in conclusions between investigators and ICD leadership in internal investigations are documented, with internal records of the nature of such disagreements and how they were resolved
• Ensure the maintenance of complete and verifiable records of disciplinary proceedings, including the findings of the ICD, the Disciplinary Commission, and the NABU Director, to enable the monitoring of lessons learned and ensure consistency in the application of procedures and sanctions
• Develop and implement a NABU communications strategy, including mechanisms for monitoring communication effectiveness.

To enhance NABU’s accountability, the Commission recommended that the Verkhovna Rada consider amending the Law on NABU to provide for external assessments every two years instead of annually. The auditors emphasized the importance of standardizing the assessment period to reduce overlap and eliminate gaps, as well as establishing key dimensions of effectiveness to be subject to audit, while allowing the Commission to retain flexibility in developing methodologies and specific criteria based on risk analysis. 

Leadership, strategy, and resource management

The Commission concluded that NABU’s performance in the area of leadership, strategy, and resource management during the assessment period was moderately effective. Specifically, the Commission assessed the following domains:

• Strategic planning
• Investigation priorities and resource allocation
• Leadership independence
• Organizational structure
• Internal management information systems
• IT modernization
• Human capital management practices.

The auditors echoed our concern that NABU operated without a current strategic plan for most of the assessment period. The previous strategy expired in 2023 and did not contain specific measurable performance indicators. Interestingly, an analysis of the implementation of the previous action plan yielded mixed results: out of 233 activities, the NABU fully implemented 148, partially implemented 44, and failed to implement 41. However, even among the completed activities, many lacked clarity and specificity. 

The new NABU Development Strategy for 2025–2030 was approved on 4 March 2025 but remained unpublished on the agency’s website for an extended period, preventing public analysis.

The Commission also paid attention to NABU’s introduction of a prioritization policy for criminal proceedings in 2023, which was updated in 2025. NABU’s internal procedures distinguish between strategic (long-term) and operational (short-term) priorities. Strategic priorities reflect various characteristics of the offender and the offense.

At the same time, during the assessment period, NABU did not maintain a control list or data-tracking system that would enable management or external evaluators to identify, monitor, or assess priority investigations. The NABU reported that as of 2025, this system was improved and now includes detailed records of initiated criminal proceedings.

Regarding changes to the organizational structure, the Commission noted that some operational areas remain unbalanced. Analysts from the Criminal Analysis and Financial Investigations Unit conduct few financial investigations. The ICD is responsible for a broad range of critical functions, yet its internal structure lacks a clear and precise division of labor.

The Commission specifically addressed the issue of the independence of NABU leadership. It referred to two publicly known incidents in which the Bureau’s Director appeared to act in defense of his independence. The first occurred shortly after his appointment in March 2023, when the Prime Minister “recommended” that he appoint two finalists to senior positions within the NABU. The Director disregarded the suggestion, which was widely perceived as a successful demonstration of independence. The second case was less clear-cut. In June 2024, the Director declined an invitation to testify before a parliamentary committee regarding the 2024 “leak” incident. He published his explanation on Facebook, stating that it would be premature to discuss a pre-trial investigation before its conclusion.

In a survey of civil society organizations, 7 out of 13 respondents fully or partially agreed that NABU leadership is independent, 4 disagreed, and 2 said they were unsure. In the Civil Oversight Council survey, 13 of 15 members agreed that NABU leadership makes decisions independently, while 2 were undecided.

Regarding internal management information systems, the Commission noted that the NABU lacks a project management system to coordinate and monitor its numerous programs, projects, and activities. Such a system would enable leadership to allocate resources, track progress, and issue requests for the objective assessment of developments. The NABU also lacks an internal management system to collect, monitor, and objectively verify statistical data related to priority cases—an observation aligned with our own recommendations.

Nevertheless, NABU has introduced several technological tools to enhance its operations, including the eCase case management system, the Memex data analysis platform, the Information Broker tool, and various analytical and operational instruments. While the eCase system received largely positive feedback from auditors, the Memex system drew mixed responses from detectives, with concerns raised about its outdated platform and limited functionality. 

In terms of human capital management, the Commission acknowledged progress made by NABU, particularly regarding performance evaluation of detectives. However, questions remain as to whether the system adequately incentivizes complex long-term investigations or cooperation between various Main Detective Divisions (MDDs). No similar evaluation system exists for ICD detectives or non-investigative staff in other units. In our view, a key shortcoming is the focus on quantitative metrics to the detriment of qualitative indicators, such as weaknesses in evidence collection, overturned investigative judge rulings on detectives’ motions, or prosecutorial reversals of detective decisions by SAPO.

As for financial resources, the auditors noted that the budgets approved for 2023 and 2024 were below NABU’s actual needs. The Bureau reported ongoing underfunding of essential needs, including IT hardware and software, tactical gear, and capital repairs and renovations of buildings in Kyiv and the territorial offices in Lviv and Kharkiv.

In this section, the Commission issued two key recommendations:

• Develop, publish, and implement a comprehensive strategic plan that includes goals, objectives, and measurable performance indicators,
• Develop a human resources management strategy covering the entire Bureau, with deadlines and metrics, aligning NABU’s human capital program with the institution’s goals and mission, and including long-term strategies for recruitment, development, and retention to support the Bureau’s mandate.

The Commission also issued five additional recommendations:

• Officially assign responsibility for the implementation and monitoring of NABU’s strategic plan to an appropriate structural unit,
• Implement and maintain a unified project management system to coordinate and continuously monitor NABU’s programs and activities, ensuring the achievement of its operational, compliance, and reporting objectives,
• Conduct an objective assessment of the Information Security Division’s functions to determine whether its reporting structure and responsibilities are properly aligned,
• Evaluate the feasibility of introducing competitive selection, rotation, or term limits for certain additional senior management positions at NABU, and, if justified, initiate relevant measures for implementation, 
• Review and, if necessary, revise the procedures for identifying material needs in accordance with established priorities for state budget and international funding.

Interagency cooperation

Overall, the Commission assessed NABU’s interagency cooperation as moderately effective, highlighting both positive developments and systemic deficiencies that require correction. The following aspects were assessed:

• Formalization of interagency cooperation agreements
• Information exchange
• Mitigation of risks of disclosing pre-trial investigation information during interagency collaboration
• Disputes over jurisdiction and investigative authority.

According to the Commission, NABU has formal agreements with many partners, most of which were concluded during the Bureau’s early development. However, these agreements rarely include clear objectives or dispute resolution mechanisms. NABU leadership does not systematically monitor the implementation of these agreements and seldom reviews or updates them.

For example, the memorandum between the NABU and SAPO was signed back in 2017, yet many of its provisions remain unimplemented, and the updated draft memorandum from 2024 has not yet been approved. The working group intended to oversee implementation was never established; meetings are held without minutes, and investigation plans are often agreed upon verbally, despite the requirement for written procedures. 

Nevertheless, the Commission acknowledged that NABU–SAPO cooperation has yielded positive results: there is a growing number of proceedings, suspicions, indictments, and convictions—an observation also noted by TI Ukraine experts in our Shadow Report, as well as an increase in the volume of seized assets. 

The Commission considers the cooperation between NABU and the NACP to be effective, although the number of convictions and sanctions in cases referred by the NACP to NABU remains low. Auditors noted that both institutions should focus on improving coordination. For example, there is a lack of alignment between NABU and NACP on the monitoring of asset declarations of public officials and covert NABU operatives. The NACP submitted a draft order, which the NABU rejected, proposing instead to resolve the matter after martial law ends. As of now, the NABU has not received a response from the NACP, and the issue remains unresolved. 

Agreements also exist between the NABU and the Security Service of Ukraine, the State Bureau of Investigation, and the National Police. However, the Commission concluded that none of these agreements function as “living documents.” There is no recorded evidence of effective information exchange or joint operations among these agencies.

According to the Commission, the memorandum of understanding with the Asset Recovery and Management Agency (ARMA) does not properly regulate asset transfer procedures. In 2023, the ARMA proposed a new agreement, but the NABU declined to consider it. The ARMA also submitted several draft laws and regulations needed to implement Ukraine’s Asset Recovery Strategy, which the NABU returned for revision. Two working meetings between the institutions took place in October and November 2024, during which some arrangements were made, but they were not formalized. In our view, the problem lies more in the quality of the documents submitted by the ARMA for review, rather than NABU’s position. The report also highlights the low added value of ARMA’s asset tracing function.

Cooperation with the State Financial Monitoring Service takes place via letters from the NABU requesting analysis of financial transactions. According to the Commission, in some cases, the Financial Monitoring Service promptly provides NABU with information about suspicious transactions or assets potentially linked to corruption offenses. However, the NABU does not disclose statistics on requests or received responses, though it does conduct biannual reconciliations with the State Financial Monitoring Service regarding the processing of materials.

In March 2024, the institutions agreed to establish a working group to enhance cooperation, and in August, the State Financial Monitoring Service asked the NABU to nominate five members. However, as of December 2024, the group had not held a single meeting.

The Commission also noted that, under the NABU Law, the Director is required to report every 6 months on cooperation with other institutions. During the assessment period, however, NABU only reported the number of regulations reviewed. 

With regard to information exchange, the Commission observed several positive aspects. NABU detectives actively communicate with other agencies, send requests, and facilitate investigations. NABU analysts maintain a list of institutions and registries that can be accessed online or via data repositories. The NABU has online access to several registries, including API-based access to NACP declarations, and it has signed agreements with the tax and customs authorities.

At the same time, the NABU does not collect systematic data to evaluate the effectiveness of operational information sharing with other pre-trial investigation bodies. It also does not maintain records of joint operations that have produced positive anti-corruption outcomes.

According to the 2023 Technical Assessment, the NABU still does not have stable and direct access to all necessary databases. There are plans to clarify the term “direct access” in legislation to enable automated and full connectivity to large volumes of data. However, access is sometimes hindered by confidentiality issues and technical problems. For example, customs system updates can result in access disruptions, which NABU learns about informally, forcing the Bureau to issue repeated requests for reinstatement. Banks do not always provide the requested information and, in some cases, outright refuse.

The 2024 OECD review confirmed that the absence of a unified register of bank accounts complicates NABU’s work, as it must submit individual requests to each bank. Out of 67 banks, 5 regularly deny such requests. The NABU has contacted the National Bank of Ukraine to clarify procedures for bank responses and is discussing legislative amendments to expedite access to financial information. 

The Commission also noted NABU’s progress in minimizing the risk of information leaks during interagency cooperation. In August 2024, the NABU Director approved guidelines for detectives on protecting investigative data. Access to state registers is now granted only after user identification, enabling traceability of who accessed what data and when. Special search techniques are used to conceal investigator involvement in active cases. 

The Commission emphasized that the Law on NABU guarantees the agency’s autonomy and exclusive jurisdiction over corruption-related offenses. During the assessment period, auditors did not record any instances of unlawful case transfers. In situations involving interference, the NABU initiates the return of materials; however, legislative gaps limit the effectiveness of this process.

The Commission also noted that the NABU reported cases where other investigative bodies, instead of transferring cases upon request, redirected them to the Prosecutor General’s Office. In one instance, NABU only received the case two years later, after the SAPO Head confirmed jurisdiction. As we previously stated in our Shadow Report, problems in interagency cooperation can lead to delays in case transfers. For example, in February 2024, the National Police failed to promptly transfer materials regarding a Ministry of Defense official. Later, the SAPO prosecutor reassigned jurisdiction, determining that the available evidence was insufficient for a NABU-led investigation.

The Commission also documented instances of duplicate registration of cases under NABU jurisdiction, so-called “clones,” which hinder investigations. Evidence transfers from other agencies are frequently delayed or blocked. According to the Commission, the Criminal Procedure Code of Ukraine lacks clear rules for transferring proceedings and does not impose liability for jurisdictional violations. This leads to delays, jeopardizes the admissibility of evidence, and aligns with our conclusions.

Accordingly, the Commission issued two key recommendations for NABU in this area: 

• Review and, where necessary, update interagency cooperation agreements to define shared objectives and measurable outcomes to improve strategic alignment
• Establish procedures for monitoring and periodically reviewing these agreements, including strengthening coordination at the leadership level, stakeholder reporting, improving dispute resolution mechanisms, and incorporating practical experience.

The Commission also issued two recommendations to the Verkhovna Rada to prevent violations of NABU’s jurisdiction. Specifically, it advised considering amendments to the Criminal Procedure Code to: 

• Define clear rules and deadlines for transferring criminal proceedings between investigative bodies, including in cases where NABU reclaims jurisdiction
• Establish administrative or disciplinary liability for the Prosecutor General’s Office, the State Bureau of Investigation, and other bodies for violations of NABU’s jurisdiction or failure to comply with NABU, SAPO, or prosecutor decisions regarding case transfers.

International cooperation

The Commission concluded that NABU’s international cooperation during the assessment period was sufficiently effective. Overall, NABU has largely achieved its stated objectives.

The Commission evaluated international cooperation across four aspects: 

• Requests for mutual legal assistance (MLA), 
• Responses to incoming MLA requests, 
• Informal international cooperation mechanisms,
• Evidence, suspects, and assets located abroad. 

One of NABU’s notable achievements was the establishment of an international legal assistance department as a dedicated structural unit responsible for preparing outgoing and processing incoming MLA requests. 

Since 2017, the NABU has also cooperated with the Basel Institute on Governance in Switzerland, which advises the Bureau on complex requests to foreign jurisdictions. The NABU maintains representation in the European Judicial Network and regularly participates in its work. 

Detectives and staff receive training that includes components on international cooperation. The NABU also uses the “Guidelines on International Cooperation in Criminal Proceedings” application, which is regularly updated by the relevant department.

The Commission noted that, based on employee surveys, the NABU faces challenges in recovering assets located abroad. Despite the large number of asset seizure orders, the time between seizure and actual confiscation remains excessively long. 

The Commission emphasized that this issue could be mitigated, in part, through legislative amendments. 

At TI Ukraine, we have similarly highlighted problems with enforcing asset confiscation decisions abroad, which may stem from both operational and legal difficulties.

The Commission noted that according to NABU data, the average timeframe for processing incoming MLA requests is 1–2 months. The report mentions the difficulty of executing requests requiring action in temporarily occupied territories or areas with ongoing hostilities.

It is also worth noting that NABU has established and maintained contacts with foreign anti-corruption agencies. Since its inception, the Bureau has signed 37 interagency cooperation agreements with international counterparts. As part of its achievements, the Commission also highlighted NABU’s access to the SIRIUS project via Europol’s expert platform and its use of other international tools.

From NABU’s founding until November 2024, its representatives submitted 1,809 requests for international assistance in evidence gathering, of which 1,418 were fulfilled. The Ministry of Justice also submitted one request for enforcement of a HACC decision on special confiscation, which is still pending. The Commission noted that NABU’s success rate for requests concerning evidence gathering and asset seizure is comparable to, or better than, that of similar agencies in other countries. 

Nonetheless, while the rate of execution for asset seizure requests is high, converting seizures into actual confiscations and returning assets to Ukraine remains a significant challenge. This requires more coordinated efforts by NABU and its partners in implementing court rulings and legislative reforms.

On extraditions, the Prosecutor General’s Office submitted 79 requests on behalf of NABU, of which only 6 were executed. The Commission highlighted not only the low success rate but also substantial delays in processing these requests. Notably, the 2023 Technical Assessment confirmed that the requirement to submit certain requests through the Prosecutor General’s Office complicates international cooperation. 

Further complications arise from concerns raised by foreign countries regarding extradition due to the security situation in Ukraine, which is beyond NABU’s control. 

Regarding joint investigation teams (JITs), NABU has established a total of four JITs. However, the Commission found that inconsistent legislative provisions and a lack of proper regulation impede NABU’s ability to effectively implement this mechanism. In our analysis, we have also emphasized the need to improve these legislative frameworks.

The Commission also noted that NABU should establish formal cooperation with Europol and Eurojust. 

In our Shadow Report on Chapter 23 on Justice and Fundamental Rights, we recommended enhancing the procedural authority of the SAPO Head, including by granting them the right to initiate extradition requests and decisions on the formation of joint investigation teams. Regarding JIT operations, we also highlighted the absence of regulatory provisions and the urgent need for legislative frameworks. Should such amendments be adopted by Parliament, the Commission concluded, the NABU could significantly improve its performance in this area.

Overall, in the field of international cooperation, the Commission recommended that NABU develop training materials and a capacity-building program for detectives to encourage the collection of evidence linking assets to criminal offenses and to increase the number of special confiscation measures.

What was missing from the audit?

Overall, the audit confirmed that NABU is a functioning institution with certain achievements but still requires systemic improvements in management, strategic planning, and legislative frameworks to enhance its effectiveness in combating high-level corruption.

However, in our view, the audit did not sufficiently address the issue of pre-trial investigation timelines, namely, the efficiency of investigations and the speed at which indictments are submitted to court. These factors directly affect the time available for HACC and its Appeals Chamber to consider a case before the statute of limitations expires. 

Our research supports this concern. If we look at the time between the case being brought to court and the release from criminal liability, it can be observed that 55% of such decisions were made between one month and one year. That means there weren’t many opportunities for a trial by the HACC.

The Commission also failed to assess the impact of the ECtHR judgment in Serhiyenko v. Ukraine on the status of NABU’s Internal Control Department. In that case, the ECtHR found violations of both the procedural and substantive aspects of Article 3 of the Convention, after the applicant sustained physical injuries while under the control of NABU staff. The Court ruled that the investigation into allegations of ill-treatment was ineffective, as it was carried out by the same institution (NABU) that had carried out the arrest, violating the requirement of independence. It also concluded that the applicant was subjected to inhuman and degrading treatment, a finding enabled by the government’s failure to refute the applicant’s claims or provide necessary documentation to support its position.

Although the events took place in June 2016, the judgment, issued on 7 November 2024, should undoubtedly have influenced the ICD’s standing and been taken into account by the Evaluation Commission in its findings.

In addition, when analyzing acquittals, the Commission limited itself to assessing whether NABU incorporates lessons learned, without examining the underlying causes of those verdicts. We acknowledge that the investigative errors may have occurred outside the audit period, but evaluating those causes could have strengthened the audit’s conclusions with valuable insights. 

Nonetheless, implementation of the Commission’s 26 recommendations will require joint efforts by both NABU and the Verkhovna Rada. Particularly important are the recommendations concerning the development of a strategic plan, improvement of human resources management, and the resolution of legal gaps. We strongly support the Commission’s attention to issues of asset recovery and information leaks, both of which undermine institutional trust and investigative effectiveness. 

We are confident that implementing these recommendations will enhance NABU’s performance. That is why we will continue to monitor these processes. As our experience tracking the follow-up to the NACP audit has shown, assessed institutions and other executive bodies are not always eager to correct operational deficiencies. Therefore, the implementation of the NABU audit recommendations may also face obstacles in the future.