Ukraine is again on the front pages of the global media for the second month now. Geopolitical tensions, which were caused by the increasing number of Russian troops near Ukrainian borders, have clearly rattled the nerves of investors and businesses operating in Ukraine and with Ukrainian partners. It is uncertain if hostilities will actually break out, but it is always prudent to have a contingency plan for continuing your business in Ukraine and with exposure to Ukraine risks. At the very least, it is prudent to minimise the risks to the maximum possible extent. 

The unprecedented security situation and relevant tensions pose an enormous threat to Ukraine and its security, which, as a result, is already causing serious economic consequences. CMS is constantly monitoring the current situation in Ukraine, which changes every day based on the declarations made by various parties. While we hope that this unprecedented security crisis will soon be resolved, it is advisable to assess the various scenarios, even the worst one. This note outlines the potential legal risks that might arise in the near future, and makes suggestions for your contingency plan.

What you can expect

According to various media reports, essentially based on US, UK and German intelligence, the Russian Federation is plotting a full-scale invasion in Ukraine. While this publication will not dwell on the reasons or historical background, it would be useful to outline the anticipated scenarios.

Full invasion

This scenario contemplates an invasion of the entire geographic territory of Ukraine. However, it is unlikely that this will be feasible given the size of the country and Ukraine’s defence capabilities. We note that Ukraine gave up its nuclear weapons in 1994 in exchange for security guarantees from the signatories of the Budapest Memorandum (including Russia, the United States and Germany).

Regional invasion

While a full-scale Russian invasion is unlikely, a more realistic scenario is that Russia will try effect previous plans to connect eastern Ukraine, which it already controls, with the Crimea or possibly Transnistria. Essentially, the Southern regions of Ukraine then would be under threat.

Hybrid scenario

Perhaps Russia fully appreciates the potential costs of military action and will use new types of warfare instead. In this scenario, Russia will not implement its military threat directly. Instead, it may deploy various hybrid-war tools. For example, these might include a mix of the following: cyber-attacks, use of puppet militants in the Donbas Region to further destabilise the situation these, economic pressure via reducing the supply of natural gas, as well as blockages in the Black Sea and Azov Sea, to name a few.

Regardless of the actual scenario, there are several risks that Ukrainian businesses–and even businesses that do not have presence in Ukraine–face. We list some of these risks below, but the list is not exhaustive.

Risks that you may face

Martial law

The primary and the most significant risk for businesses in the event of a Russian invasion is the adoption of martial law, either in the entire country or a specific part of it for a set period. Martial law was temporarily introduced in 2018 when there was a military escalation in the eastern part of Ukraine.

Martial law needs to be adopted by the President of Ukraine on recommendations by the National Security and Defence Council of Ukraine, and approved by the Ukrainian parliament (Verkhovna Rada of Ukraine).

Once introduced, it creates a further legal ground for the state authorities and military command to take measures to protect and defend Ukraine’s interests. These measures can include:

  • compulsory labour for able-bodied persons;
  • use of businesses’ capacity and labour resources; and
  • forcible alienation of private property in favour of the state, although in the event of such alienation, the value of the private property must be compensated by the state, once martial law ends.

Although we hope that these measures will not be introduced, it is still preferable to take them into account regarding your business operations.

Tighter currency controls

Another potential risk is the devaluation of the Ukrainian Hryvnia. As evidenced by many cases around the world, once a military invasion happens, the national currency devalues rapidly.

Devaluation will in turn cause further active involvement from the National Bank of Ukraine (the “NBU”) to stabilise the currency. As witnessed during 2014–2016, the NBU was willing to introduce various currency control restrictions. These restrictive measures can include the following: (i) limitation on foreign currency purchases; (ii) prohibition on prepayment or early repayment of cross-border loans; (iii) reduction in the settlement period for export-import transactions; and (iv) prohibition on the repatriation of dividends abroad.

Cybersecurity

In the event of a military invasion, businesses may face additional cybersecurity risks, including disruption to their systems and operations, critical assets, and sensitive information loss.

The current crisis between Ukraine and Russia has already been connected with a series of cyberattacks on Ukrainian targets. The Ukrainian government has recently reported the largest attack of its type on two banks and the defence ministry. Experts believe that cyberattacks will continue as part of any hybrid war and to increase pressure on Ukraine.

If military action escalates, it will likely include offensive cyber operations by Russia’s military intelligence and specifically engaged hacker groups. The key targets are governmental institutions and critical infrastructure in Ukraine. However, we cannot exclude that the attacks could become more extensive, hitting all types of organisations and companies. Apart from Russia, other cybercriminals may attempt to take advantage of the situation by increasing their hacking activities. Many businesses in Ukraine still remember the global malware attack known as Petya/NotPetya that, in 2016–2017, caused disruption to the operations of many companies in Ukraine, reportedly costing hundreds of millions of dollars.

Disruption of state authorities, banks, etc

Some reports have indicated that Russia intends to encircle Kyiv, Ukraine’s capital, and install a puppet government. While all the state authorities and the key organisations (including banks) are in Kyiv, if the capital becomes the epicentre of military action the authorities and organisations will probably not be able to function. In this case, companies would not be able to obtain the necessary approvals or licences to continue their business in Ukraine, and might not even be able simply to make a money transfer through a local bank office.

Contractual liability

Force majeure

Active military operations in Ukraine could make the fulfilment of contract obligations practically impossible.

Under Ukrainian law, parties may regulate what they consider to be force majeure events (e.g. Russian military invasion to Ukraine). At the same time, although parties are free to regulate force majeure clauses as they wish, such clauses should still comply with the fundamental principles of Ukrainian contract law, such as fairness, diligence, and reasonableness, and should not constitute an abuse of rights.

Moreover, force majeure cannot be invoked where the performance of the obligation becomes cumbersome but is objectively possible—it can only be invoked where the performance of the obligation became objectively impossible.

In the case of a force majeure event, a person can be relieved from liability if they can prove all of the following three elements: (i) an event of force majeure (e.g., a Russian military invasion); (ii) inability to perform under the contract or obligation arising from the law; and (iii) a direct causal link between (i) and (ii).

You can also find more detailed information on the regulation of force majeure in Ukraine in the CMS Expert Guide at this link: Force majeure - law and regulation in Ukraine | CMS Expert Guides.

Sanctions

The United States and leaders of many other countries have already threatened to impose sanctions against Russia in the event of an invasion. If a new sanctions regime is implemented, it is likely to be targeted at Russian foreign business projects, politicians, companies, and may also cover related partners. Additional sanctions may also be imposed by the Ukrainian government. The businesses in Ukraine and abroad should therefore be mindful to ensure that they are not directly or indirectly dealing with sanctioned entities or projects, and should proactively monitor any developments regarding sanctions that could be imposed.

Insurance

Some international insurance companies have announced that they have stopped insuring aircraft on flights over Ukraine due to the high risk of war. While Ukraine has not closed its airspace and local airports are operating as usual, there are a few instances of flight cancellations and grounding outside Ukraine. At the same time, it has been reported that the Ministry of Infrastructure of Ukraine and international insurers have reached an agreement to provide the necessary guarantees for insurance and leasing companies.

Steps to be taken immediately

Given the current dynamic situation, the prudent approach is to have a plan in case any of the scenarios listed or potentially omitted in this publication actually happen. At the same time, the following is a list that you may need or want to include into your contingency plan.

  1. Have you carried out a stress test, covering business process vulnerability, possible cybersecurity weakness, and supplies of key products?
  2. Do you know where your key company and title documents, and licences and permits are stored or located? It is recommended to approach state authorities in advance to collect and obtain all pending documents, those confirming ownership rights to assets and those required for ongoing business operations.
  3. Have your in-house lawyers already reviewed your existing (especially long term) contracts? It may be sensible to review and check whether they contain provisions regulating a force majeure event. If you have insurance in place, it is worth checking the coverage for war and similar risks.
  4. If your personnel have already moved out of Ukraine because of security concerns, it would be advisable to check the tax implications of such relocation and whether licensing conditions (if your business is subject to licensing) allows your services to be provided from abroad.
  5. Have you already protected your company’s critical data and backed up the rest? It is recommended to regularly back up the data, at least the data that critical to your business operations, and to store it offsite or in the cloud. It is also recommended to ensure the proper cyber security tools and services are being used by the company. Employees should also be trained on basic cybersecurity best practices.