Cash in bags, offshores and fake IT giants: details of the NABU case against top officials of the State Financial Monitoring Service Pronin and Korolchuk

Cash in bags, offshores and fake IT giants: details of the NABU case against top officials of the State Financial Monitoring Service Pronin and Korolchuk

The State Financial Monitoring Service of Ukraine — the country’s main body tasked with detecting dirty money, combating money laundering, and blocking shadow flows.

However, a high-profile NABU investigation proved that since the beginning of 2025, when the agency was headed by former head of the Poltava Regional Military Administration Filip Pronin and his permanent first deputy Bohdan Korolchuk (both pictured above), the “financial intelligence” itself turned into a high-tech conversion center serving corrupt schemes.

An elite money-laundering infrastructure, fake IT giants, bags stuffed with millions, and a direct link to the embezzlement of the defense budget — the details of this large-scale criminal case were published by Member of Parliament Yaroslav Zheleznyak based on official rulings of the High Anti-Corruption Court.

How money for fortifications led to bags in Kyiv

This detective story unfolded on October 21 last year. NABU detectives and SAPO prosecutors carried out searches in one of the premises in Kyiv on Moldovska Street. The investigative actions were conducted as part of a criminal proceeding regarding the large-scale embezzlement of budget funds allocated for the construction of fortifications in Donetsk region.

During the search, operatives found bags whose contents shocked even experienced detectives. Next to the personal documents of the First Deputy Head of the State Financial Monitoring Service, Bohdan Korolchuk, and his family, there were:

- 278,050 US dollars in cash;

- 3.343 million hryvnias in cash;

- a huge array of statutory documents, seals, and powers of attorney for fictitious companies.

These funds and companies, of course, were not listed in any official declaration of the top official. Korolchuk tried to justify himself with the classic phrase that the money was allegedly “just given to him for safekeeping,” but the seized documents revealed a much deeper syndicate.

Anatomy of the scheme — fake Luxoft, Ciklum, and an offshore chain

Filip Pronin

Detectives found in the bags complete sets of documents for 11 Ukrainian legal entities, 12 individual entrepreneurs (IEs), and 7 foreign companies registered in classic offshore and European jurisdictions — in Cyprus, the Czech Republic (Prague), Hungary, and the British Virgin Islands (BVI).

An analysis of bank statements conducted by NABU established that this network operated continuously from January 1, 2024, to January 21, 2026. The scheme worked according to a clearly tuned algorithm:

1. Multi-million sums from various business entities (including contractors plundering the defense budget on fortifications) were transferred to the accounts of controlled shell companies.

2. The official purpose of the payments was indicated as fictitious services: “provision of security services,” “consultations,” “supply of goods,” and “software development.”

3. To prevent transactions worth hundreds of thousands of dollars for “software development” from raising suspicions among bank compliance officers, the organizers resorted to a cynical trick. They created twin companies whose names copied world-famous IT giants. In particular, the case materials mention LLC “Ciklum Softver” and LLC “Luksoft Ukraina.” They have no connection to the real Ciklum or Luxoft brands and were created solely to disguise dirty money as legitimate IT exports.

4. After accumulation in the accounts, the hryvnia mass was converted into dollars and euros through currency transactions and transferred abroad to the accounts of non-resident shell companies, completely bypassing the strict currency restrictions of the National Bank of Ukraine.

Poltava background and overpayments for “dragon’s teeth”

To understand how this shadow circuit emerged, it is worth returning to the previous place of work of the current heads of the State Financial Monitoring Service. Before their appointment to the Kyiv offices of financial intelligence at the beginning of 2025, Filip Pronin headed the Poltava Regional Military Administration, and Bohdan Korolchuk worked as his first deputy and signed key financial documents.

NABU clearly traced the connection between the seized conversion center and the Poltava period of Pronin’s team. The companies that funneled millions into Korolchuk’s accounts turned out to be the same shell companies that appeared in the investigation into the construction of defensive structures.

A striking example is the procurement of concrete barrier pyramids (“dragon’s teeth”):

- The general contractor Construction purchased materials not directly from manufacturers, but through the shell company “Premium Aktiv.”

- The shell sold the state more than 13,500 pyramids at a price of 2,161 hryvnias per unit.

- A year later, the same “Premium Aktiv” officially bought the same pyramids four times cheaper — only 541 hryvnias per unit.

In this way, the Poltava Regional Military Administration overpaid more than 22 million hryvnias from the budget on just one fortification element. Another 21 million hryvnias were written off for fictitious delivery of these structures: drivers of the transport companies stated during NABU interrogations that they had never carried out these trips and knew nothing about them.

A similar scheme with three- to fivefold price inflation and fictitious volumes also operated in the procurement of timber for dugouts, where the amount of fictitious supplies totaled 8 million hryvnias. This money stolen from the defense lines later flowed into Korolchuk’s bags in the capital.

High-level patronage: could the deputies have acted independently?

The scale of operations, the duration of the scheme (over two years), and the involvement of international offshore jurisdictions indicate that under the roof of the State Financial Monitoring Service, not just an office-based scam was operating, but a powerful systemic syndicate.

Yaroslav Zheleznyak emphasizes an important political aspect: the heads of the State Financial Monitoring Service, Pronin and Korolchuk, enjoy serious protection at the highest levels of power. The head of the Poltava Regional Military Administration was at one time actively promoted by his classmate — the profile Deputy Prime Minister for Reconstruction, while the overall political cover for the system was provided directly by the leadership of the Office of the President under the supervision of Yermak.

Therefore, the question of whether two officials could independently, without the approval of higher curators, organize an international offshore chain for withdrawing capital from a warring country in circumvention of NBU restrictions remains rhetorical.

Instead of fighting money laundering, the top officials of the State Financial Monitoring Service built a perfect shelter for the legalization of dirty cash right inside the state control system. NABU currently possesses the full array of payment documents, seals, and transaction statements. Thus, detentions and asset seizures are only the first stage. Ahead lies a serious test for Ukrainian society: whether the anti-corruption system will dare to bring the case of the “eternal leaders” to real prison sentences, or whether the case will be hushed up through high-level connections.