When the paper trail is rewritten: what the Deloitte Cyprus reporting means for recovery work

October 13, 2026

This week the BBC, The Guardian and The Bureau of Investigative Journalism published reporting, based on leaked files, about how companies linked to Roman Abramovich were run from Cyprus. The work builds on the Cyprus Confidential investigation led by OCCRP with partners, including the Cyprus Investigative Reporting Network.

According to TBIJ, its forensic analysis found more than 1,000 corporate records that had been given a false earlier date, sometimes by as much as five years, between 1999 and 2013. The reporting says staff at Deloitte Cyprus, and later at MeritServus, the firm spun out of it, were involved.

The BBC reports one example from 2006. After a new Cyprus law required company accounts to be made public, documents were allegedly backdated by three years to make it look as if assets had moved to a British Virgin Islands parent company in 2003. The BBC says assets worth $672m, including superyachts, homes and private jets, disappeared from the Cypriot company's accounts as a result. OCCRP and CIReN report that the related financial statements were not filed until 2016.

The Guardian reports that lawyers for Mr Abramovich denied any wrongdoing and said he relied on the advice of his advisers and Deloitte Cyprus. Deloitte Cyprus said it "acts in compliance with all applicable laws" and that, because of the time that has passed, it could no longer access the relevant material. These are allegations drawn from leaked records, and they should be read that way.

If you are a liquidator, receiver, asset-tracing lawyer or forensic accountant, the method described will be familiar, even if the scale is not. A transfer that happened late is papered as if it happened early. A board minute appears that nobody remembers. A trust deed turns up dated years before anyone had reason to write it.

Backdating only works when nobody can prove what a document looked like, or when it existed. That is the gap. In disclosure you are often handed a neat file and asked to accept it. Testing it takes time and money: metadata reviews, expert reports, witness evidence and argument in court. It took leaked emails and a forensic review for these journalists to show what they say happened. Most recovery teams do not have a leak to work from.

This is the problem we built Partisan to solve. When a document is created, Partisan records a private fingerprint of it and a signed timestamp. The fingerprint is a short code worked out from the file itself. It reveals nothing about what the document says, and the contents are never shared with us or anyone else.

Later, anyone holding the document can check it against that record. If the file is the same, it matches. If a single character has changed, or someone claims it existed before it really did, the check fails straight away.

We tested this on a live system. A genuine file was confirmed. A copy with one figure changed, from 1,250.00 to 1,251.00, was rejected.

For your work, that means three things:

  1. Faster disclosure reviews. Documents that carry a record can be checked in minutes, so you can focus on those that do not.

  2. Stronger evidence. A signed timestamp gives you an independent answer to "when did this exist?", rather than relying on the word of the person who produced it.

  3. Earlier warning signs. When a party cannot show a record for a key document, that tells you where to look.

None of this replaces your judgment or your experts. It gives them firmer ground to stand on.

I wrote about the reporting on LinkedIn earlier this week. If you work on recovery or disclosure and would like to see how a check works on a real file, I would be glad to show you in a 15 minute demo. Email me at contact@charlespycraft.co.uk.

Charles Pycraft, co-founder of Partisan