What should a company do in the first week after a government subpoena?

This page explains federal law and New York law on what a company should do when it first receives a subpoena, civil investigative demand or similar request from a government agency or regulator. KOR Law LLP's regulatory and enforcement practice represents companies and individuals in federal and state investigations, including responses to subpoenas and informal inquiries, and in internal investigations. The steps below apply to most agencies; specific deadlines vary by agency and are covered on the linked pages.

Why does preservation come first?

Because the criminal exposure for getting it wrong can exceed the exposure in the investigation itself. Federal law punishes anyone who "knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation" of any federal agency matter, "or in relation to or contemplation of any such matter," with up to 20 years in prison (18 U.S.C. 1519). Separate obstruction provisions cover concealing or destroying material subject to certain civil investigative demands and corruptly impeding agency proceedings, with penalties up to five years (18 U.S.C. 1505).

Preservation means suspending routine deletion, telling the employees who hold relevant material not to destroy it, and securing devices and accounts, including personal phones and messaging apps used for business. It is also the foundation of any later privilege or cooperation strategy, discussed in how to run an internal investigation without losing attorney-client privilege.

What should happen in the first week, step by step?

1. Day 1: issue a legal hold. Written instructions to custodians and IT, covering email, chat, texts, shared drives and backups.
2. Day 1: identify the issuer and the authority. Read the subpoena or demand and any cover letter. An FTC demand must be accompanied by notice of the investigation's purpose and scope, and a Commission resolution suffices (16 CFR 2.6). In an SEC formal investigation, a person compelled or requested to testify or produce documents may ask to see the formal order of investigation (17 CFR 203.7(a)).
3. Days 1 to 2: calendar every deadline. The return date, any objection deadline, and any required meeting. For example, an FTC recipient must meet and confer with staff within 14 days after receipt or before the deadline to petition to quash, whichever is first (16 CFR 2.7(k)), and a petition to limit or quash is due within 20 days after service (16 CFR 2.10(a)(1)).
4. Days 2 to 3: engage counsel and make contact. Counsel introduces themselves to the staff, confirms deadlines, and opens discussion of scope and rolling production.
5. Days 3 to 5: map the data. Who has the documents, where they live, and in what form. Agencies often specify formats; the FTC requires electronically stored information to be produced in the form its staff instructs (16 CFR 2.7(j)).
6. Days 5 to 7: decide on objections and privilege handling. Identify privileged material and plan the privilege log the agency will require.
7. Throughout: control communications. One point of contact; no informal calls with agency staff by employees; board briefings in privileged settings.

Who might be on the other end?

The agency shapes everything else. The Federal Trade Commission uses civil investigative demands for consumer protection investigations, with the deadlines covered in what the deadlines are for an FTC civil investigative demand. The SEC begins with preliminary inquiries in which "no process is issued or testimony compelled," and can then open a formal investigation with subpoenas (17 CFR 202.5(a)); the end-stage process is in what an SEC Wells notice is and how to respond. In New York, the Attorney General can subpoena witnesses and documents in fraud and securities investigations (Executive Law 63(12); GBL 352(2)), explained in what powers the New York Attorney General has in a business investigation. Brokerage firms and their people also answer to FINRA; see what a FINRA Rule 8210 request is.

Some agencies pursue specialized programs. Appliance and equipment manufacturers, for example, may face Department of Energy certification and testing demands, described in what happens when the Department of Energy brings an appliance efficiency enforcement case.

How are privileged documents handled?

A company does not have to hand over attorney-client communications or attorney work product, but it must claim the protection properly and on time. The FTC's rule is a good example of how demanding agencies can be: anyone withholding responsive material must assert the claim no later than the production date, with a detailed log attested by the supervising attorney that lists, for each item, its date, authors and recipients with their affiliations, a description, and the factual basis for the claim, marking every attorney with an asterisk (16 CFR 2.11(a)). Failing to log properly is treated as noncompliance subject to judicial enforcement (2.11(b)), and material not protected must be produced without redaction (2.11(c)).

Mistakes can sometimes be fixed. If privileged material is produced by accident, the FTC rule protects it where the disclosure was inadvertent, reasonable steps were taken to prevent it, and the holder promptly took steps to fix the error, including notifying the staff (2.11(d)). Building the review and logging process in the first week makes those protections easier to keep.

What changes the answer?

• Whether you are a target, subject or witness. It shapes how much to say and whether individuals need their own counsel.
• Civil or criminal exposure. The SEC may refer willful violations to the Department of Justice (17 CFR 202.5(b)), and settlements with the SEC do not resolve criminal charges (202.5(f)).
• The objection clock. FTC objections are lost if not raised by petition in time (16 CFR 2.10(a)(1)); in New York, a motion to quash must be made promptly (CPLR 2304).
• Privilege. Agencies require detailed logs of withheld material; the FTC's rule lists the required fields (16 CFR 2.11).
• Industry regulators. FINRA members face suspension for failing to respond (FINRA Rules 8210, 9552).
• Parallel private litigation. Documents produced to an agency may later be sought by private plaintiffs.

For example: a consumer products company served with an FTC demand

Common mistakes

• Letting auto-delete run. Routine deletion after a subpoena can look like obstruction (18 U.S.C. 1519).
• Missing the objection window. Some agencies treat late objections as waived (16 CFR 2.10(a)(1)).
• Talking informally to the agency. Employees should not field staff calls on their own.
• Over-collecting privileged material without a plan. Log requirements are detailed (16 CFR 2.11).
• Ignoring individuals' interests. Officers may need separate counsel.
• Assuming a civil inquiry is only civil. Criminal referral is possible (17 CFR 202.5(b)).

What to do this week

1. Issue a written legal hold and suspend deletion policies.
2. Copy the subpoena, cover letter and envelope; record the date and manner of receipt.
3. List every deadline, including any meet-and-confer and objection dates.
4. Identify custodians, systems and devices.
5. Brief the board or owners in a privileged setting.
6. Retain counsel to contact the agency and negotiate scope.

Frequently asked questions

Is a subpoena an accusation of wrongdoing?

Not necessarily. Agencies gather facts to decide whether a violation may have occurred; at the SEC, for example, investigations are non-public unless the Commission orders otherwise (17 CFR 202.5(a)). Equally, the SEC's rule warns that word that an investigation has ended "must in no way be construed as indicating that the party has been exonerated" (202.5(d)).

Can we negotiate the scope?

Usually. Agencies routinely discuss scope, timing and format, and the FTC requires a meet and confer for that purpose (16 CFR 2.7(k)).

Can we challenge a New York Attorney General subpoena?

For a subpoena not returnable in court, the recipient first asks the issuer to withdraw or modify it and may then move to quash in Supreme Court (CPLR 2304).

Do employees have to talk to investigators?

It depends on whether they are compelled. In SEC formal proceedings, witnesses may be accompanied and advised by counsel (17 CFR 203.7(b)).

What if the investigation leads to a lawsuit?

Agencies may sue in federal or state court, and private plaintiffs may follow. Forum issues are discussed in federal court or state court for a New York business dispute.