What powers does the New York Attorney General have in a business investigation?

This page explains New York law on the investigative and enforcement powers of the New York State Attorney General over businesses, and how companies respond. KOR Law LLP's regulatory and enforcement practice represents companies and individuals in state regulatory matters and government investigations, including responses to subpoenas and informal inquiries. For the general first-week checklist that applies to any agency, see what a company should do in the first week after a government subpoena.

Where do the Attorney General's powers come from?

Three statutes do most of the work:

• Executive Law 63(12). When a person engages "in repeated fraudulent or illegal acts or otherwise demonstrate[s] persistent fraud or illegality in the carrying on, conducting or transaction of business," the Attorney General may apply to the Supreme Court, on five days' notice, for an order enjoining the conduct and "directing restitution and damages." The statute defines fraud broadly, to include "any device, scheme or artifice to defraud and any deception, misrepresentation, concealment, suppression, false pretense, false promise or unconscionable contractual provisions," and defines "repeated" to include conduct affecting more than one person. To support an application, the Attorney General "is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules."
• The Martin Act (GBL Article 23-A). In securities and commodities matters, the Attorney General may require sworn written statements and may "subpoena witnesses, compel their attendance, examine them under oath" and require production of books and papers (GBL 352(1), (2)). It may sue to enjoin fraudulent practices and seek restitution (GBL 353), and certain fraudulent practices are crimes (GBL 352-c).
• GBL 349. The Attorney General may sue to enjoin "unfair, deceptive, or abusive" acts and practices in business in New York and obtain restitution, with preliminary relief available (GBL 349(b)). Before suing, the Attorney General must generally give the target notice by certified mail and ten calendar days to show in writing why an action should not be brought, unless preliminary relief is sought and notice is not in the public interest (GBL 349(c)).

What makes the Martin Act different?

In People v Credit Suisse (2018), the Court of Appeals explained that the Martin Act "expands upon, rather than codifies, the common law of fraud." It reaffirmed that the Attorney General need not prove scienter or intentional fraud in a Martin Act enforcement proceeding, and noted the statute "dispenses ... with any requirement that the Attorney General prove scienter or justifiable reliance on the part of investors." For that reason, the court held that Martin Act claims carry the three-year limitations period for liabilities created by statute (CPLR 214(2)), rather than six years. For Executive Law 63(12), the court held that courts "look through" the claim and apply the limitations period of the underlying liability. Private parties cannot sue under the Martin Act, the court noted, though common-law fraud claims remain available; their elements are covered in what you have to prove to win a fraud claim in a New York business case.

How does an investigation usually unfold, step by step?

1. Contact. A letter request or a subpoena for documents or testimony arrives.
2. Preservation. The company issues a legal hold and secures records.
3. Negotiation of scope. For a subpoena not returnable in court, the recipient first asks the issuer to withdraw or modify it (CPLR 2304).
4. Production and testimony. Documents are produced, and witnesses may be examined under oath (GBL 352(2)). In Martin Act inquiries, refusing without reasonable cause to obey a subpoena, be sworn or answer is a misdemeanor (GBL 352(4)).
5. Pre-suit notice. Under GBL 349(c), the target generally receives notice and ten days to respond in writing before suit.
6. Resolution or suit. Many matters resolve by agreement; otherwise the Attorney General sues in Supreme Court under 63(12), 349 or 353.

Can a company push back on a subpoena?

Yes, within limits. CPLR 2304 says that if a subpoena is not returnable in a court, "a request to withdraw or modify the subpoena shall first be made to the person who issued it and a motion to quash, fix conditions or modify may thereafter be made in the supreme court," and reasonable conditions may be imposed. On the other side, if a person fails to comply with a non-judicial subpoena, the issuer may move in Supreme Court to compel compliance, and the court can order compliance, impose costs and penalties, and issue a warrant to bring a witness in (CPLR 2308(b)). The practical path is to negotiate scope first and litigate only where necessary.

What changes the answer?

• The subject. Securities and commodities trigger the Martin Act (GBL 352); other business conduct falls under 63(12) and 349.
• Repetition. 63(12) requires repeated or persistent conduct, which includes conduct affecting more than one person.
• Intent. The Martin Act does not require proof of scienter (People v Credit Suisse).
• Timing. Martin Act claims have three years (CPLR 214(2)); 63(12) claims follow the underlying liability (People v Credit Suisse).
• Preliminary relief. The Attorney General may seek it and skip pre-suit notice where notice is not in the public interest (GBL 349(b), (c)).
• Federal parallels. Consumer practices can also draw FTC attention, covered in what the deadlines are for an FTC civil investigative demand. Securities matters may run alongside an SEC inquiry; see what an SEC Wells notice is.
• Industry regulators. Broker-dealers may also receive FINRA requests at the same time; see what a FINRA Rule 8210 request is.

For example: a subscription business and an Attorney General letter

Common mistakes

• Treating a letter request as optional. Subpoena power stands behind it (Executive Law 63(12); GBL 352).
• Moving to quash first. CPLR 2304 requires asking the issuer first for non-judicial subpoenas.
• Ignoring the 10-day notice. It is the last formal chance to respond before suit (GBL 349(c)).
• Assuming intent is required. Not under the Martin Act (People v Credit Suisse).
• Discussing the investigation loosely. In Martin Act matters, unauthorized disclosure by witnesses of information obtained in the inquiry can be a misdemeanor (GBL 352(5)).
• Forgetting preservation. Records must be secured from the first contact; see how to run an internal investigation without losing privilege.

What to do this week

1. Issue a legal hold and suspend deletion.
2. Identify which statute the request cites and what conduct it targets.
3. Call the Assistant Attorney General to confirm deadlines and discuss scope.
4. Map documents and custodians, and plan a privilege review.
5. Prepare witnesses who may be examined under oath.
6. Brief the board or owners in a privileged setting.

Frequently asked questions

Can the Attorney General recover money for customers?

Yes. Executive Law 63(12) authorizes orders directing restitution and damages, GBL 353(3) allows restitution for Martin Act fraudulent practices, and GBL 349(b) allows restitution for unfair, deceptive or abusive practices.

Does the Attorney General have to go to court to get documents?

No. The Attorney General can issue subpoenas without first suing (Executive Law 63(12); GBL 352(2)), and goes to court only to compel compliance if needed (CPLR 2308(b)).

How long does the Attorney General have to sue?

For Martin Act claims, three years under CPLR 214(2); for 63(12) claims, the period of the underlying liability (People v Credit Suisse). Limitations for private business claims are covered in how long you have to sue for breach of contract, fraud, or a sale of goods in New York.

Can customers sue too?

Individuals injured by deceptive practices have their own claim under GBL 349(h), but private parties cannot sue under the Martin Act (People v Credit Suisse).

Can investigations involve criminal charges?

Yes. Certain Martin Act violations are crimes (GBL 352-c), and the Attorney General may prosecute perjury committed during an investigation (Executive Law 63(13)).