1. How Doj, Sec, Ftc, and Oig Regulatory Investigations Differ in the First Respons
The agency that contacts the company determines the immediate legal obligations, the available procedural tools, and the likely resolution path. Each agency investigates differently, and the first response must be calibrated to which one is calling.
A DOJ criminal investigation typically surfaces through a grand jury subpoena for documents, a target or subject letter, or federal agents appearing at company offices for voluntary interviews. The criminal standard, the potential for individual indictments, and the threat of obstruction charges under 18 U.S.C. § 1512 make the DOJ criminal investigation the highest-stakes regulatory contact a company can receive. An SEC investigation surfaces through a formal order of investigation, staff subpoenas for documents and testimony, or a request for a voluntary interview with enforcement staff. The SEC can seek injunctive relief, disgorgement, civil penalties, and officer-and-director bars, and its enforcement actions run parallel to any DOJ criminal investigation of the same conduct. An FTC civil investigative demand signals a civil enforcement investigation into competition, consumer protection, or privacy violations; HHS OIG administrative subpoenas and payment audits signal a healthcare fraud investigation that can lead to exclusion from federal healthcare programs, civil monetary penalties under the False Claims Act, and criminal referral to DOJ.
The CFPB's investigative authority under the Consumer Financial Protection Act allows it to issue civil investigative demands to any covered person or service provider, demand production of documents, and require written reports and answers to interrogatories without filing any formal proceeding first. A company that receives a CFPB CID is facing a civil regulatory investigation with administrative enforcement authority that does not require a court to impose relief. Each of these contacts requires a different first response: criminal contacts require immediate privilege analysis, individual counsel assessment, and litigation hold; civil agency contacts require the same litigation hold and privilege protection but carry less immediate individual criminal exposure.
Target Letters, Subject Letters, and Witness Letters in Doj Investigations
Federal prosecutors send three categories of letters to individuals whose testimony or records are sought in criminal investigations, and the category is the first strategic data point that determines whether an employee needs separate counsel before any other decision is made.
A target letter notifies the recipient that they are a target of a grand jury investigation, meaning the government has substantial evidence linking them to a crime and is actively considering indictment. A subject letter notifies the recipient that their conduct is within the scope of the investigation without yet reaching the target threshold. A witness letter indicates that the government believes the person has relevant information but is not currently under investigation. These categories change as the investigation develops: witnesses become subjects and subjects become targets as the government builds its evidence.
Company counsel represents the organization. When an investigation creates potential individual criminal exposure, those individuals need separate counsel before any testimony, document production, or investigator interview. Allowing employees to assume that company counsel also represents their individual interests in a criminal investigation is one of the most common early failures in investigation management, and it can result in waiver of the individual's own Fifth Amendment rights or disclosure of information that harms the individual without benefiting the company.
2. What the Company Must Do When a Regulatory Investigation Starts
The litigation hold is the first action. It has no exceptions for inconvenience, pending internal review, or uncertainty about whether the matter is serious.
A litigation hold is a directive to every employee, IT system, and third-party custodian to suspend all document destruction routines, retain all communications and records that might be relevant to the investigation, and report any documents that may have been destroyed since the investigation began. The hold must be issued the moment the company receives any government contact suggesting potential litigation or investigation: a subpoena, an informal document request, a witness interview request, or a media inquiry indicating that a government investigation is underway. Under 18 U.S.C. § 1519, altering, destroying, or concealing records with the intent to obstruct a federal investigation carries up to 20 years imprisonment regardless of whether the underlying investigation produces charges.
The decision whether to conduct a parallel internal investigation is one of the most consequential early choices in any regulatory matter. An internal investigation conducted by outside counsel, under attorney-client privilege and work product protection, allows the company to understand what happened before the government does, to identify whose conduct is at issue, to make informed decisions about cooperation and voluntary disclosure, and to take remediation steps that demonstrate good faith. The first analysis should focus on what the subpoena or CID reveals about the government's theory before the company decides whether to cooperate, contest, or conduct a full internal investigation. Grand jury investigations and internal investigation services require structuring that parallel process in a way that serves the company's interests without creating additional obstruction risk.
How Internal Investigations Interact with Government Investigations and Where Privilege Holds
Attorney-client privilege protects communications between lawyers and corporate employees made for the purpose of obtaining legal advice. It does not protect every document created by or shared with lawyers during an investigation.
Upjohn established that the corporate attorney-client privilege extends to communications between corporate counsel and non-senior employees when those communications are made in connection with providing legal advice to the organization. An outside counsel who conducts internal investigation interviews of employees to understand what happened and provide legal advice to the company creates privileged communications that cannot be compelled by the government unless the company waives privilege. Waiver occurs when privileged communications are voluntarily disclosed to the government as part of a cooperation strategy, and that decision is among the most significant the company will make during the investigation.
Work product protection under FRCP Rule 26(b)(3) provides separate protection for documents prepared in anticipation of litigation, including attorney notes, interview memoranda, and analytical documents prepared during the internal investigation. The government frequently requests the factual results of an internal investigation, which the company may provide while asserting privilege over counsel's legal analysis and mental impressions. Managing both doctrines together, from the first day of the investigation, determines how much of the internal investigation record the company must eventually share.
| Agency | Primary Investigation Mechanism | Typical Trigger | Common Resolution |
|---|---|---|---|
| DOJ Criminal | Grand jury subpoena, search warrant, target letter | Whistleblower, tip, parallel civil referral | DPA, NPA, guilty plea, declination |
| SEC | Formal order of investigation, testimony subpoena | Whistleblower, suspicious trading, restatement | Administrative order, civil injunction, disgorgement |
| FTC / DOJ Civil | Civil investigative demand | Competitor complaint, audit, consumer complaint | Consent decree, civil penalty, injunction |
| HHS OIG / DOJ | Administrative subpoena, qui tam complaint | Medicare billing anomaly, False Claims Act relator | Corporate integrity agreement, exclusion, settlement |
False Claims Act qui tam investigations under 31 U.S.C. § 3730 are among the most consequential regulatory investigations a healthcare company, defense contractor, or government program participant can face, because they originate with a private relator who has already provided the government with detailed inside information before the company knows an investigation exists. The government investigates the qui tam complaint under seal for up to 60 days, with extensions routinely granted, while the company continues normal operations unaware that a former employee has already provided documents, witness names, and a detailed narrative of the alleged fraud. By the time the seal is lifted, the government may have conducted months of investigation and determined whether to intervene. False Claims Act defense requires responding to a complaint that has a significant informational head start.
3. How Cooperation Credit Works in Regulatory Investigations and What Agencies Measure
Cooperation is not a vague gesture of goodwill toward prosecutors. It is a specific set of behaviors that DOJ and SEC evaluate against published criteria to determine sentence recommendations, penalty reductions, and resolution type.
The DOJ's USAM § 9-28.000 framework lists the factors prosecutors weigh when deciding whether to charge a corporation, including the pervasiveness of the wrongdoing, the corporation's history of misconduct, the existence and effectiveness of a prior compliance program, and the timely and voluntary disclosure of wrongdoing paired with genuine cooperation in the subsequent investigation. A company that identifies a problem, stops it, reports it to the government before being caught, and cooperates fully is positioned for a deferred prosecution agreement or non-prosecution agreement. A company that waited to be caught has none of those advantages, and the penalty and resolution difference between the two positions is frequently measured in tens of millions of dollars and the presence or absence of a criminal conviction.
SEC cooperation credit operates through a published framework awarding credit for self-policing before the SEC investigation begins, self-reporting promptly when an issue is identified, remediating the harm, and cooperating with the investigation. The SEC has publicly announced declinations for companies that self-reported, cooperated fully, and remediated effectively, and those announcements exist to signal the value of early cooperation. Companies evaluating whether to self-report must weigh the benefits of cooperation credit against the certain exposure that comes with disclosure. That calculation requires understanding both the strength of the evidence the government might independently develop and the resolution options available with full cooperation versus minimum legal compliance. SEC enforcement and securities and commodities enforcement matters require that analysis before a disclosure decision is made.
How Parallel Criminal and Civil Proceedings Create Simultaneous Exposure
The same underlying conduct can produce a criminal DOJ investigation and a parallel civil SEC investigation running simultaneously. Decisions made in one proceeding directly affect the other, and the interactions are not theoretical.
A company that settles the civil SEC case first may have made admissions of fact in the consent decree that the DOJ uses in the parallel criminal case. An individual who testifies in a civil proceeding and then faces criminal charges has created a testimonial record available for impeachment or as substantive evidence. A company that waives attorney-client privilege over internal investigation materials as part of civil cooperation has waived that privilege for all purposes, including in the criminal proceeding. These interactions have produced convictions and dramatically increased individual and corporate penalties in cases where the parallel proceeding strategy was not managed as a coordinated whole from the beginning.
The Fifth Amendment applies differently across proceedings. An employee called to testify in an SEC administrative proceeding has the right to invoke the Fifth Amendment, but doing so in a civil proceeding produces an adverse inference against the company, while invoking it in a criminal proceeding carries no such civil penalty. White collar criminal defense and government and internal investigations practice in parallel proceedings requires a coordinated strategy that addresses both tracks simultaneously from the moment the second proceeding opens.
4. Frequently Asked Questions about Regulatory Investigations
Regulatory investigation questions arrive from general counsel who received a grand jury subpoena on a Friday afternoon, from compliance officers who discovered an employee may have been falsifying records and need to decide whether to call the DOJ before the DOJ calls them, and from executives who received an SEC letter stating they are the subject of a formal order of investigation. Those situations generate the following questions.
What Is a Regulatory Investigation and How Does It Differ from a Lawsui
A regulatory investigation is a government agency's process of gathering evidence to determine whether a violation of law occurred and what enforcement action is warranted. It differs from a lawsuit in that no formal charges or complaints have yet been filed, the company is not yet a defendant, and the investigation's outcome can range from a criminal indictment to a civil enforcement action to an administrative proceeding to a declination with no action taken. The critical distinction from a lawsuit is that the company's conduct during the investigation, including its cooperation, remediation, and disclosure decisions, directly affects whether and how the government proceeds.
How Does the Type of Agency Determine the Company'S First Response?
A DOJ criminal investigation requires immediate privilege protection, individual counsel assessment for potentially exposed employees, and litigation hold implementation, with Fifth Amendment rights and obstruction risk as immediate concerns. An SEC investigation requires the same litigation hold and privilege protection but focuses on civil enforcement remedies including disgorgement and injunction rather than criminal charges, though SEC matters frequently run parallel to DOJ criminal investigations. An FTC or CFPB civil investigative demand signals a civil regulatory investigation without immediate criminal exposure but with substantial civil penalty and injunctive relief authority. Each agency uses different investigative tools, follows different procedural rules, and resolves matters through different mechanisms, so the first response strategy must be calibrated to which agency is investigating.
Does the Company Have to Cooperate Beyond What the Subpoena Legally Requires?
The company has legal obligations to respond to subpoenas and CIDs, but cooperation beyond the minimum legal requirement is a strategic choice with direct consequences for resolution. DOJ and SEC cooperation credit frameworks reward companies that voluntarily disclose problems, produce documents proactively, make witnesses available for interviews, and take remediation steps. Companies that cooperate fully are eligible for deferred prosecution agreements, non-prosecution agreements, and civil penalty reductions that companies that simply comply with the minimum legal requirements do not receive. The decision requires evaluating the strength of the government's likely independent evidence and the resolution options available at different cooperation levels.
When Should a Company Consider Voluntary Disclosure before Receiving a Subpoena?
Voluntary disclosure makes sense when the company has identified clear violations, when the government is likely to learn about the conduct through a whistleblower or parallel investigation anyway, and when cooperation credit available for self-reporting materially improves the likely resolution. The DOJ FCPA Corporate Enforcement Policy creates a presumption of declination for companies that voluntarily self-disclose FCPA violations, fully cooperate, and remediate. The SEC has publicly announced declinations for companies that self-reported and cooperated. The calculus changes when the evidence of the violation is weak, when the government is unlikely to discover the issue independently, or when voluntary disclosure triggers mandatory reporting obligations in other jurisdictions that create additional exposure. FCPA law and voluntary disclosure decisions require analysis of all of those factors simultaneously.
What Is the Difference between a Deferred Prosecution Agreement, a Non-Prosecution Agreement, and a Consent Decree?
A deferred prosecution agreement is a formal agreement in which the government files criminal charges but agrees to defer prosecution while the company fulfills conditions including payment of a financial penalty, compliance improvements, and cooperation with ongoing investigations. If the company satisfies all conditions, charges are dismissed. A non-prosecution agreement involves no charges filed: the government agrees not to prosecute in exchange for meeting similar conditions. Both are alternatives to corporate guilty pleas in criminal matters. A consent decree is the civil analog, used when a civil agency seeks injunctive relief and civil penalties without a criminal proceeding. The available resolution type depends on the nature of the violation, the severity of the conduct, and the company's cooperation and remediation record throughout the investigation.
08 Jun, 2026
