Summary. A grand jury subpoena is the broadest compulsory process in American law, and the window for responding well to one is measured in days. The recipient must preserve immediately, determine whether the company is a target, subject, or witness, negotiate scope with a prosecutor who expects to be engaged rather than fought, and manage the divergence between the company's interests and those of its employees. This guide runs the response in the order the clock requires, from the first hour through production, privilege review, and testimony. It covers the constitutional asymmetry that leaves corporations without a Fifth Amendment privilege while individuals retain one, the obstruction exposure that destroys more companies than the underlying conduct, and the practical decisions about counsel, cooperation, and disclosure that shape everything after.

Someone brings the envelope to the general counsel's office, or a process server hands it to a receptionist, or an FBI agent delivers it in person and asks a few questions while doing so. It is a single page plus an attachment listing categories of documents, with a return date perhaps three weeks out.

Almost everything that will matter about the resulting investigation is decided in the following two weeks, and most of it before anyone knows what the case is about.

This guide walks the response in sequence.

Hour one to hour four

Do not discuss it with anyone yet

Not the executive team, not the employees named in it, and above all not the person whose conduct the subpoena appears to be about. Information travels, and a conversation intended to gather facts can look afterward like an attempt to align stories.

The exception is the small group who must know immediately: the general counsel, the chief executive or the board chair depending on who is implicated, and outside counsel.

Engage outside counsel immediately

Even a company with sophisticated in-house capability should engage outside white-collar counsel on day one. The reasons are practical rather than ceremonial: privilege is cleaner, the prosecutor's expectations are known to someone who deals with that office, and in-house counsel may become a witness.

Where senior management may be implicated, counsel should be engaged by the board or audit committee, not by management.

Read the subpoena carefully

Identify:

  • The issuing court and grand jury, which tells you the district.
  • The Assistant United States Attorney's name and the agency listed — FBI, IRS-CI, HHS-OIG, FDA-OCI, Postal Inspection Service. The agency frequently reveals the subject matter.
  • The return date.
  • The categories requested, and the date range.
  • Whether it is a subpoena duces tecum for documents, ad testificandum for testimony, or both.
  • Any instructions regarding form of production, custodians, or electronic data.

If agents are also present

Agents delivering a subpoena often attempt a brief interview. Employees should be told, in advance as a matter of policy and again in the moment:

  • They are not required to speak with agents.
  • They may speak with agents if they choose.
  • They may have counsel present.
  • They must not lie — a false statement to a federal agent is a crime under 18 U.S.C. § 1001 whether or not the person is under oath.
  • They must not destroy or conceal anything.

Post a notice with this content, and have someone available to answer questions.

If agents are executing a search warrant rather than serving a subpoena, that is a different and more serious event: obtain a copy of the warrant and the inventory, do not consent to searches beyond its scope, do not obstruct, send employees home if practical, and get counsel to the site immediately.

Day one: preservation

This is the single most important step, and failing it is worse than anything the underlying investigation is likely to find.

Issue a written litigation hold, immediately, that is broader than the subpoena. Include:

  • Every custodian who might have responsive material, plus a margin.
  • Email, files, chat and messaging platforms, text messages on personal and company devices, voicemail, calendars, notes, and paper.
  • Instructions to preserve and not to delete, and to contact counsel with questions.

Then confirm, in writing from someone technical, that:

  • Automatic deletion is suspended — email retention policies, chat message expiry, ephemeral messaging applications, backup rotation, and device recycling.
  • Departing employees' accounts and devices are preserved rather than reimaged.
  • Cloud services and third-party systems are covered.

The criminal exposure here is severe and independent. 18 U.S.C. § 1512(c)(1) reaches corrupt alteration or destruction of a record with intent to impair its availability in an official proceeding. 18 U.S.C. § 1519 reaches knowing destruction, alteration, or concealment of a record with intent to impede an investigation in relation to or contemplation of any federal matter — no pending proceeding required — and carries up to twenty years.

Arthur Andersen LLP v. United States, 544 U.S. 696 (2005), narrowed § 1512(b) by requiring consciousness of wrongdoing. The firm had already been destroyed. That is the lesson, not the holding.

Companies survive the conduct that prompted the subpoena. They do not survive the deletion.

Days one to three: the status question

Call the prosecutor. Introduce yourself, confirm representation, and ask directly whether the company is a target, a subject, or a witness — and, separately, the status of any individuals named.

The Justice Manual at § 9-11.151 defines these:

  • Target — a person as to whom the prosecutor has substantial evidence linking them to a crime and who is a putative defendant.
  • Subject — a person whose conduct is within the scope of the investigation.
  • Witness — everyone else.

Prosecutors will usually answer. The answer determines the entire strategy: a target company is deciding about cooperation and self-disclosure; a witness company is deciding how quickly and cheaply it can comply.

Ask also whether there is a parallel civil or regulatory proceeding, and whether the office objects to the company conducting an internal investigation. The answers are informative and the questions are expected.

Week one: negotiating the subpoena

What is negotiable

Almost everything except the obligation to comply.

Prosecutors routinely agree to:

  • Extend the return date, often substantially, for a recipient who engages promptly and shows a plan.
  • Narrow custodians to those likely to have responsive material.
  • Narrow date ranges.
  • Agree search terms for electronic review, sometimes with hit-count reporting.
  • Accept rolling production.
  • Agree form of production — load files, metadata fields, native formats for spreadsheets.

The posture that works is cooperative and specific: here is what your request captures, here is the burden, here is a proposal that gets you what you actually want faster. The posture that fails is a motion to quash.

Why motions to quash rarely work

United States v. R. Enterprises, Inc., 498 U.S. 292 (1991), holds a grand jury subpoena presumptively valid, quashed only where there is no reasonable possibility that the material sought will produce information relevant to the general subject of the investigation. The grand jury need not have probable cause and need not identify what it is investigating.

Fed. R. Crim. P. 17(c)(2) permits quashing a subpoena that is unreasonable or oppressive. In practice the grounds that occasionally succeed are genuine and extreme burden, privilege, or a demonstrable improper purpose — such as use of the grand jury solely to prepare an already-indicted case for trial, or issuance after a decision to indict.

Filing and losing costs credibility with the office that will later decide whether to charge the company.

What must never happen

Do not produce a narrowed set while allowing the prosecutor to believe it is complete. If the production is partial, say so in writing, describe what is excluded and why, and preserve the excluded material. Silent narrowing is how a document case becomes an obstruction case.

Weeks one to four: collecting and producing

Scope and collect

Identify custodians and systems. Interview IT about where data actually lives, which is frequently different from where the organizational chart suggests. Collect forensically where the integrity of the data may be questioned.

Do not let custodians self-collect. A custodian deciding which of their own emails are responsive is both unreliable and, if the matter turns adversarial, a serious problem.

Review

Two overlays:

Responsiveness, against the categories as negotiated.

Privilege. Withhold privileged material and log it. Grand jury privilege logs are typically less detailed than civil ones, but the government reads them, and an overbroad assertion invites challenge.

Be alert to the crime-fraud exception. United States v. Zolin, 491 U.S. 554 (1989), permits in camera review on a showing of a factual basis adequate to support a good-faith belief that review may reveal evidence establishing the exception. Communications in furtherance of an ongoing or contemplated crime are not privileged.

Where the government seizes potentially privileged material — most often in a search of a law office or an executive's files — a filter team or taint team is typically used, and a recipient may seek judicial supervision or a special master instead. This is worth fighting for; filter teams are government lawyers.

Produce

Cover letter identifying what is produced, by Bates range, against which categories, and noting anything withheld or excluded. Keep a complete production set. Track everything.

The custodian of records

Where the subpoena calls for testimony authenticating the records, a custodian of records appears before the grand jury to identify the documents and confirm they are the company's business records.

Two points:

The corporation has no Fifth Amendment privilege. Hale v. Henkel, 201 U.S. 43 (1906). And under Braswell v. United States, 487 U.S. 99 (1988), a custodian may not resist production on the ground that the act of producing corporate records would incriminate them personally, because the act is deemed the corporation's. The custodian's own act of production may not be used against them personally, but the records may.

Choose a custodian without personal exposure. Someone who did not participate in the conduct under investigation, who is prepared narrowly to authenticate, and who has counsel. Appearances are limited in scope and should stay there.

The individuals

The company and its employees have interests that will diverge, and pretending otherwise creates problems that compound.

Upjohn warnings

Any internal interview must begin with the warning: counsel represents the company, not the employee; the conversation is privileged but the privilege belongs to the company; the company may waive it and disclose what is said, including to the government; and the employee may wish to consult their own lawyer. Upjohn Co. v. United States, 449 U.S. 383 (1981); ABA Model Rule 1.13(f).

Document that it was given. United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009), is the cautionary case.

Separate counsel

Employees who are subjects or targets need their own lawyers. Companies commonly advance fees under charter, bylaw, or statutory indemnification provisions such as 8 Del. C. § 145.

The government may not treat fee advancement as non-cooperation. United States v. Stein, 541 F.3d 130 (2d Cir. 2008), held that pressuring a company to cut off fees violated the employees' Sixth Amendment rights, and the Justice Manual now forbids considering it.

Joint defense agreements

Useful for preserving privilege across shared communications, and dangerous when interests later diverge. Put it in writing, define the scope narrowly, and include an express withdrawal provision addressing what happens to shared information.

Individual Fifth Amendment rights

An individual served with a subpoena for personal records may assert the privilege where the act of production would itself be testimonial — conceding existence, possession, or authenticity. Fisher v. United States, 425 U.S. 391 (1976); United States v. Hubbell, 530 U.S. 27 (2000).

An individual subpoenaed to testify may assert the privilege question by question. Prosecutors sometimes respond with:

  • A proffer agreement, under which the individual's statements in the proffer session may not be used in the government's case-in-chief, subject to significant exceptions permitting derivative use and impeachment. These agreements are less protective than clients assume.
  • Statutory immunity under 18 U.S.C. §§ 6002–6003, which is use and derivative use immunity, not transactional. The individual may still be prosecuted on evidence derived from wholly independent sources, and the government bears the burden of proving independence at a Kastigar hearing. Kastigar v. United States, 406 U.S. 441 (1972).

No individual should make either decision without their own counsel.

Running the internal investigation alongside

A company that produces documents without knowing what they say is negotiating blind. Some level of internal investigation is nearly always warranted.

Scope it in writing. Who is the client, what questions are being answered, who does counsel report to, and what is out of scope.

Sequence the interviews from the periphery inward, after the documents have been collected and reviewed. An interviewer who has not read the emails is asking the witness to characterize the record.

Decide about a written report deliberately. A report is useful to a board and persuasive to a prosecutor. It is also discoverable if privilege is waived or pierced, and a roadmap for every civil plaintiff who follows. Many companies deliver an oral report with a short written summary, holding detailed interview memoranda as work product.

Do not obstruct the government's investigation by conducting yours. Do not tell witnesses what others said. Do not suggest what an answer should be. Do not instruct anyone to decline an interview with agents — telling employees they have the right to decline is proper; instructing them to do so is not.

The cooperation decision

For a target or subject company, the largest question is whether to cooperate and whether to disclose conduct the government has not found.

The Justice Manual's principles of federal prosecution of business organizations at § 9-28.300 list the charging factors, including the pervasiveness of wrongdoing, the company's history, timely and voluntary disclosure, the effectiveness of the compliance program, and remedial action.

Under current policy, full cooperation credit requires identifying all individuals substantially involved and producing all relevant, non-privileged facts about their conduct. Privilege waiver is expressly not required for eligibility — but the underlying facts must be disclosed, which in practice means disclosing what witnesses said even where memoranda are withheld.

Voluntary self-disclosure carries a substantial and increasingly formalized discount, including a presumption of declination absent aggravating circumstances where the company self-discloses, fully cooperates, and timely remediates.

The decision is a genuine bet: that the government will find out anyway, that the discount exceeds the cost of disclosure, and that the collateral consequences — debarment, licensing, civil exposure, contractual defaults — are survivable. It should be made by the board, on a written analysis, and it is one of the few genuinely irreversible steps in the sequence.

Grand jury secrecy, and what you can say publicly

Fed. R. Crim. P. 6(e) imposes secrecy on government attorneys, grand jurors, and court personnel — not on witnesses and not on subpoena recipients. A company may generally disclose that it received a subpoena, and public companies frequently must.

Practical considerations:

  • Prosecutors often request confidentiality. The request is not binding, but antagonizing the office has costs, and there is usually a way to satisfy legitimate concerns.
  • Disclosure obligations may compel a statement: SEC materiality analysis, loan covenant notices, contractual representations, insurance notice, and auditor inquiries.
  • Say less rather than more. A statement that the company is cooperating and does not comment on ongoing matters is nearly always sufficient. Characterizations of the investigation's likely outcome age badly.
  • Watch the auditors. Responses to auditor inquiry letters are not privileged, and the interaction between an internal investigation and the audit process requires deliberate management.

A checklist for the first two weeks

  1. Read the subpoena; identify the AUSA, agency, return date, and scope.
  2. Engage outside white-collar counsel. Involve the board where management is implicated.
  3. Issue a written litigation hold broader than the subpoena; confirm suspension of auto-deletion in writing.
  4. Instruct employees on their rights regarding agent contact; do not instruct them to decline.
  5. Contact the prosecutor; confirm representation; ask about target, subject, and witness status for the company and for individuals; request an extension.
  6. Identify custodians and systems; begin collection; do not permit self-collection.
  7. Offer separate counsel to employees with exposure; confirm fee advancement authority.
  8. Scope an internal investigation in writing; document Upjohn warnings.
  9. Negotiate custodians, date ranges, search terms, and form of production; confirm in writing.
  10. Notify insurers; assess D&O coverage and advancement obligations.
  11. Assess disclosure obligations — securities, lenders, auditors, contractual counterparties.
  12. Begin rolling production with a privilege log maintained contemporaneously.
  13. Select and prepare a custodian of records without personal exposure.
  14. Frame the cooperation and self-disclosure question for the board.

Primary authority

Handling electronic data specifically

Most of what a grand jury subpoena reaches is electronic, and the mechanics deserve their own treatment because the criminal context differs from civil discovery in ways that matter.

There is no meet-and-confer rule and no proportionality standard. The civil framework of Rule 26(b)(1) and Rule 26(f) does not apply. What substitutes is the prosecutor's willingness to negotiate, which is real but discretionary. Approach it by demonstrating burden with numbers — custodian counts, gigabyte volumes, hit counts on proposed terms, estimated review hours — rather than by asserting it.

Identify the systems honestly, including the inconvenient ones. Personal email used for business. Text messages on personal phones. WhatsApp, Signal, and Telegram. Slack and Teams. Shared drives nobody administers. Departed employees' archives. A production that omits a channel the government later learns about is the fact that turns cooperation into obstruction.

Ephemeral messaging is now a specific enforcement focus. The Justice Department's guidance on evaluating corporate compliance programs asks directly about a company's policies on messaging applications and whether business communications are preserved. A company that permitted disappearing messages and cannot produce them will be asked why, and the answer affects cooperation credit.

BYOD is the recurring problem. Where employees use personal devices for business, the company's right to collect depends on its policy and on state law, and several states restrict employer access to personal accounts. Where the company cannot compel collection, say so early and in writing rather than producing an incomplete set silently.

Forensic collection where integrity is in question. Ordinary collection is fine for most material. Where deletion, alteration, or timing is at issue — which is exactly when it matters — use a forensic examiner and preserve chain of custody. Metadata is frequently the evidence.

Form of production. Agree it in writing: load file format, metadata fields, native production for spreadsheets and presentations, deduplication and threading conventions, and handling of encrypted or unprocessable files. Then document what could not be processed rather than dropping it silently.

Structured data. Databases, ERP systems, and transaction logs rarely fit a document production. Negotiate a report or an extract specification with the prosecutor and the case agent, and involve someone who understands the underlying schema on both sides.

Log everything. What was collected, from whom, when, by what method, and what was excluded and why. The collection log is the document that demonstrates good faith if the completeness of the production is ever questioned — and in a criminal matter, it will be.

When the subpoena goes to an executive personally

The analysis changes fundamentally when the recipient is an individual rather than the company, and the most common error is treating company counsel as the executive's lawyer.

The company's lawyer is not your lawyer. This is true even where the company is paying, even where the executive is the chief executive, and even where everyone has been friendly for fifteen years. Company counsel owes duties to the entity, and if the entity's interests come to require distancing itself from the executive — which is precisely what cooperation credit incentivizes — counsel will do that.

Get separate counsel before responding to anything. Before producing a document, before agreeing to an interview, before answering the agent's friendly question at the door.

Personal records are different from corporate records. A subpoena directed to an individual for their own records may be resisted where the act of production is itself testimonial — conceding that the documents exist, that the individual possesses them, and that they are authentic. Fisher v. United States, 425 U.S. 391 (1976); United States v. Hubbell, 530 U.S. 27 (2000). The privilege does not protect the contents of voluntarily prepared documents; it protects the act.

Where the individual holds documents in a representative capacity for the company, Braswell controls and the privilege is unavailable.

Testimony. An individual subpoenaed to the grand jury has no right to counsel in the room — counsel waits outside, and the witness may leave to consult after each question, which is awkward and entirely permissible. Assert the privilege question by question where it applies; a blanket refusal to appear is not an option.

Devices and passcodes. Whether compelling a passcode violates the Fifth Amendment is genuinely unsettled and state courts have divided sharply. Biometric unlocking has been treated differently from a memorized passcode in several decisions. Do not resolve this on the fly.

Employment consequences. An executive who declines to be interviewed by company counsel may be terminated for it — the Fifth Amendment restrains the government, not the employer — while an executive who submits to the interview is speaking to someone who may hand the substance to prosecutors. Indemnification, advancement, and D&O coverage should be confirmed before that choice is made, and the advancement right is frequently stronger than executives realize.

Do not talk to colleagues about the substance. Conversations intended to reconstruct events look, afterward, like coordination — and coordination is an obstruction theory.

The parallel proceedings problem

A grand jury subpoena rarely arrives alone. The same conduct typically generates a regulatory investigation, a civil class action, a derivative suit, and sometimes a state attorney general inquiry — each on its own timetable, with different discovery rules and different consequences for silence.

Civil discovery is the pressure point. In a civil case an individual who asserts the Fifth Amendment faces an adverse inference, which is unavailable in the criminal case. Baxter v. Palmigiano, 425 U.S. 308 (1976). This forces individual defendants to choose between testifying — creating a transcript the government will read — and effectively conceding the civil case.

Moving to stay. Defendants commonly move to stay the civil action pending resolution of the criminal one. Courts weigh the overlap between the proceedings, the status of the criminal case, the burden on the defendants, the interests of the plaintiff and the public, and judicial efficiency. A stay is substantially more likely after an indictment than during an investigation, and partial stays — limited to depositions of individuals with exposure — are a common middle ground.

The government may intervene to seek a stay of civil discovery in order to protect its investigation, and it frequently does.

Grand jury secrecy cuts less far than defendants hope. Rule 6(e) restrains disclosure of matters occurring before the grand jury, but material developed outside it moves freely among agencies, and civil and criminal enforcement components coordinate openly. Do not assume information is compartmentalized.

Consistency across forums is a discipline. Sworn deposition testimony, regulatory submissions, public filings, insurance notices, and auditor representations are all available to the prosecutor, and each is a potential false statement charge under 18 U.S.C. § 1001 or a perjury charge under § 1621. Every substantive statement about the facts, in any forum, should be reviewed by the same team.

Settlement timing. Civil cases settle at very different values before and after a criminal resolution, and a plea or a deferred prosecution agreement with an admitted statement of facts may effectively decide the civil case through collateral estoppel. Where feasible, resolve the criminal matter first, or negotiate a factual statement drafted with the civil exposure in mind.

Insurance. D&O policies commonly exclude coverage for deliberate fraud, typically triggered only by a final adjudication, which is why the wording matters enormously and why a plea can retroactively remove the coverage that funded the defense.

How these matters end, and what to expect

Knowing the possible endings shapes decisions made at the beginning.

Nothing. The most common outcome for a witness company. The subpoena is complied with, the investigation moves elsewhere, and no one ever calls again. Companies are rarely told the matter is closed, which is unsatisfying and normal. Counsel may request a closing letter; some offices provide one.

Declination. The government considers charging and decides not to. Under current corporate enforcement policy a declination may be accompanied by disgorgement and, in some programs, published.

A non-prosecution agreement. A letter agreement: admissions, payment, cooperation, compliance undertakings, and a term. No court involvement, no charge filed.

A deferred prosecution agreement. An information is filed and prosecution deferred for a term, with dismissal on compliance. Requires a speedy-trial exclusion under 18 U.S.C. § 3161(h)(2) and court approval, though United States v. Fokker Services B.V., 818 F.3d 733 (D.C. Cir. 2016), confirmed that judicial review is narrow.

A plea by the entity, a subsidiary, or individuals.

Indictment and trial, rare for entities because the Sentencing Guidelines make losing catastrophic and because collateral consequences — debarment, exclusion, licensure — can be fatal independent of the sentence.

Individuals charged while the company is not. Increasingly the pattern, and the reason the individual-accountability requirement in the cooperation framework matters so much to the people inside the company.

Timelines. Federal white-collar investigations commonly run two to four years, sometimes longer. The five-year default limitations period in 18 U.S.C. § 3282 disciplines the end, and prosecutors frequently seek tolling agreements as it approaches — a request that deserves careful analysis rather than reflexive agreement, since refusing may force a charging decision on an incomplete record.

What to tell the client at the outset. That the process is long, that silence from the government is not evidence of anything, that legal fees will be substantial and largely front-loaded, that the preservation obligation continues throughout, and that the decisions with the greatest effect on the outcome are being made now, in the first month, when the least is known.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. A grand jury subpoena signals a federal criminal investigation, and the obstruction exposure created by mishandling preservation is independent of and frequently more serious than the conduct being investigated. Charging and cooperation policies change with administrations and should be checked against the current Justice Manual. Retain experienced white-collar counsel immediately, and before communicating with the government.