Summary. A federal white-collar investigation announces itself in one of a few ways — a grand jury subpoena to the company, an agent at an employee's front door on a Saturday morning, a target letter, or a call from a prosecutor who is being unusually polite. What the company does in the first two weeks shapes everything that follows, because the decisions about preservation, privilege, employee interviews, and whether to self-disclose are made before anyone knows what happened. The single most consequential structural fact is that the company and its employees have interests that will diverge, often sharply, and the Upjohn warning that acknowledges this is both an ethical obligation and the thing that makes an employee stop talking. This article walks the anatomy of an investigation from the first subpoena through charging, cooperation credit, and resolution, with attention to the decisions that are genuinely reversible and the ones that are not.

There is a particular quality to the phone call. A lawyer you have never met introduces herself as an Assistant United States Attorney, says she is looking into some matters involving your company, and asks whether you are represented. The tone is courteous. Nothing about it sounds like an emergency. It is an emergency.

Federal white-collar practice runs on a timeline that is invisible from the outside. By the time the government contacts a company, it has usually been working the case for months and sometimes years. It has bank records obtained by subpoena without notice to anyone. It may have a cooperating witness who has been recording calls. It has almost certainly already talked to former employees, who owe the company nothing and remember everything unflatteringly. The company is arriving late to its own investigation.

This article is about what to do with that disadvantage. It covers how investigations start, what a grand jury subpoena actually requires, how to run an internal investigation that is worth what it costs, the privilege problems that ruin investigations conducted carelessly, the calculus of cooperation, and the ways these cases end.

How a white-collar case actually begins

Federal criminal investigations of business conduct arrive through a small number of doors.

A whistleblower. The most common origin. An employee who was passed over, terminated, or simply appalled contacts the SEC, the Commodity Futures Trading Commission, the IRS, or a qui tam relator's counsel. The financial incentives are substantial: the Dodd-Frank whistleblower program under 15 U.S.C. § 78u-6 pays between ten and thirty percent of sanctions over one million dollars, and False Claims Act relators under 31 U.S.C. § 3730(d) recover between fifteen and thirty percent. These are not small numbers, and they have professionalized the plaintiff-side referral pipeline.

A regulator's referral. A civil examination turns up something that looks intentional. The SEC's Division of Enforcement, banking regulators, and the IRS all have referral mechanisms to the Department of Justice, and the referral often arrives without the company knowing it happened.

A cooperating defendant. Someone charged in a different case offers your company's conduct as currency. This is why the government sometimes seems to know exactly which transaction to ask about.

Data. The government increasingly runs analytics against its own datasets — Medicare billing patterns, customs entries, securities trading ahead of announcements — and generates leads without a human complainant at all.

Self-disclosure. The company reports itself, usually after an internal investigation, in exchange for the substantial discounts discussed below.

Knowing which door the case came through matters, because it tells you what the government already has and how much of the story it has heard from someone hostile.

Target, subject, witness: the three words that organize everything

The Justice Manual at § 9-11.151 defines the categories, and they are not merely descriptive — they drive the government's obligations and your client's exposure.

A target is a person as to whom the prosecutor has substantial evidence linking them to the commission of a crime and who, in the prosecutor's judgment, is a putative defendant. A target letter is a courtesy, not a requirement, and it is frequently an invitation to negotiate.

A subject is a person whose conduct is within the scope of the grand jury's investigation. This is the most uncomfortable category, because it means the prosecutor has not decided. Subjects can become targets or witnesses depending on what the investigation develops and, often, on how helpful they are.

A witness is everyone else. But witness status is provisional, and a witness who shades testimony becomes a target under 18 U.S.C. § 1001 or § 1621 for reasons having nothing to do with the underlying conduct.

Ask the prosecutor which category your client occupies. Prosecutors will usually tell you, and the answer changes the strategy entirely. A target does not sit for an interview without an immunity or proffer agreement. A witness generally should cooperate promptly, because the cost of being difficult is being reclassified.

The grand jury subpoena

A grand jury subpoena under Fed. R. Crim. P. 17 is the government's primary compulsory tool in a white-collar case, and it is broader than anything available in civil litigation. There is no relevance objection worth the name. The Supreme Court held in United States v. R. Enterprises, Inc., 498 U.S. 292 (1991), that a subpoena is presumptively valid and will be quashed only where there is no reasonable possibility that the material sought will produce information relevant to the general subject of the investigation. That is close to no standard at all.

Two forms matter. A subpoena duces tecum commands production of documents and records. A subpoena ad testificandum commands a person to appear and testify.

What to do in the first forty-eight hours

Read the return date and calendar backward. Production deadlines are negotiable — prosecutors routinely extend them for a company that engages cooperatively — but the request must be made, not assumed.

Issue a litigation hold immediately, and make it broader than the subpoena. Destruction of documents after a subpoena arrives is a separate crime under 18 U.S.C. § 1512(c)(1) and § 1519, carrying up to twenty years. Section 1519 does not even require a pending proceeding; it reaches destruction "in relation to or contemplation of" any federal matter. Companies survive the underlying conduct all the time. They do not survive the cover-up. Arthur Andersen LLP v. United States, 544 U.S. 696 (2005), narrowed § 1512(b) by requiring consciousness of wrongdoing, but the firm was destroyed by then, which is the actual lesson.

Suspend automatic deletion. Email retention policies, Slack message expiry, ephemeral messaging applications, and phone recycling programs all have to stop, and someone technical has to confirm in writing that they did. The Justice Department's Evaluation of Corporate Compliance Programs guidance now specifically addresses whether a company's messaging policies preserve business communications.

Identify the custodians and the systems before you negotiate scope. You cannot sensibly narrow a request until you know what it captures.

Do not call the employees named in the subpoena to ask what happened. Not yet. Do this in a structured way, with counsel, with warnings, for the reasons discussed below.

Negotiating the subpoena

Prosecutors expect negotiation and most will engage on scope, custodians, date ranges, and search terms. The productive posture is to demonstrate that you are trying to give them what they want faster, not to give them less. Offer a rolling production. Propose a custodian list with a rationale. Suggest search terms and share the hit counts.

What you cannot do is quietly produce a narrowed set and let the prosecutor believe it is complete. That is the path to an obstruction charge on top of everything else.

Privilege and the subpoena

Privileged material is withheld, but the log matters more than in civil practice because the government reads it as a roadmap. And note the crime-fraud exception: under United States v. Zolin, 491 U.S. 554 (1989), a court may review allegedly privileged material in camera on a showing of a factual basis adequate to support a good-faith belief that review may reveal evidence establishing the exception. Communications in furtherance of an ongoing or contemplated crime are not privileged, and the government does not need to prove the crime to get the documents.

The Fifth Amendment problem the company does not have

A corporation has no Fifth Amendment privilege. Hale v. Henkel, 201 U.S. 43 (1906), and Braswell v. United States, 487 U.S. 99 (1988), establish that a custodian of corporate records cannot resist producing them on self-incrimination grounds even if the records incriminate the custodian personally. The act of production is deemed that of the corporation.

Individuals are different. A natural person may assert the privilege against producing personal records where the act of production would itself be testimonial — conceding existence, possession, and authenticity. Fisher v. United States, 425 U.S. 391 (1976), and United States v. Hubbell, 530 U.S. 27 (2000), define the doctrine. Hubbell in particular held that where the government uses the compelled production to learn what documents exist, the derivative use is barred by an act-of-production immunity grant.

This asymmetry is the first place company and employee interests diverge, and it will not be the last.

The internal investigation

At some point early, the company has to find out what actually happened. This is harder than it sounds, and it is where most of the expensive mistakes occur.

Who conducts it

The threshold question is whether in-house counsel can run the investigation or whether outside counsel is required. The considerations are credibility, privilege, and conflicts.

Credibility: a prosecutor evaluating whether to extend cooperation credit will discount an investigation conducted by people who report to the executives under scrutiny. Where senior management or the board is implicated, independent outside counsel retained by the audit committee is effectively mandatory.

Privilege: in-house counsel wear business hats and legal hats, and the mixed-purpose problem makes privilege assertions harder to sustain. Outside counsel retained for the express purpose of providing legal advice presents a cleaner record.

Conflicts: counsel who advised on the transaction under investigation cannot credibly investigate it.

The Upjohn warning

Upjohn Co. v. United States, 449 U.S. 383 (1981), established that the corporate attorney-client privilege extends to communications between counsel and employees at any level, where the communications concern matters within the scope of the employee's duties and are made for the purpose of securing legal advice for the corporation. It also made clear what follows: the privilege belongs to the corporation, not to the employee.

That means counsel must tell every employee interviewed, at the start, in substance:

  • I represent the company, not you.
  • This conversation is privileged, but the privilege belongs to the company.
  • The company may decide to waive it and disclose what you say, including to the government, without asking you.
  • You should keep this conversation confidential.
  • You may wish to consult your own lawyer.

This is the Upjohn warning, sometimes called the corporate Miranda. ABA Model Rule 1.13(f) requires substantially this disclosure when the organization's interests are adverse to the constituent's. Failure to give it creates a genuine risk that the employee will later claim a personal attorney-client relationship and move to block the company's disclosure. Courts have taken those claims seriously; United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009), is the case every white-collar lawyer reads on this point, and it involved a CFO who believed counsel represented him personally.

Document the warning. Have the interviewer's notes reflect that it was given and that the employee acknowledged it. Some firms use a signed acknowledgment; others consider that adversarial enough to chill the interview. Either approach is defensible; no documentation at all is not.

The sequencing problem

Interview order matters enormously. Interview the peripheral witnesses first to build a factual baseline, then move inward. Interviewing the likely wrongdoer first, before you know what the documents show, wastes your only opportunity to ask an unprepared question.

And interview only after the documents are collected and reviewed. An interviewer who has not read the emails is asking the subject to characterize the record rather than confronting them with it.

Whether to write a report

This is genuinely contested. A written report is the deliverable that makes an investigation useful to a board and persuasive to a prosecutor. It is also a discoverable document if privilege is waived or pierced, and it is a roadmap for every civil plaintiff who follows.

The practical middle ground: an oral report to the board with a short written summary of findings and recommendations, holding detailed interview memoranda separately as work product. Whether that survives contact with a determined adversary depends on the jurisdiction and the facts.

Employee counsel and joint defense

Employees who are subjects or targets need their own lawyers. Companies routinely advance fees under indemnification provisions and state statutes such as 8 Del. C. § 145, and the government may not treat fee advancement as non-cooperation — United States v. Stein, 541 F.3d 130 (2d Cir. 2008), held that pressuring a company to cut off employee fees violated the employees' Sixth Amendment rights, and the Justice Manual now expressly forbids considering fee advancement in the cooperation calculus.

Joint defense agreements among company and employee counsel preserve privilege across shared communications, but they come with a cost: withdrawal from a joint defense group when interests diverge is awkward, and information learned inside it may be restricted. Put the agreement in writing and include an express exit provision.

Cooperation, self-disclosure, and the discount structure

The Justice Manual's principles of federal prosecution of business organizations, at § 9-28.300 — the successors to what practitioners still call the Filip factors — list the considerations for charging a corporation. They include the seriousness of the offense, pervasiveness of wrongdoing within the organization, the corporation's history, timely and voluntary disclosure, the existence and effectiveness of a compliance program, remedial actions, collateral consequences, and the adequacy of civil or regulatory remedies.

Two of these are within the company's control after the fact: disclosure and remediation.

What cooperation credit requires

Under the current framework, full cooperation credit requires the company to identify all individuals substantially involved in the misconduct and to produce all relevant, non-privileged facts about their conduct. This is the individual-accountability principle that began with the 2015 Yates memorandum and has been refined since. The company does not have to waive privilege to get credit — the Justice Manual is explicit that eligibility does not depend on waiver — but it does have to disclose the underlying facts, which in practice means disclosing what witnesses said even if the memoranda themselves are withheld.

Voluntary self-disclosure

The Department's corporate enforcement policy offers a substantial and increasingly formalized discount for voluntary self-disclosure. Where a company voluntarily self-discloses, fully cooperates, and timely and appropriately remediates, the current policy creates a presumption of declination absent aggravating circumstances, and where a criminal resolution is warranted, discounts of fifty percent or more off the low end of the Sentencing Guidelines fine range. Several U.S. Attorney's Offices have adopted parallel policies, and the Criminal Division has extended similar frameworks to individuals through its whistleblower and self-disclosure programs.

The decision to self-disclose is not obvious. It is a bet that the government will find out anyway, that the discount exceeds the cost of the disclosure, and that the collateral consequences — debarment, licensing, civil exposure, contractual defaults — are survivable. That bet is easier when a whistleblower has already filed, when the conduct is ongoing, or when the industry is one where regulators talk to each other.

Remediation the government actually credits

Discipline of responsible individuals, including clawback of compensation. The Department's compensation incentives and clawbacks pilot program made this explicit, offering fine reductions for companies that claw back compensation from wrongdoers. Structural changes to the control that failed. Investment in compliance staffing and testing. Not: a new policy document, a training slide deck, and a press release.

Parallel proceedings

White-collar conduct rarely generates only one proceeding. A single set of facts can produce a criminal investigation, an SEC enforcement action, a civil class action, a derivative suit, a state attorney general inquiry, and a contractual dispute — running simultaneously, on different timetables, with different discovery rules.

The recurring problems:

The stay question. Defendants often move to stay the civil case pending the criminal one, because civil discovery forces individuals to choose between testifying and taking the Fifth. Courts weigh the overlap, the status of the criminal case, and prejudice to the plaintiff. A stay is far more likely after an indictment than during an investigation.

The adverse inference. In a civil case, unlike a criminal one, the factfinder may draw an adverse inference from an assertion of the Fifth Amendment. Baxter v. Palmigiano, 425 U.S. 308 (1976). This is why individual defendants sometimes settle civil cases they would win, and why the timing of a criminal resolution changes civil settlement value dramatically.

Information sharing. Grand jury material is secret under Fed. R. Crim. P. 6(e), and the secrecy rule constrains what prosecutors may share with civil regulators. But the constraint is narrower than defense counsel would like: material developed outside the grand jury flows freely, and agencies conduct genuinely parallel investigations with coordinated timing.

Statements made in one forum. Deposition testimony, regulatory submissions, and public filings are all available to the prosecutor, and each is a potential false-statement charge under 18 U.S.C. § 1001 or a perjury charge under § 1621. Consistency across proceedings is a discipline that has to be actively managed.

The statutes that actually get charged

White-collar prosecutions are built from a surprisingly small toolkit, and the tools are broad by design.

Mail and wire fraud, 18 U.S.C. § 1341 and § 1343. A scheme to defraud, plus use of the mails or interstate wires. The wires element is trivially satisfied by an email. The Supreme Court has spent a decade narrowing the property interest the scheme must target — Kelly v. United States, 590 U.S. 391 (2020), reversed the Bridgegate convictions because the object was regulatory power rather than property; Ciminelli v. United States, 598 U.S. 306 (2023), rejected the right-to-control theory; Percoco v. United States, 598 U.S. 319 (2023), narrowed honest-services fraud for private citizens. These cases matter enormously at the margins, but the core theory remains available and remains the government's workhorse.

Honest services fraud, 18 U.S.C. § 1346, limited by Skilling v. United States, 561 U.S. 358 (2010), to bribery and kickback schemes.

Securities fraud, 15 U.S.C. § 78j(b) and 17 C.F.R. § 240.10b-5, and the standalone criminal provision at 18 U.S.C. § 1348, which does not require the same elements and is correspondingly easier to charge.

False statements, 18 U.S.C. § 1001. Any materially false statement in a matter within federal jurisdiction. This is why the interview with the agent is dangerous even for people who did nothing wrong, and why the answer to an unexpected knock is always that you would like to have counsel present.

Obstruction, 18 U.S.C. § 1503, § 1505, § 1512, and § 1519. See above.

Conspiracy, 18 U.S.C. § 371, including the defraud clause, which reaches schemes to impair the lawful functions of a government agency without any independent statutory violation.

Money laundering, 18 U.S.C. § 1956 and § 1957, which convert a completed fraud into a second, more serious offense whenever proceeds move.

Sector-specific statutes: the Foreign Corrupt Practices Act at 15 U.S.C. § 78dd-1; the Anti-Kickback Statute at 42 U.S.C. § 1320a-7b; the False Claims Act's criminal analogue at 18 U.S.C. § 287.

Corporate criminal liability itself rests on New York Central & Hudson River Railroad Co. v. United States, 212 U.S. 481 (1909): a corporation is liable for the acts of its agents committed within the scope of employment and at least in part to benefit the corporation. There is no good-faith compliance defense in federal law, which is precisely why the charging policies and the Sentencing Guidelines carry so much weight — the mitigation happens at charging and sentencing, not at trial.

How these cases end

Declination. The government closes without charging. Under the current corporate enforcement policy, a declination with disgorgement is a recognized outcome and is sometimes published.

Non-prosecution agreement. A letter agreement under which the government agrees not to charge, in exchange for admissions, payment, cooperation, and compliance undertakings. No court involvement.

Deferred prosecution agreement. An information is filed, prosecution is deferred for a term, and the charge is dismissed if the company complies. Requires court approval and a speedy-trial exclusion under 18 U.S.C. § 3161(h)(2). United States v. Fokker Services B.V., 818 F.3d 733 (D.C. Cir. 2016), confirmed that judicial review of a DPA is narrow.

Plea. A guilty plea by the entity, a subsidiary, or individuals, under Fed. R. Crim. P. 11.

Trial. Rare for entities and not common for individuals, because the Sentencing Guidelines create an enormous penalty for losing.

Corporate fines run through Chapter Eight of the Sentencing Guidelines: a base fine from § 8C2.4, multiplied by a culpability score under § 8C2.5 that increases for involvement of high-level personnel and prior history, and decreases for an effective compliance program and for self-reporting, cooperation, and acceptance of responsibility. The compliance-program credit under § 8B2.1 is the reason a real program pays for itself exactly once, at the worst possible moment, and pays for itself completely.

Monitorships. An independent monitor imposed for a term, reporting to the government on remediation. Expensive, intrusive, and — under recent Department guidance — imposed more selectively and with clearer scoping than in the past.

What competent counsel does differently

The pattern across cases that go well is not clever lawyering. It is speed and discipline in the first month.

Preserve immediately and prove it later. The company that can produce a dated hold notice, a list of suspended deletion jobs, and a custodian acknowledgment log has removed the government's easiest theory.

Get the facts before you take a position. Companies that publicly deny conduct they have not investigated end up either retracting or defending the indefensible.

Warn every employee, every time. No exceptions for the executive you have known for fifteen years.

Separate counsel early. The instinct to keep everyone under one tent is understandable and wrong. Divergence gets more expensive the later it is recognized.

Treat the timeline as a negotiation, not a deadline. Prosecutors extend for companies that engage and do not extend for companies that go quiet.

Decide about self-disclosure deliberately and in writing. The board should see the analysis. It is one of the few genuinely irreversible decisions in the sequence.

Assume every communication will be read by the government. Including the ones written by lawyers, because privilege is a rule about admissibility, not a guarantee of secrecy.

Primary authority

A worked sequence: the first thirty days

It helps to see the whole thing as a schedule rather than a set of principles.

Day 1. The subpoena arrives, or the agents do. Someone senior calls outside counsel before responding substantively to anything. If agents are executing a search warrant, employees are told they may decline to be interviewed, that they may have counsel present, and that they should not obstruct the search. Counsel goes to the site. A copy of the warrant and the inventory is obtained.

Days 1–2. Litigation hold issued in writing to a custodian list built from the subpoena plus a generous margin. IT confirms in writing that automatic deletion, retention purges, and device recycling are suspended, including for ephemeral messaging platforms. The general counsel calendars the return date and instructs no one to contact anyone named in the subpoena about its subject matter.

Days 2–5. Counsel contacts the prosecutor, confirms representation, asks whether the company is a target, subject, or witness, and asks the same about named individuals. Requests an extension. Begins negotiating custodians, date ranges, and search terms. Nothing is produced yet.

Week 1. The board or audit committee is briefed. The scope of the internal investigation is defined in writing, including who the client is and who the investigation reports to. If senior management may be implicated, the committee retains independent counsel directly.

Weeks 1–2. Document collection and review begins. Employees whose conduct is likely at issue are identified and offered separate counsel; fee advancement is confirmed against the charter, bylaws, and any indemnification agreement. A joint defense agreement is drafted but not yet executed.

Weeks 2–4. Interviews, from the periphery inward, each opened with a documented Upjohn warning. Rolling production begins on the schedule negotiated with the prosecutor. Privilege log maintained contemporaneously rather than reconstructed later.

End of month one. Counsel gives the board a preliminary factual picture and the first honest assessment of three questions: what happened, who knew, and whether to self-disclose. That last question does not have to be answered yet. It does have to be framed, with the discount structure, the collateral consequences, and the likelihood that the government learns anyway all set out plainly.

Companies that follow something like this schedule tend to be treated as cooperative regardless of what the investigation finds. Companies that spend the first month deciding who is in charge tend not to be.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Federal charging policies, self-disclosure programs, and monitorship practices change with administrations and are revised frequently; the Justice Manual provisions described here should be checked against the current text before any disclosure decision is made. If your company has received a grand jury subpoena or been contacted by federal agents, retain experienced white-collar counsel immediately and before speaking with the government.