White collar cases almost never begin with an arrest. They begin quietly, months or years earlier, with a subpoena to a bank, a whistleblower complaint, a regulatory referral, or a cooperating witness — and by the time anyone in the company knows, the government has often already assembled the documents. This article explains how these investigations actually start and unfold, what the difference between a witness, a subject, and a target really means, and why the most dangerous crimes in this field are frequently the ones committed after the investigation begins. It covers the small number of extremely broad statutes that carry most federal white collar prosecutions, the Supreme Court decisions that have repeatedly narrowed them, and what those decisions mean in practice. Separate parts address the individual's first decisions, the corporation's parallel and conflicting interests, the attorney-client privilege in an internal investigation, and the choice between cooperating and defending. Later parts cover parallel civil and regulatory proceedings, forfeiture, and sentencing. Examples run throughout.