Checklist · Criminal
Responding to a Subpoena, Target Letter, or Financial Investigation: A Practical Checklist
18 U.S.C. § 1001
- Type
- Checklist
- Jurisdiction
- National
- Date
- 2024-11-26
- Topic
- Criminal
This checklist covers what to do when a federal financial investigation touches you or your organization, in the order that preserves the most options. The first two sequences are immediate: what to say when agents appear, what to preserve, what not to do, and how to handle a search warrant being executed. The third covers responding to a grand jury subpoena or civil investigative demand, from the litigation hold through scope negotiation, defensible collection, and the privilege log, and it explains how to read the subpoena as intelligence about the government's theory. The fourth covers what a target letter means and what a pre-indictment presentation involves, including the narrowing decisions every fraud theory should be tested against. The fifth covers the individual's separate interests when the employer is also involved — the Upjohn warning, fee advancement, and interview conduct. The sixth covers the organization's internal investigation, insurance and regulatory notices, and the self-disclosure decision. The seventh covers parallel civil, regulatory, and licensing proceedings, and the last covers sentencing preparation and collateral consequences. Deadlines that cannot be recovered are marked throughout.
Responding to a Subpoena, Target Letter, or Financial Investigation: A Practical Checklist
Criminal > White Collar and Financial Crime | Published 26 November 2024 - Updated 26 July 2025 | UpLaw - uplaw.us
⭐ Three rules govern everything below. Do not talk to investigators without counsel. Delete nothing, ever, from the moment you learn of the matter. Get your own lawyer before deciding what kind of participant you are.
⚠ More people are convicted of what they did after the investigation started than of what started it.
Sequence A — The first hour
☐ If agents are at your door: step outside, close the door, and say — "I am not going to answer questions without my attorney present. Please leave me your card." Repeat if necessary. ⚠ 18 U.S.C. § 1001 applies to unsworn, informal statements, and agents may lawfully mislead you about what they know. ☐ You are not required to consent to a search. If they have a warrant, do not obstruct; if they do not, you may decline consent. ☐ ⚠ Do not delete anything — not a text, not an email, not a file, not an app. 18 U.S.C. § 1519 reaches destruction in contemplation of a matter that has not yet begun. ☐ ⚠ Do not call colleagues to compare recollections. That maps directly onto 18 U.S.C. § 1512. ☐ Write down what happened, immediately and privately: who came, what they asked, what they took, what you said, exact words where possible. ☐ Retain counsel today. Not the company's counsel — your own. ☐ Say nothing on social media, in group chats, or to anyone who might be interviewed.
Sequence B — A search warrant is being executed
☐ Ask to see the warrant; read it — the premises, the items, and the date. ☐ Request a copy, and photograph it if a copy is refused. ☐ ⚠ Do not obstruct, and do not consent to anything beyond the warrant's scope. State clearly that you do not consent to searches outside it. ☐ Ask whether you are free to leave; if you are, leave and call counsel. ☐ ⚠ Do not answer questions. Agents will ask while executing; you may decline. ☐ Note the agents' names, agencies, and the time of arrival and departure. ☐ Have someone observe and take notes if permitted. ☐ Obtain the inventory of items seized before agents leave. ☐ Identify privileged materials to counsel immediately; request a filter or taint team. ☐ Note which devices were taken and what business functions they support. ☐ ⭐ Call counsel while it is happening, not afterward.
Sequence C — Subpoena or civil investigative demand
C1. Immediately
☐ Calendar the return date and note who issued it — grand jury, agency, or a civil investigative demand under 31 U.S.C. § 3733, or regulatory process under 15 U.S.C. § 78u. ☐ ⭐ Issue a written litigation hold the same day, to every person and function with potentially responsive material. ☐ Confirm with IT that automatic deletion is suspended across email, chat, ticketing, phones, cloud storage, and backups. ☐ Document the suspension, with dates and the name of the person who executed it. ☐ ⚠ Do not allow anyone to "organize" or "clean up" files. ☐ Contact the prosecutor to request an extension; extensions are routine.
C2. Scope and collection
☐ Identify custodians, including departed employees and personal devices used for work. ☐ Identify systems: email, messaging, shared drives, ERP, CRM, accounting, backups, and any personal accounts used for business. ☐ Negotiate scope in writing — date ranges, custodians, and search terms. ☐ Collect defensibly and document the method, tools, and dates. ☐ Track everything with Bates ranges.
C3. Privilege
☐ Review for attorney-client privilege and work product. ☐ Prepare a privilege log; do not silently withhold. ☐ For an organization, apply Upjohn, 449 U.S. 383 — the privilege covers employee communications about matters within their duties, and ⭐ belongs to the organization. ☐ ⚠ For an individual, the act of production may itself be testimonial. Never simply comply without counsel.
C4. Read it as intelligence
☐ ⭐ The date range, the custodians named, and the transactions identified disclose the government's theory. Analyze them. ☐ Identify which statutes the described conduct would implicate: fraud at 18 U.S.C. § 1341 and 18 U.S.C. § 1343; bank fraud at 18 U.S.C. § 1344; health care fraud at 18 U.S.C. § 1347; securities fraud at 18 U.S.C. § 1348; conspiracy at 18 U.S.C. § 371 and 18 U.S.C. § 1349. ☐ Consider whether a sealed qui tam may underlie it — 31 U.S.C. § 3730. ☐ Consider money laundering exposure downstream of any fraud — 18 U.S.C. § 1956, 18 U.S.C. § 1957 — and forfeiture at 18 U.S.C. § 981 and 18 U.S.C. § 982.
Sequence D — A target letter arrives
☐ Understand the classifications: witness (has information), subject (conduct within scope), target (substantial evidence; a putative defendant). ⚠ Status changes without notice. ☐ ⭐ Retain experienced federal criminal counsel immediately. This is not a matter for general counsel or a civil litigator. ☐ Do not accept an invitation to testify before the grand jury without a fully considered decision — ⚠ a target who testifies almost always makes the case worse. ☐ Evaluate a pre-indictment presentation: attack the theory, present exculpatory documents, address intent with contemporaneous evidence, and raise collateral consequences. ☐ Test the theory against the narrowing decisions: is there identifiable money or property — Kelly, 590 U.S. 391; Ciminelli, 598 U.S. 306? Is there a bribery or kickback scheme — Skilling, 561 U.S. 358? Is there an official act — McDonnell, 579 U.S. 550? Is a gratuity tied to a specific act — Sun-Diamond Growers, 526 U.S. 398? Compare the historical baseline in McNally, 483 U.S. 350, and the private-duty limits in Percoco, 598 U.S. 319. ☐ Check limitations: five years generally under 18 U.S.C. § 3282; ten for offenses affecting financial institutions under 18 U.S.C. § 3293. ☐ ⚠ Weigh the risk that a presentation educates the government. ☐ Consider whether cooperation is realistic and, if so, that ⭐ timing dominates value — the first cooperator receives materially more than the third.
Sequence E — When your employer is also involved
☐ Ask company counsel directly: "Do you represent me?" The answer will be no. ☐ Listen for the Upjohn warning. If it is not given, ask for it in writing. ☐ ⚠ Understand that the company may give your statements to the government to obtain cooperation credit. ☐ ⭐ Retain your own counsel before the interview, not after. ☐ Ask whether the company will advance legal fees under its bylaws, indemnification agreement, or D&O policy. Ask in writing. ☐ Consider a written joint defense or common-interest agreement, with explicit terms for what happens when interests diverge. ☐ In the interview: do not guess. ⭐ "I do not recall" is honest and safe; a confident wrong answer is neither. ☐ Take no documents home; delete nothing; forward nothing to a personal account. ☐ If you reported the concern internally, note your anti-retaliation protections — 31 U.S.C. § 3730, 15 U.S.C. § 78u-6, 10 U.S.C. § 2409. See reporting misconduct and preserving a retaliation claim and whistleblower and retaliation claims.
Sequence F — The organization's response
F1. First week
☐ ⭐ Litigation hold first, before interviews, before analysis, before anything. ☐ Decide in-house versus outside counsel; outside counsel is more credible to a regulator and avoids counsel becoming a witness. ☐ Define scope, client identity, and reporting line in writing. ☐ Determine the board's role; consider a special committee. ☐ ⚠ Notify insurers under D&O and fidelity policies within the policy notice period — late notice is a common coverage defeat. ☐ Identify independent regulatory reporting obligations and their deadlines. ☐ ⚠ Do not let the people whose conduct is at issue run the investigation.
F2. The investigation
☐ Give and document Upjohn warnings at every interview. ☐ Advise implicated employees to consider separate counsel. ☐ Plan for privilege: written report versus oral briefing, and who receives it. ☐ ⚠ Disclosure of findings to the government generally waives privilege as to the subject matter. ☐ Separate remediation from investigation; fix control failures immediately. ☐ Preserve interview memoranda carefully; they are work product and they are discoverable in some circumstances.
F3. The self-disclosure decision
☐ Make it deliberately and early — ⭐ credit for voluntary disclosure erodes rapidly once the government learns independently. ☐ Weigh: seriousness, pervasiveness, the compliance program then and now, remediation, discipline imposed, restitution, and collateral consequences. ☐ ⚠ Understand that cooperation credit generally requires providing the facts about individuals. ☐ Model the resolution options: declination, non-prosecution agreement, deferred prosecution agreement, or plea. ☐ Model collateral consequences: suspension and debarment under 48 C.F.R. part 9 — see government contracting — industry bars, and licensing action. ☐ Assess parallel False Claims Act exposure under 31 U.S.C. § 3729, where scienter is measured subjectively — Schutte, 598 U.S. 739.
Sequence G — Parallel proceedings
☐ Map every proceeding: criminal; regulatory under 15 U.S.C. § 78u; civil litigation; sealed qui tam under 31 U.S.C. § 3730; administrative and licensing; employment claims. ☐ ⭐ Sequence them deliberately. A civil deposition taken without knowing the criminal posture is the classic unforced error. ☐ Consider moving to stay the civil case pending the criminal matter. ☐ ⚠ An individual may invoke the Fifth Amendment in a civil case, but an adverse inference may be drawn. A corporation has no such privilege. ☐ Track what has been produced in each forum; ⚠ inconsistencies across forums are prosecutorial gifts. ☐ Recognize that regulatory testimony transcripts routinely reach prosecutors. ☐ Calendar licensing board deadlines separately — the standard of proof is lower and the timeline is independent. See professional licensing and occupational discipline and responding to a licensing board complaint or investigation.
Sequence H — Proffer and cooperation
☐ ⚠ Never proffer without counsel experienced in federal practice. ☐ Understand the limits: a limited-use agreement typically permits derivative use, impeachment, and rebuttal — ⭐ which constrains your later defense significantly. ☐ Consider an attorney proffer first: counsel describes what the client knows without the client speaking. ☐ ⚠ Complete truthfulness is required. A single falsehood voids a cooperation agreement and creates new exposure under 18 U.S.C. § 1001 and 18 U.S.C. § 1621 or 18 U.S.C. § 1623. ☐ Prepare thoroughly: review documents, reconstruct chronology, and identify what you do not know. ☐ ⭐ Understand the timing dynamic before deciding. Value declines sharply with each cooperator ahead of you. ☐ Consider the practical costs: testimony, relationships, employment, and the length of the commitment.
Sequence I — Sentencing preparation
⭐ Begin this at the same time as the defense, not after a plea.
☐ Identify the loss the government will assert, and build the counter-analysis: actual versus intended, achievability, credits for amounts repaid, value of services actually delivered, causation, and relevant conduct scope. ☐ Identify the enhancements in play: number of victims, sophisticated means, role in the offense, abuse of a position of trust, obstruction. ☐ Gather mitigation under 18 U.S.C. § 3553: history and characteristics, health, family circumstances, restitution paid, collateral consequences already suffered, and disparity with co-participants. ☐ Note the statutory framework: 18 U.S.C. § 3551, 18 U.S.C. § 3559, 18 U.S.C. § 3571, probation and supervised release at 18 U.S.C. § 3561, 18 U.S.C. § 3563, and 18 U.S.C. § 3583; Commission authority at 28 U.S.C. § 991 and 28 U.S.C. § 994; appellate review at 18 U.S.C. § 3742. ☐ ⚠ File written objections to the presentence report within the deadline. An unchallenged loss calculation becomes the sentence. ☐ Address forfeiture — 18 U.S.C. § 982 — and any pre-trial restraint impairing the ability to retain counsel. ☐ Address restitution; it is joint and several and ⚠ not dischargeable in bankruptcy — compare consumer bankruptcy. ☐ Plan for collateral consequences: licensing, debarment under 48 C.F.R. part 9, industry bars, immigration, bonding, and record relief. See criminal record relief, petitioning to expunge or seal a criminal record, and the sentence after the sentence.
The deadline table
| Trigger | Window | If missed |
|---|---|---|
| Learning of an investigation | ⭐ Immediate | Preservation duty attaches; deletion becomes 18 U.S.C. § 1519 exposure |
| Subpoena return date | As stated; extensions routine | Contempt |
| Civil investigative demand | As stated | Enforcement action |
| D&O insurance notice | Per policy, often short | ⚠ Coverage denied |
| Regulatory self-report | Industry-specific | Independent violation |
| Target letter response invitation | As stated | Loss of pre-indictment presentation |
| Debarment notice | ~30 days | Decided on the government's record |
| Licensing board response | Per state rule | Default discipline |
| Presentence report objections | Per local rule | ⚠ Loss calculation stands |
| Notice of appeal | 14 days | Appeal barred |
| Limitations — general | 5 years — 18 U.S.C. § 3282 | Prosecution barred |
| Limitations — financial institutions | 10 years — 18 U.S.C. § 3293 | Prosecution barred |
Related resources
Plain-language overview: the investigation you do not know about. Full doctrine, elements, and defenses: white collar and financial crime. Holds, scripts, and letters: the white collar investigation response toolkit.
Adjacent: government contracting, bidding, protesting, and performing a government contract, the whistleblower protection and retaliation claim toolkit, the employee who said something, and investor rights and securities claims.
⭐ If you remember nothing else: preserve everything, say nothing without counsel, and get a lawyer who is yours. Those three steps are correct whether or not you did anything wrong — which is exactly why they should be taken before you have finished deciding.
Appendix: what to say, verbatim
To an agent at your door or workplace:
"I am not going to answer any questions without my attorney present. Please leave me your card and I will have my attorney contact you. I am not consenting to any search."
Repeat it if pressed. ⚠ You do not need to explain why, and declining is not evidence of anything.
To company counsel before an interview:
"Before we start — do you represent me personally in this matter?"
Then, after the answer: "I would like to speak with my own attorney before this interview."
To your employer about fees:
"I have been asked to sit for an interview in the [matter]. I intend to retain personal counsel. Please confirm in writing whether the company will advance my legal fees under its bylaws, indemnification agreement, or D&O policy, and on what conditions."
In an internal or government interview, when you are unsure:
"I do not recall."
⭐ That is an honest answer and a safe one. A confident wrong answer about a four-year-old event is how a witness becomes a defendant under 18 U.S.C. § 1001.
To IT, the same day:
"Effective immediately, suspend all automatic deletion and retention policies for [custodians/systems] and preserve all backups. Confirm in writing when this is done, with the time."
Appendix: the preservation memo
Send this on day one. ⭐ It is the single step that gets irreversibly worse with every hour of delay.
PRIVILEGED AND CONFIDENTIAL — LEGAL HOLD
To: [custodians] · From: [counsel] · Date: [ ]
Re: Preservation obligation — [matter]
[Organization] has received [a subpoena / notice of an investigation] concerning [subject]. You must preserve all documents and data relating to [subject], effective immediately.
This includes: email and attachments; instant messages and chat, including ephemeral messaging applications; text messages on company and personal devices used for work; voicemail; calendars; notes and drafts; contracts and correspondence; financial records, invoices, and ledgers; databases and reports; photographs; and backup media.
You must not: delete, alter, overwrite, archive, or reorganize any of the above; disable or reset any device; use automatic-deletion messaging for work matters; or discuss this notice outside the recipients listed.
⚠ Automatic deletion and retention policies are suspended as to these materials as of today.
⚠ Altering or destroying records with intent to impede a federal matter — including one merely contemplated — is a federal crime under 18 U.S.C. § 1519.
Route any contact from investigators to [counsel]. Do not discuss the matter with colleagues.
Acknowledge receipt by [date].
☐ Track acknowledgments and follow up on non-responses. ☐ Reissue periodically and on personnel changes. ☐ ⚠ Confirm the IT suspension in writing, with a timestamp — a verbal instruction is not evidence.
Appendix: the ten most common mistakes
⚠ Every one of these has converted a survivable problem into a charge.
☐ Talking to agents to "clear it up." The most common route from witness to defendant. ☐ Deleting anything. Texts, an old folder, an app, a phone reset before a trade-in — all of it, under 18 U.S.C. § 1519. ☐ Calling colleagues to compare recollections. Corrupt persuasion under 18 U.S.C. § 1512 looks exactly like this from the outside. ☐ Assuming company counsel is your counsel. They said otherwise; people do not hear it. ☐ Guessing in an interview. Four-year-old details recalled confidently and wrongly become false statements. ☐ Letting the implicated department run the internal investigation. The most common structural failure in the field. ☐ Missing the D&O notice period. Coverage denied for late notice, when it was the one thing that would have paid for the defense. ☐ Sitting for a civil deposition without knowing the criminal posture. Testimony given in one forum arrives in the other. ☐ Delaying the self-disclosure decision. Credit erodes rapidly and disappears once the government learns independently. ☐ Treating sentencing as something that starts after a plea. ⭐ The loss calculation is the case, and building the counter-analysis takes months.
Appendix: a two-minute triage
Answer these and the next step is usually obvious.
☐ Has anyone been contacted by an agent, or has any process arrived? If yes, the hold goes out today. ☐ Do I know what the government thinks happened? If a subpoena exists, read the date range and custodians — that is the theory. ☐ Am I a witness, a subject, or a target? ⚠ If nobody has told you, assume the worst posture consistent with the facts. ☐ Is my employer's interest the same as mine? ⭐ It is not, once cooperation credit is in play. ☐ Is anything running? A return date, a policy notice period, a licensing deadline, a civil deposition. ☐ Is anyone still deleting anything, anywhere? Confirm in writing that they are not. ☐ Do I have my own lawyer? If the answer is no and any of the above is yes, that is the next step.
⭐ None of this requires knowing whether anyone did anything wrong. Each step is correct either way — which is precisely the point.