Toolkit · Criminal
The White Collar Investigation Response Toolkit
18 U.S.C. § 1519
- Type
- Toolkit
- Jurisdiction
- National
- Date
- 2024-06-25
- Topic
- Criminal
This toolkit collects the working documents for a federal financial investigation, on both the individual and the organizational side. The immediate items include a search warrant response card, an agent contact script, and a litigation hold memorandum written to be sent the same day. The organizational items include an internal investigation plan, an Upjohn warning script with a documentation record, an insurance notice letter, and a self-disclosure decision memorandum. The response items include a subpoena response log, a scope negotiation letter, and a privilege log template. The individual items include a fee advancement request, a joint defense agreement outline, and a proffer preparation worksheet. The sentencing items include a loss calculation worksheet and a presentence report objection outline. Each is drafted to be adapted, with bracketed fields marking what must be supplied and warnings marking the omissions that convert a survivable problem into a charge.
The White Collar Investigation Response Toolkit
Criminal > White Collar and Financial Crime | Published 25 June 2024 - Updated 1 June 2026 | UpLaw - uplaw.us
⚠ These are drafting aids, not legal advice, and none of them substitutes for experienced federal criminal counsel. The single most important item in this toolkit is Tool 3, and it should be sent before anything else is considered.
Tool 1 — Search warrant response card
Print this. Keep a copy at reception and one at home.
IF AGENTS ARRIVE WITH A WARRANT
1. Ask to see the warrant. Read the premises, the items, and the date. Request a copy; photograph it if refused. 2. Do not obstruct. Do not consent to anything beyond the warrant. Say: "I am not consenting to any search beyond this warrant." 3. Say: "I am not going to answer questions without my attorney present." ⚠ This applies to every employee. 4. Ask: "Am I free to leave?" If yes, leave and call counsel. 5. Call counsel while it is happening. 6. Note agent names, agencies, arrival and departure times. 7. Have someone observe and take notes if permitted. 8. Identify privileged materials to counsel immediately; request a filter or taint team. 9. Obtain the inventory of items seized before agents leave. 10. ⚠ Delete nothing. Reset nothing. Do not "clean up" anything. 18 U.S.C. § 1519.
Tool 2 — Agent contact script
"I am not going to answer any questions without my attorney present. Please leave me your card and my attorney will contact you. I am not consenting to a search."
☐ Repeat if pressed. ⚠ No explanation is owed, and declining is not evidence of anything. ☐ Do not answer "just background" questions. ⚠ 18 U.S.C. § 1001 applies to unsworn, informal statements, and agents may lawfully mislead you about what they know. ☐ Do not call back later to "clarify" — a correction can be charged as a second false statement. ☐ ⚠ Do not contact colleagues to compare recollections — 18 U.S.C. § 1512. ☐ Immediately afterward, write privately for counsel: who came, agency, time, what was asked, what you said, what they took.
Tool 3 — Litigation hold memorandum
PRIVILEGED AND CONFIDENTIAL — LEGAL HOLD
To: [custodians] · From: [counsel] · Date: [ ] · Time: [ ]
Re: Preservation obligation — [matter]
[Organization] has received [a grand jury subpoena / a civil investigative demand / notice of an investigation] concerning [subject]. Preserve all documents and data relating to [subject], effective immediately.
Preserve: email and attachments; instant messages and chat, including ephemeral and disappearing-message applications; text messages on company and personal devices used for work; voicemail; calendars; handwritten notes and drafts; contracts and correspondence; invoices, ledgers, and financial records; databases, reports, and exports; photographs and video; and all backup media.
Do not: delete, alter, overwrite, archive, or reorganize anything covered; disable, reset, wipe, or trade in any device; enable auto-deletion for work communications; or discuss this notice outside the recipients listed.
⚠ All automatic deletion and retention policies are suspended as to these materials as of today. IT will confirm implementation in writing.
⚠ Altering or destroying records with intent to impede a federal matter — including one merely contemplated — is a federal crime. 18 U.S.C. § 1519. Persuading another person to do so is a separate crime. 18 U.S.C. § 1512.
Route all contact from investigators to [counsel]. Do not discuss the matter with colleagues.
Acknowledge receipt by [date].
☐ ⭐ Send this on day one. It is the only step that becomes irreversibly worse with every hour of delay. ☐ Track acknowledgments; follow up on non-responses in writing. ☐ ⚠ Obtain written confirmation from IT, with a timestamp, that auto-deletion is suspended. ☐ Reissue periodically and on personnel changes.
Tool 4 — Upjohn warning script and record
"Before we begin: I represent [Company], not you personally. This conversation is protected by the attorney-client privilege, but the privilege belongs to the Company. The Company alone decides whether to waive it, and the Company may choose to disclose what you tell me — including to the government. You may wish to consult your own attorney. Do you understand?"
Documentation record:
| Field | Entry |
|---|---|
| Interviewee | |
| Date and time | |
| Counsel present | |
| ⭐ Warning given verbatim | ☐ |
| Interviewee confirmed understanding | ☐ |
| Advised of the right to separate counsel | ☐ |
| Interviewee asked about personal counsel | ☐ |
| Interviewee asked about fee advancement | ☐ |
| Interview memorandum prepared as work product | ☐ |
⚠ The absence of a documented warning is a serious problem later. Upjohn Co. v. United States, 449 U.S. 383, establishes that the corporate privilege reaches employee communications about matters within their duties — ⭐ and that the privilege belongs to the corporation.
☐ Do not promise confidentiality that cannot be delivered. ☐ ⚠ Do not tell an employee they do not need a lawyer.
Tool 5 — Subpoena response log
| Field | Entry |
|---|---|
| Issuing authority (grand jury / agency / CID under 31 U.S.C. § 3733 / 15 U.S.C. § 78u) | |
| Date received; ⚠ return date | |
| Extension requested / granted | |
| ⭐ Date range demanded | |
| ⭐ Custodians named | |
| ⭐ Transactions or entities named | |
| Theory inferred from the above | |
| Litigation hold issued (date, time) | |
| IT auto-deletion suspension confirmed in writing | ☐ |
| Custodian list (including departed employees) | |
| Systems in scope (email, chat, drives, ERP, backups, personal devices) | |
| Scope negotiated (date ranges, custodians, search terms) | |
| Collection method documented | ☐ |
| Privilege review completed | ☐ |
| Privilege log produced | ☐ |
| Bates ranges produced, by date | |
| Parallel exposure assessed (qui tam under 31 U.S.C. § 3730; civil; regulatory; licensing) | ☐ |
⭐ The three shaded rows are the point. A subpoena's date range, custodians, and named transactions disclose what the government thinks happened — usually more clearly than anything else you will receive for months.
Tool 6 — Scope negotiation letter
[Date] — [Assistant United States Attorney / agency counsel]
Re: Subpoena to [entity] dated [ ] — response and request to narrow
[Entity] is committed to a complete and timely response. A litigation hold issued on [date] and automatic deletion has been suspended across all systems.
To produce responsive material efficiently, we propose the following:
1. Custodians. The subpoena does not identify custodians. We propose [names/roles], who held responsibility for [functions] during the relevant period. Please advise if additional custodians are required.
2. Date range. We propose [dates], which encompasses [explain]. Material outside that range appears unrelated to the matters identified.
3. Search terms. We propose the attached list, developed with [vendor], and will report hit counts before review.
4. Format. We propose production in [format] with load files and Bates numbering.
5. Schedule. We request an extension to [date] to permit defensible collection and privilege review, and propose rolling productions beginning [date].
6. Privilege. We will produce a privilege log for withheld materials and propose a non-waiver arrangement for inadvertent production.
[Counsel, contact]
☐ ⭐ Prosecutors routinely narrow scope. Ask. ☐ Propose rolling production; it buys time and demonstrates good faith. ☐ Confirm every agreement in writing the same day.
Tool 7 — Privilege log template
| # | Bates / control | Date | Author | Recipients | CC/BCC | Type | Subject (non-privileged description) | Basis | Withheld / redacted |
|---|---|---|---|---|---|---|---|---|---|
| ☐ AC ☐ WP ☐ Both | ☐ W ☐ R |
☐ Identify every author and recipient, with roles, so the privileged relationship is apparent. ☐ ⚠ Note whether any non-legal third party received the communication — that is where privilege claims fail. ☐ Distinguish fact work product from opinion work product. ☐ Describe the subject without disclosing the advice. ☐ ⚠ Never withhold silently. An unlogged withholding is treated as a waiver in many courts.
Tool 8 — Fee advancement request
[Date] — [General Counsel / Corporate Secretary], [Company]
Re: Request for advancement of legal fees — [matter]
I have been [asked to sit for an interview / served with a subpoena / contacted by federal agents] in connection with [matter], arising out of conduct within the scope of my duties as [title].
I am retaining personal counsel. Under [Article [ ] of the Bylaws / the Indemnification Agreement dated [ ] / the Company's D&O policy], I request that the Company advance my reasonable legal fees and expenses.
I confirm that I will provide the undertaking to repay required by [provision] if it is ultimately determined that I am not entitled to indemnification.
Please respond in writing by [date], identifying any conditions the Company intends to impose and confirming that notice has been given to the D&O carrier.
[Name, title, contact]
☐ ⚠ Ask early. Advancement can be conditioned or withdrawn, and the conditions matter. ☐ ⚠ Confirm that the company has given timely notice to the D&O carrier — late notice is one of the most common ways coverage is lost. ☐ Understand that accepting advancement does not make company counsel your counsel.
Tool 9 — Insurance notice letter
[Date] — [Carrier], Claims Department — sent by email and certified mail
Re: Notice of claim / circumstance — Policy No. [ ], Policy Period [ ]
Pursuant to the notice provisions of the above policy, [Company] gives notice of the following.
1. Matter. On [date], [Company] received [a grand jury subpoena / a civil investigative demand / notice of an investigation] from [authority] concerning [subject].
2. Insureds potentially affected. [Company] and the following individuals: [names/roles].
3. Status. [Company] issued a litigation hold on [date] and has retained [counsel]. No charges have been filed.
4. Coverage requested. Defense costs for the Company and for the individual insureds, and advancement under [provision].
5. Consent. [Company] requests consent to the retention of [counsel] at the rates stated in the enclosed engagement letter.
Enclosed: the subpoena or notice; the engagement letter; the litigation hold.
[Counsel, contact]
☐ ⚠ Calendar the policy notice period the day the matter arises. Late notice defeats coverage more often than any substantive exclusion. ☐ Give notice of a circumstance even where no claim has been made, if the policy permits it. ☐ Obtain written consent to counsel selection and rates before incurring significant fees.
Tool 10 — Internal investigation plan
| Element | Entry |
|---|---|
| ⭐ Litigation hold issued (date, time) | ☐ |
| IT suspension confirmed in writing | ☐ |
| Client identified (Board / committee / Company) | |
| Counsel: in-house or outside; conflicts cleared | |
| Scope, in writing | |
| Reporting line | |
| Custodians and systems | |
| Interview list and sequence (⭐ least involved first) | |
| Upjohn warnings scripted and logged | ☐ |
| Employees advised of the right to separate counsel | ☐ |
| ⚠ Implicated persons excluded from conducting or overseeing the investigation | ☐ |
| Privilege plan: written report or oral briefing; recipients | |
| ⚠ Waiver analysis for any disclosure to the government | |
| Remediation track, separate from the investigation | |
| Regulatory reporting obligations and deadlines | |
| Insurance notices given | ☐ |
| Document retention plan for the investigation file |
⭐ The most common structural failure in this field is an investigation conducted or supervised by the people whose conduct is at issue. It converts a manageable problem into an obstruction problem.
Tool 11 — Self-disclosure decision memorandum
PRIVILEGED — [Company] — Self-Disclosure Analysis
1. Conduct. [What happened, when, by whom, over what period, in what amount.]
2. Statutes implicated. [E.g., 18 U.S.C. § 1341, 18 U.S.C. § 1343, 18 U.S.C. § 1344, 18 U.S.C. § 1347, 18 U.S.C. § 1348, 18 U.S.C. § 371, 18 U.S.C. § 1349; downstream 18 U.S.C. § 1956 and 18 U.S.C. § 1957; false statements at 18 U.S.C. § 1001; civil exposure at 31 U.S.C. § 3729.]
3. Theory viability. [Test against Skilling, 561 U.S. 358; McDonnell, 579 U.S. 550; Kelly, 590 U.S. 391; Ciminelli, 598 U.S. 306; Percoco, 598 U.S. 319; Sun-Diamond Growers, 526 U.S. 398; McNally, 483 U.S. 350. Scienter under Schutte, 598 U.S. 739.]
4. Likelihood of independent discovery. [Whistleblower? Sealed qui tam under 31 U.S.C. § 3730? Regulatory examination? Bank reporting under 31 U.S.C. § 5318?]
5. Limitations. [Five years under 18 U.S.C. § 3282; ten if a financial institution is affected — 18 U.S.C. § 3293.]
6. Credit factors. [Voluntariness; timeliness; completeness; cooperation including individual facts; compliance program then and now; remediation; discipline; restitution.]
7. ⚠ Cost of cooperation. [Cooperation credit generally requires providing facts about individuals — the point at which corporate and individual interests separate.]
8. Collateral consequences. [Suspension and debarment under 48 C.F.R. part 9; industry bars; licensing; program exclusion; contract terminations.]
9. Privilege consequences. [⚠ Disclosure generally waives privilege as to the subject matter.]
10. Recommendation and timing. [⭐ Credit erodes rapidly once the government learns independently.]
Tool 12 — Joint defense agreement outline
☐ Parties, and each party's counsel. ☐ Common interest stated with specificity — the matter, not "all matters." ☐ Shared materials defined: oral communications, documents, work product, and analyses. ☐ Confidentiality, with no disclosure to third parties without consent. ☐ Use restriction: shared material may be used only for the common defense. ☐ ⭐ Divergence provision — what happens when interests conflict, including whether shared information may be used adversely, and the answer should be no. ☐ Withdrawal procedure, with continuing obligations surviving withdrawal. ☐ No waiver of any privilege by sharing. ☐ Return or destruction of materials on termination. ☐ ⚠ No party controls another's decisions — cooperation, plea, or settlement remain each party's own. ☐ Execute before anything is shared.
Tool 13 — Proffer preparation worksheet
| Question | Entry |
|---|---|
| Attorney proffer attempted first? | ⭐ ☐ |
| Written agreement reviewed; ⚠ derivative use permitted? | ☐ |
| ⚠ Impeachment and rebuttal use permitted? | ☐ |
| What the client will admit | |
| What the client does not know | |
| Documents reviewed in preparation | |
| Chronology reconstructed and verified against documents | ☐ |
| Areas where memory is genuinely uncertain | |
| Others whose conduct will be described | |
| ⭐ Cooperator sequence — who has already proffered? | |
| Realistic value of cooperation at this stage | |
| Personal and professional consequences assessed | ☐ |
| Client understands ⚠ one falsehood voids everything | ☐ |
⚠ Never proffer without counsel experienced in federal practice. A proffer constrains the later defense significantly, and incomplete truthfulness creates new exposure under 18 U.S.C. § 1001, 18 U.S.C. § 1621, and 18 U.S.C. § 1623.
Tool 14 — Loss calculation worksheet
⭐ In economic crime, this single computation drives the sentence more than every offender characteristic combined.
| Line | Government | Defense | Basis |
|---|---|---|---|
| Gross transaction volume | |||
| Portion alleged to be fraudulent | |||
| Actual loss | |||
| Intended loss, and realistic achievability | |||
| Gain used as a proxy (only if loss is indeterminable) | |||
| ⭐ Credit: amounts repaid before detection | |||
| ⭐ Credit: value of services actually delivered | |||
| Credit: collateral value | |||
| Losses attributable to market or intervening causes | |||
| Relevant conduct — scope of jointly undertaken activity | |||
| Net loss | |||
| Number of victims; substantial financial hardship | |||
| Sophisticated means | |||
| Role in the offense | |||
| Abuse of a position of trust | |||
| Obstruction |
☐ Statutory framework: 18 U.S.C. § 3553, 18 U.S.C. § 3551, 18 U.S.C. § 3559, 18 U.S.C. § 3571; Commission authority at 28 U.S.C. § 991 and 28 U.S.C. § 994; appellate review at 18 U.S.C. § 3742. ☐ Address forfeiture — 18 U.S.C. § 981, 18 U.S.C. § 982 — and pre-trial restraint impairing counsel of choice. ☐ ⚠ Restitution is joint and several and is not dischargeable in bankruptcy — compare consumer bankruptcy.
Tool 15 — Presentence report objection outline
OBJECTIONS TO THE PRESENTENCE INVESTIGATION REPORT
1. Loss (¶ [ ]). The report adopts the government's figure of $[ ]. The correct figure is $[ ] because [credits, delivered value, causation, relevant conduct scope]. This changes the offense level by [ ].
2. Number of victims (¶ [ ]). [ ]
3. Sophisticated means (¶ [ ]). [Ordinary business processes are not sophisticated means.]
4. Role (¶ [ ]). [Mitigating role relative to co-participants.]
5. Abuse of trust (¶ [ ]). [ ]
6. Obstruction (¶ [ ]). [ ]
7. Acceptance of responsibility (¶ [ ]). [ ]
8. Factual corrections (¶¶ [ ]). [Each error, with the record citation.]
9. 18 U.S.C. § 3553 considerations. [History and characteristics; restitution paid; collateral consequences already suffered — licensing, debarment, employment; disparity with co-participants; supervised release conditions under 18 U.S.C. § 3583; probation terms under 18 U.S.C. § 3561 and 18 U.S.C. § 3563.]
☐ ⚠ File within the local rule's deadline. An unchallenged loss figure becomes the sentence. ☐ Support every objection with a document or a record citation. ☐ Prepare collateral consequence evidence — criminal record relief, petitioning to expunge or seal a criminal record, the sentence after the sentence, and professional licensing and occupational discipline.
Tool 16 — Routing table
Closing card
⭐ Three documents matter most, in this order: the litigation hold sent on day one, the documented Upjohn warning, and the loss counter-analysis. The first prevents a charge, the second preserves the privilege, and the third determines the sentence.
⚠ Three sentences prevent most disasters. "I am not going to answer questions without my attorney." "Do you represent me?" "Suspend all automatic deletion, effective immediately, and confirm in writing."
⭐ One asymmetry to keep in mind throughout: the government's fraud theories are vulnerable and its process charges are not. Which is why what happens after the investigation starts matters more than what happened before it.