This guide is general legal information, not legal advice, and does not create an attorney–client relationship. Rules change and vary by state — verify current requirements with official sources or a licensed attorney.
White-collar cases rarely begin with handcuffs. They begin with paper — a subpoena served on a company's registered agent, a preservation letter, a call from an agent to an employee at home, or a regulator's request for documents that turns out to have a criminal investigation behind it. Months or years can pass between that first signal and any charging decision, and much of what determines the outcome happens in that interval, before a courtroom is involved at all.
That is why the early handling of a white-collar matter is disproportionately important. Evidence is created or destroyed, statements are made that later become their own offense, and the government forms a view about whether it is looking at a mistake, a rogue employee, or an organized scheme.
Most large white-collar matters are federal, brought under federal statutes and investigated by federal agencies, and the discussion below reflects the federal model. States prosecute white-collar conduct too — securities fraud, insurance fraud, contractor fraud, tax offenses, embezzlement — under their own statutes and grand jury systems, with the same basic architecture but different procedural rules.
Key takeaways
- A grand jury subpoena is a court-backed command, not a request; the obligation to preserve responsive material begins the moment it arrives.
- Lying to a federal agent is a separate federal crime, which is why voluntary interviews carry risk out of proportion to their apparent informality.
- The Justice Department distinguishes among witnesses, subjects, and targets, and status can shift during an investigation.
- Criminal, civil, regulatory, and administrative proceedings routinely run in parallel, and DOJ policy expressly contemplates coordination between them.
- Company counsel represents the company, not the employee — a distinction employees are entitled to be told about and often misunderstand.
How investigations start and who runs them
Referrals arrive from many directions: whistleblowers and qui tam relators, regulators such as securities, banking, and health agencies, auditors, competitors, disgruntled former employees, suspicious activity reports filed by financial institutions, and data analytics that flag anomalous billing or trading patterns.
On the federal side, prosecution is handled by U.S. Attorneys' offices and by the litigating sections of the Justice Department's Criminal Division, which houses specialized units covering fraud, public integrity, money laundering, and computer crime, working with investigative agencies including the FBI and agency inspectors general. Statutes commonly charged include mail and wire fraud, bank and securities fraud, false statements, money laundering, obstruction, and conspiracy — with conspiracy and obstruction appearing so often that they deserve their own line in any risk assessment.
The government's toolkit
| Instrument | Who issues it | Practical effect |
|---|---|---|
| Grand jury subpoena for documents | Grand jury, through the prosecutor | Compels production of described records by a return date; scope can be negotiated with the prosecutor |
| Grand jury subpoena for testimony | Grand jury, through the prosecutor | Compels appearance; counsel may not enter the grand jury room but may wait outside for consultation |
| Search warrant | Judge or magistrate, on probable cause | Authorizes seizure without notice, often used where destruction of evidence is feared |
| Voluntary interview | Investigating agents | No obligation to speak, but any false statement can itself be charged |
| Civil investigative demand or regulatory subpoena | Civil or regulatory authority | Compels documents and sometimes sworn testimony in a non-criminal track |
| Target, subject, or witness notification | Prosecutor | Signals the person's status and, for targets, often an invitation to appear or respond before charging |
The grand jury sits at the center of federal investigations. Its procedures are governed by Rule 6 of the Federal Rules of Criminal Procedure, which imposes secrecy obligations on prosecutors and jurors — but notably not on a witness, who is generally free to discuss their own testimony. Rule 17 governs subpoenas more broadly.
First moves when a subpoena arrives
- Stop routine deletion immediately. Suspend document retention schedules, automated email purges, and device wipes for anything potentially responsive. Deletion after notice is how a document case becomes an obstruction case.
- Issue a written litigation hold. Identify custodians, describe the categories of material, and confirm receipt. Include personal devices and messaging applications used for work.
- Read the return date and the definitions. Scope, date ranges, and custodian lists are frequently negotiable with the prosecutor; the deadline is less so, but extensions are commonly granted on request.
- Log and image, do not sort. Preserve first and cull later, under counsel's direction, so that the collection process is defensible.
- Identify privileged material before production. Attorney-client and work-product claims must be asserted and logged; inadvertent production is fixable but expensive.
- Decide who represents whom. Company counsel, individual counsel, and any joint defense arrangement should be sorted out before interviews begin, not after.
Practical note: Employees interviewed as part of an internal investigation should receive a clear warning — often called an Upjohn or corporate-Miranda warning — that company counsel represents the company, that the conversation is privileged but the privilege belongs to the company, and that the company may waive it and share the interview with the government. Giving that warning properly protects both sides; skipping it creates problems later.
Why the interview is the highest-risk hour
Agents may approach employees anywhere, and there is no obligation to speak with them. The reason lawyers treat these encounters so seriously is narrow and concrete: making a materially false statement to a federal investigator is itself a federal felony, independent of whether the underlying conduct was criminal at all. Memory failures under pressure, guesses offered to be helpful, and confident answers about documents the person has not reviewed in years all create exposure.
Declining an interview until counsel is arranged is lawful and ordinary. So is asking who the agents are, which agency they represent, and how to reach them, then calling back through a lawyer. The same rights that apply after an arrest — silence and counsel — apply during an investigation, as our guide to what happens after an arrest describes in the custodial setting.
Parallel criminal, civil, and regulatory tracks
A single set of facts often generates several proceedings at once: a criminal investigation, a civil enforcement action, a regulatory examination, a debarment or licensing review, and private litigation from shareholders, customers, or competitors. The Justice Manual expressly directs criminal and civil attorneys to coordinate in corporate matters, including planning early for how grand jury material governed by Rule 6(e) may or may not be shared, and noting that evidence obtained outside the grand jury — through administrative subpoenas, warrants, or interviews — may be shared with appropriate safeguards.
The consequences for anyone caught in the middle are practical:
- Testimony compelled in a civil or regulatory proceeding can become evidence in the criminal case, which is why counsel sometimes seeks a stay of the civil matter.
- The Fifth Amendment protects individuals, not corporations, and asserting it in a civil case can support an adverse inference against a party there.
- Settlement in one track does not resolve the others, and language accepting facts in a civil settlement can be used elsewhere.
- Timelines diverge; a regulator may act long before a charging decision is made, or long after.
How white-collar matters end
A substantial share close without charges — through declination, through a decision to proceed only civilly, or simply through inactivity until the statute of limitations runs. Where the government does act against a company, resolutions range from a declination with disgorgement, to a non-prosecution or deferred prosecution agreement with compliance obligations and monitoring, to a guilty plea. Individual resolutions follow the ordinary criminal path, with charge classification driving procedure as described in our comparison of misdemeanors and felonies.
Sentencing in federal white-collar cases is heavily influenced by loss amount, the number of victims, sophistication, and the defendant's role, applied through the guidelines published by the U.S. Sentencing Commission, which also maintains guidance for sentencing organizations and publishes annual data on economic offenses. Restitution is standard, and forfeiture frequently accompanies it — issues that intersect with the rights described in our guide to victim rights in criminal cases. Pretrial release in these cases is usually straightforward but still governed by the framework in our guide to bail and pretrial release.
Frequently asked questions
What is the difference between a witness, a subject, and a target?
A witness has information but is not currently under suspicion. A subject is a person whose conduct falls within the grand jury's investigation. A target is someone the prosecutor believes is substantially linked to the commission of a crime and a putative defendant. Status is a snapshot, not a guarantee, and can change as evidence develops.
Can I refuse to answer a grand jury subpoena?
You must appear. You may assert privileges once there — the Fifth Amendment privilege against self-incrimination as to specific questions, or attorney-client privilege — and counsel can move to quash a subpoena that is unreasonable or improper. Simply ignoring it invites contempt proceedings. Get counsel before the return date.
Should employees hire their own lawyer if the company has counsel?
Often yes, particularly for anyone likely to be interviewed or subpoenaed. Company counsel owes duties to the company, and the company can waive privilege over an employee's interview and share it with the government. Many companies advance fees for separate counsel; whether they do is worth asking early.
How long do these investigations take?
Frequently a year or more, and multi-year investigations are common in complex financial matters. Federal statutes of limitations for many fraud offenses run five years, with longer periods for certain categories such as bank fraud. Long silences are normal and are not reliable evidence that a matter has closed.
Putting it together
If a subpoena, agent visit, or preservation letter has arrived, the sequence that protects the most options is short: preserve everything, say nothing substantive without counsel, sort out who represents whom, and open a professional line of communication with the prosecutor through a lawyer rather than going quiet.
For organizations, the questions the government tends to ask at the end are decided at the beginning — whether the compliance program was real, whether the misconduct was reported promptly, whether the internal investigation was independent, and whether the company cooperated in identifying the individuals responsible. Building the record that answers those questions is the work of the first weeks.
For individuals, the most common avoidable harm comes from an unrepresented conversation intended to clear things up. The safer path is to defer, retain counsel, and let the account be given accurately once. For related material on procedure, charges, and sentencing consequences, see our criminal law guides.
