When the Subpoena Lands: The First 72 Hours of an SEC Investigation

By Otto K. Hilbert, II

In 36 years of trying cases and defending companies in regulatory investigations, I have watched the same pattern repeat itself. A general counsel calls me on a Thursday afternoon. The Wells notice arrived that morning. The CEO wants to know what to say to the board on Monday. The compliance officer has already drafted a response to the staff. And somewhere in the building, an executive assistant is still searching for the documents that should have been preserved two weeks earlier when the document subpoena first hit.

The Securities and Exchange Commission rarely investigates by surprise anymore. By the time a Wells notice or formal order of investigation lands on a general counsel’s desk, the staff has typically spent months — sometimes years — building its theory of the case. The company’s response in the first seventy-two hours after notification will not determine the outcome of the investigation, but it will materially constrain every strategic option available later. What follows are the decisions I have seen general counsel and boards get right, and the ones I have seen them get expensively wrong.

The Preservation Problem That Most Companies Underestimate

The first thing that happens when a serious investigation lands is also the thing most often mishandled: the litigation hold. By the time the SEC sends formal notice, the company’s preservation obligations have crystallized. Routine document destruction policies must be suspended. Auto-deletion settings in email and messaging platforms must be disabled. Personal devices used for business communications — and yes, that includes the CFO’s iPhone and the head of trading’s WhatsApp — must be brought within the preservation net.

The reason this matters so much is not theoretical. In recent years, the Commission has imposed nine-figure penalties on financial institutions specifically for off-channel communications and recordkeeping failures. When the underlying investigation expands to include preservation failures, the company is no longer defending one case. It is defending two, and the second one is usually easier for the government to win than the first.

I have seen sophisticated companies fumble this step because the litigation hold went to the legal department but never reached the operations team that controls the Slack archive, or because the IT director did not understand that “preserve everything” includes the backup tapes scheduled for rotation the following weekend. The fix is unglamorous: a written preservation memorandum issued within hours of notification, distributed by name to every custodian and every system administrator, with personal acknowledgment required from each recipient. It is the kind of step that looks like overkill on Friday and looks like prescience on Monday.

Privilege Architecture Before the First Interview

The second decision that drives long-term outcomes is the structure of the privilege relationship. In a serious matter, the company will need to conduct an internal investigation. The question is who conducts it, who they report to, and how the work product is protected.

If the investigation is run by in-house counsel, the privilege analysis becomes complicated. The attorney-client privilege protects communications made for the purpose of providing legal advice, but in-house counsel often wear business hats as well as legal hats, and the government will probe that distinction aggressively. The work product doctrine offers some protection, but only for materials prepared in anticipation of litigation, which requires a contemporaneous showing that the company genuinely anticipated litigation when the work was performed.

In matters where the exposure is material — and any matter that has reached the Wells notice stage qualifies — the prudent course is to retain outside counsel to direct the internal investigation, with explicit engagement language confirming that the work is being performed at counsel’s direction for the purpose of providing legal advice. This is not a matter of inflating fees. It is a matter of building privilege architecture that will withstand challenge eighteen months from now when the government argues that the company’s internal interviews were business interviews, not legal interviews, and therefore producible.

The same logic applies to interview memoranda. Upjohn warnings should be standard. The interview notes should reflect counsel’s mental impressions and legal analysis, not verbatim transcripts that may later be characterized as fact work product subject to disclosure on a showing of substantial need.

The Voluntary Disclosure Calculus

Within the first seventy-two hours, general counsel will face pressure to decide whether to make a voluntary disclosure. The pressure may come from the board, from outside auditors who are wrestling with their own disclosure obligations, from the company’s underwriters in advance of an upcoming offering, or from the SEC staff itself, which has become increasingly explicit about the cooperation credit available to early disclosers.

This is the decision I see most often made too quickly. The cooperation framework articulated in the Commission’s Seaboard Report and refined in subsequent enforcement releases does offer meaningful reductions in sanctions for companies that self-report, conduct thorough internal investigations, and remediate misconduct. But cooperation credit is calibrated against the alternative — what the staff would have charged absent cooperation — and that calibration is rarely as favorable as the staff suggests in early conversations.

More importantly, voluntary disclosure to the SEC almost always triggers parallel exposure. The Department of Justice may take an interest. State attorneys general may follow. The plaintiffs’ bar reads the cooperation paragraph in the enforcement release and immediately drafts derivative complaints and securities class actions. A voluntary disclosure decision made for SEC purposes is, in practice, a disclosure decision across every forum where the underlying conduct could matter.

My counsel to general counsel facing this decision is the same one I gave fifteen years ago and the same one I gave last month: do not make the disclosure decision in the first seventy-two hours. Make the preservation decision. Make the privilege decision. Begin the internal investigation. Engage with the staff to understand the scope of their concerns. The disclosure decision can be made on day thirty with vastly better information than on day three.

The Conversations That Quietly Determine Outcomes

There is a set of conversations that happens in the first week of a serious investigation that has more impact on the eventual outcome than most general counsel appreciate. They are not the conversations with the staff. They are the conversations inside the company.

The first conversation is with the board, or with the audit committee if the matter falls within its charter. The board needs to understand the scope of the investigation, the company’s exposure, and the structure of the response. It does not need to make the operational decisions, but it needs to bless the framework. A board that is informed in the first week and consulted thereafter is a board that supports the response. A board that learns about the investigation from a securities analyst’s note three months later is a board that fires the general counsel.

The second conversation is with the executives who are likely to be witnesses. They need to understand that they may have individual exposure separate from the company’s exposure, that the company’s counsel does not represent them individually, and that they may want to consult personal counsel. This conversation is awkward. It is also non-negotiable. The Upjohn warning is not a formality. The executive who later argues that he believed company counsel was representing him personally is the executive whose deposition becomes a problem for the company.

The third conversation is with the auditors, the underwriters, and any other third parties with their own disclosure obligations. These conversations require care because they involve sharing information that may waive privilege or compromise the investigation. They cannot be avoided indefinitely, but they should be staged thoughtfully and conducted under common interest agreements where appropriate.

What the Staff Sees, and What They Do Not

The SEC staff approaches each new investigation with a thesis. They have seen documents, they have interviewed witnesses, and they have formed a preliminary view of what happened and who is responsible. By the time the Wells notice issues, they have spent enough time on the matter to have invested professional capital in their thesis.

The mistake most defense responses make is engaging with the staff’s stated thesis as if it were the whole picture. The staff sees what the staff has been shown. They have not seen the documents that exonerate the executive whose emails they have been reading for six months. They have not interviewed the witnesses who would explain that the transaction the staff finds suspicious was reviewed and approved by three layers of compliance review. They do not know what they do not know.

The defense lawyer’s job in the early weeks is to begin filling those gaps — not by arguing with the staff, but by presenting facts the staff has not seen and witnesses the staff has not heard. This is not advocacy in the trial sense. It is the patient construction of an alternative narrative that the staff will weigh against its initial thesis as the investigation progresses. Done well, this work can persuade the staff to recommend a closing letter or a substantially narrower set of charges. Done poorly — or not at all — it leaves the staff to draft its enforcement recommendation based on the version of events that brought it to the Wells notice in the first place.

The Practical Sequence

Putting this all together, the first seventy-two hours after notification should produce a defined set of actions. The written litigation hold should be issued. Outside counsel should be engaged and the privilege structure documented. The internal investigation should be scoped, with a clear protocol for interviews, document review, and reporting. The board should be informed and the audit committee, if applicable, should be convened. The communications strategy — both internal and external — should be sketched, even if not finalized. And initial contact with the staff should be made by counsel, not by company employees, to establish the channel and signal that the company is taking the matter seriously.

What should not happen in those first seventy-two hours is a substantive response to the staff’s allegations. Substantive responses come later, after the internal investigation has matured and after counsel has had time to test the staff’s thesis against the underlying facts. Early substantive responses are the source of most of the avoidable errors I have seen in three decades of this work — admissions made without full knowledge, characterizations that constrain later positions, and concessions that cannot be walked back.

A Final Observation

Companies that handle the first seventy-two hours well rarely produce dramatic outcomes in the first seventy-two hours. They produce nothing visible at all. The dramatic outcomes come months later — closing letters, narrowed charges, reduced sanctions, preserved reputations — and they come because the foundation was poured correctly in those first three days.

In thirty-six years, I have not seen a serious SEC investigation that ended well in spite of a botched first week. I have seen many that ended well because the first week was handled with discipline. That is the difference this work makes, and it is the standard general counsel should hold themselves and their outside counsel to when the subpoena lands.

—

Otto K. Hilbert, II is a Trial Attorney with AEGIS Law. He brings over 36 years of first-chair trial and appellate experience to representing clients in complex commercial litigation, securities defense, and regulatory enforcement matters. He has tried cases in 23 states and is admitted before the United States Supreme Court and multiple United States Courts of Appeals.

This article is provided for general informational purposes and does not constitute legal advice. Readers facing specific legal matters should consult qualified counsel.