Start With the Document You Received

A securities-fraud investigation can begin with a company inquiry, a regulator’s request, a subpoena, a search warrant, or a charging document. These are different events. The first step is to preserve the actual document and identify the sender, deadline, scope, requested records, and instructions for responding. Avoid treating an informal question as a criminal charge or treating a broad news report as a formal notice.

Preserve Data Before Reviewing the Merits

Relevant information may exist in email, messaging platforms, shared drives, accounting systems, brokerage accounts, trading platforms, mobile devices, calendars, presentations, and paper files. Preserve original records, including available metadata and version history. Do not delete, modify, backdate, or recreate documents after learning of an inquiry.

A collection log can identify the data source, custodian, date range, file type, and person who collected each item. That record is useful when a request later changes or when the facts depend on the timing of a communication or trade.

Map the Timeline and the Participants

For many securities matters, timing is central. A factual timeline may include when information was created, discussed, approved, disclosed, or made public; when trades occurred; and which accounts were involved. The relevant participants may include employees, officers, directors, brokers, consultants, investors, and service providers. The timeline should identify source documents instead of relying only on recollection.

The Department of Justice describes securities-related enforcement work involving, among other areas, insider trading, market manipulation, public-issuer accounting fraud, and disclosure-based fraud. Its unit page provides a general description of those areas.

Keep Regulatory and Criminal Procedures Distinct

A regulator’s examination, a civil enforcement matter, an internal investigation, and a criminal prosecution have different procedures. The same conduct may be discussed in more than one forum, but the applicable documents and standards are not identical. If a federal criminal case is filed, court notices, the charging document, and orders set the next deadlines. The United States Courts explains the general criminal process.

Respond With a Traceable Record

A production should be responsive to the request, complete within its scope, and documented. Confirm the delivery method, keep copies of what was sent, and retain confirmation of receipt. If an item cannot be located, document the systems searched and the result rather than creating a replacement record.

Public filings and court records can also be checked through PACER when a federal case has been filed. Public records may not show every document or explain the evidence in a particular matter, so they should be read with care.

Handle Interviews and Communications Carefully

People who worked on a transaction, filing, or trade may help identify records and ordinary workflows. Questions should seek factual information and locate source material. They should not prompt anyone to revise notes, delete messages, or align a version of events with other participants. Record who provided a document or identified a system so later review can trace the source.

Preserving that distinction helps keep the record complete while the scope of the inquiry is being understood.