PanicStation.org
UK USA
uk Legal, police, prison & official contact regulator contact • contacted by a regulator • regulatory investigation • enforcement inquiry • compliance breach allegation • possible violations notice • official investigation letter • regulator email or phone call • information request from regulator • statutory notice received • unannounced inspection • dawn raid • interview request by regulator • unsure how to respond • panic after official letter • preserve documents • preservation notice • do i need a solicitor • corporate investigation • regulatory powers

What to do if…
you are contacted by a regulator about possible violations and you are unsure how to respond

Short answer

Pause, preserve everything, and get legal advice before you say anything substantive. Your safest first move is to acknowledge receipt and ask for the legal basis, scope, and deadline in writing.

Do not do these things

  • Do not ignore it, miss deadlines, or assume “it will go away”.
  • Do not destroy, delete, edit, backdate, “tidy up”, or move records (including chats, emails, files, logs, calendars).
  • Do not give an off-the-cuff explanation on a phone call “to be helpful”.
  • Do not volunteer extra information beyond what is asked for, especially without advice.
  • Do not ask staff to “keep quiet” or pressure them about what to say.
  • Do not “align accounts” or script narratives. (It’s fine to collect facts and locate records; it’s not fine to coordinate what people say.)
  • Do not sign statements, agree to interviews, or hand over devices/documents without checking what power they are using and getting advice.
  • Do not email sensitive details widely inside your organisation; assume internal messages may later be reviewed.

What to do now

  1. Confirm it’s real (without using the contact details in the message).
    Use the regulator’s official website or published switchboard number to call back, quote the reference number, and confirm the case officer/team exists.
  2. Capture the basics immediately (before panic blurs details).
    Save the letter/email, note the date/time received, reference numbers, what they’re asking for, and any stated deadline. If it was a call, write down exactly what was said and by whom.
  3. Stop any deletion or “housekeeping” right now.
    Turn off auto-delete where you can. Don’t delete “duplicates”. If you have IT support, ask for a preservation notice / document hold (internal) so routine retention/destruction pauses for relevant systems, accounts, and devices.
  4. Work out what kind of contact this is (it changes what you do next).
    Look for whether it’s:
    • a voluntary request / informal enquiry,
    • a formal information notice / statutory request,
    • a request to attend an interview, or
    • an unannounced inspection/visit using statutory powers.
      If you can’t tell, treat it as formal until you have advice.
  5. Get the scope and authority in writing.
    Reply briefly: acknowledge receipt; ask what legal power they’re relying on; what period/topics they want; what format they require; and who you should correspond with. If the deadline is tight, ask for an extension early (before it expires) and ask how to confirm any extension in writing.
  6. Get appropriate legal help fast.
    If you have in-house counsel/compliance, tell them. If not, contact a solicitor with regulatory/investigations experience. If you cannot reach anyone immediately, do steps 1–5 and say you are seeking advice.
  7. Choose one point of contact (and keep it controlled).
    Decide who speaks to the regulator. Everyone else should be told (calmly) to forward any regulator contact to that person and not to respond themselves.
  8. If officials arrive in person, shift into “verify powers + log everything”.
    Ask for identification and written authority, and read the scope (what they can access, what they can take/copy, and for what time period). Call your lawyer immediately. Cooperate without obstructing, but don’t volunteer extra material beyond what is required. Keep a written log of what they ask for and what they take/copy.
  9. If they ask for an interview, don’t attend alone.
    Ask whether it’s voluntary or under a legal power, whether you are being interviewed under caution, and what topics/time period it will cover. Arrange legal representation before any interview.
  10. Start a clean, factual timeline for your adviser.
    List relevant events, systems, and people involved; where records are; and anything time-sensitive (deadlines, ongoing risks, safety issues). Keep it factual—no speculation.

What can wait

  • You do not need to decide “the whole strategy” today.
  • You do not need to write a detailed narrative response immediately.
  • You do not need to confront colleagues, terminate staff, or announce anything publicly right now.
  • You do not need to guess what the regulator “really thinks”; focus on scope, preservation, and controlled communication first.

Important reassurance

Being contacted by a regulator can range from routine fact-finding to formal enforcement. Feeling shocked or frozen is normal. If you preserve records, slow down communications, and get the scope clarified in writing, you’ve already prevented the most common irreversible mistakes.

Scope note

This is first-steps guidance to stabilise the situation and avoid self-inflicted damage. Your next steps may depend heavily on which regulator it is, what powers they’re using, and whether this is civil, criminal, or disciplinary.

Important note

This is general information, not legal advice. Regulatory powers, deadlines, and your rights can vary by regulator and situation. If you are unsure, treat the matter as potentially serious, preserve records, and get UK-qualified legal advice promptly.

Additional Resources
Support us