PanicStation.org
UK USA
us Legal, police, prison & official contact

What to do if…
you are contacted by a regulator about possible violations and are unsure how to respond

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause before giving a substantive reply. Preserve potentially relevant records, note every stated deadline, independently verify the contact, and seek prompt advice from a qualified US attorney.

Do not do these things

  • Do not ignore the contact or assume that an informal tone means there is no deadline.
  • Do not delete, alter, backdate, rename, conceal, or tidy up potentially relevant records.
  • Do not click links, send information, or use contact details supplied only in an unexpected message before independently checking that the contact is genuine.
  • Do not send a detailed explanation, guess at answers, or agree to an interview on the spot.
  • Do not circulate the matter widely or speculate about it in internal messages.
  • Do not ask anyone to align accounts or tell them what to say.
  • Do not obstruct or argue on the spot. Do not assume that you should consent to or refuse a request without advice.

What to do now

  1. Save the complete contact and note the time.
    Keep the letter, email, envelope, attachment, voicemail, or business card. Note when it arrived, the sender’s name, the agency, any reference number, any requested action, and every stated deadline.

  2. Verify unexpected contact independently.
    Find the agency’s official website or use the USAGov agency directory. Use a phone number or contact route from that official source, not only the number, link, or email address in the message. Ask whether the named person, office, and reference number are genuine.

  3. Note what kind of request it appears to be.
    Look for words such as voluntary request, subpoena, civil investigative demand, notice of violation, interview request, inspection, or warrant. Do not try to decide the legal effect yourself. Show the complete document to a qualified US attorney promptly.

  4. Protect potentially relevant records.
    Until you get advice, do not delete or change potentially relevant records. Where feasible, ask IT or the person who manages records to pause routine deletion of clearly relevant emails, messages, files, logs, and data on devices without editing, reorganizing, or creating replacement versions.

  5. Route the matter to one responsible person.
    Contact in-house counsel or your usual lawyer promptly. If you do not have one, seek a qualified US attorney with experience in the relevant regulatory area. The American Bar Association’s Find Legal Help page can point you to lawyer-referral and licensing resources. Give your attorney the complete contact, the date received, the stated deadlines, and a short note of where relevant records may be stored.

  6. Avoid silence without improvising.
    Ask your attorney what response is appropriate. A brief receipt acknowledgment may be suitable in some situations, but avoid admissions, detailed explanations, or promises about scope, timing, or document production until you have advice. If more time may be needed, ask about requesting written confirmation of any agreed extension.

  7. Treat FTC compulsory process as time-sensitive.
    If the document is an FTC CID, subpoena, or other FTC compulsory process, note every date in the document and contact counsel promptly. Current FTC rules include an early meet-and-confer process. Follow the document and get advice about any questions concerning scope, format, timing, or preservation.

  8. If someone arrives in person, stay calm and record the basics.
    Ask for identification, the agency name, the purpose of the visit, and a copy of any written authority. Contact counsel promptly. Do not obstruct. Keep a simple written log of who attended, what was requested, and what was taken or copied.

  9. Give staff a narrow routing instruction.
    Calmly tell relevant staff to protect potentially relevant records and forward any regulator contact to the designated person. Ask them not to delete records, speculate, or respond independently.

What can wait

  • You do not need to explain the whole situation immediately.
  • You do not need to decide fault, blame, disciplinary action, or a public statement in the first hours.
  • You do not need to reorganize records before advice.
  • Insurance notice questions and longer-term response planning can usually wait briefly while you protect records, note deadlines, verify the contact, and reach counsel.

Important reassurance

A regulator’s contact is not the same as a finding. A request may be information-gathering, and the recipient may not be accused of wrongdoing. Protecting records, narrowing communications, and getting advice promptly can stabilize the situation and buy time.

Scope note

These are first steps only. Later decisions may need specialist legal help based on the agency, the document, the deadline, and whether the request is voluntary or compulsory.

Important note

This is general information, not legal, medical, financial, therapeutic, or other professional advice. US federal, state, and local regulators may use different processes. A qualified US attorney can advise on the specific contact you received.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us