What to do if…
you are contacted by a regulator about your work and you are not sure what to say
Short answer
Don’t answer substantive questions yet. Verify the contact, move everything to writing, and get legal/compliance support (and independent counsel if your interests may differ from your employer’s) before you speak.
Do not do these things
- Don’t improvise answers “off the record” or “just to help”.
- Don’t guess, speculate, or volunteer extra facts beyond what’s asked.
- Don’t click links/open attachments from unexpected messages until you’ve verified the agency independently.
- Don’t delete, alter, backdate, or “clean up” files, messages, or logs once you know a regulator is involved.
- Don’t sign a written statement or timeline on the spot.
- Don’t hand over passwords, personal devices, or private accounts without advice.
- Don’t ignore subpoenas, civil investigative demands, or written deadlines.
- Don’t discuss the situation broadly with coworkers or on social media.
What to do now
- Verify the person and agency. Get their full name, office, agency, and reference/case number. Then independently find the agency’s official contact (a .gov site for federal agencies, or an official state regulator site) and confirm the contact is legitimate.
- Ask for the request in writing and slow the pace. Say: “I want to respond accurately. Please send the questions/request, the authority for it, and the deadline in writing. I’ll reply after checking records.”
- Notify the right internal team immediately (if you’re employed). Inform your manager and your employer’s legal/compliance function and forward the exact message. Ask whether a document preservation (“legal hold”) notice should be issued.
- Decide whether you need your own lawyer. Company counsel often represents the company first. If you think you could be personally blamed, disciplined, face licensing consequences, or be treated as a target, consider independent counsel before any interview, testimony, or signed statement.
- Preserve records immediately. Don’t delete emails, chats, drafts, notes, or files. If systems auto-delete, alert IT/legal so retention can be paused. Keep a simple list of where relevant records are (systems, folders, devices).
- Clarify what kind of contact this is. In writing, ask whether they are requesting:
- voluntary questions,
- an interview,
- documents, or
- formal testimony under subpoena (or similar compulsory process).
- If you receive a subpoena or formal demand, treat it as deadline-driven and run it through counsel. Calendar the due date, send it to counsel/compliance, and don’t ignore it. Ask counsel about scope and privilege. Keep copies of what you produce and a record of what was sent and when.
- If you’re asked for testimony or an interview, request counsel and a scheduled time. Don’t do it immediately. If the matter involves an agency like the SEC, you have the right to be accompanied and advised by counsel—use that time to prepare and avoid mistakes.
- If investigators show up at the workplace, route them properly. Ask reception/management to involve legal/compliance. Keep the interaction professional, and write down names, what was requested, and what (if anything) was taken or copied.
- Use a safe holding line if pressured. For example: “I’m not refusing. I’m trying to avoid mistakes. I need to review records and speak with counsel/compliance before answering.”
What can wait
- You do not need to “tell your whole side” today.
- You do not need to decide blame, resign, or confront coworkers immediately.
- You do not need to respond to every informal question in real time.
- You do not need to provide extra materials beyond what is properly requested.
Important reassurance
Regulators contact people as witnesses and information sources all the time. Verifying identity, moving to writing, and speaking with counsel/compliance before answering is a normal protective step—not an admission of wrongdoing.
Scope note
These are first steps only, focused on preventing irreversible mistakes and buying time. Next steps depend on the specific agency, whether this is voluntary outreach or compulsory process, and whether you are a witness or a target.
Important note
This is general information, not legal advice. If you receive a subpoena (or similar compulsory demand) or think you may have personal exposure, consider speaking with a qualified attorney promptly.