A federal grand jury subpoena shows up in the CFO’s inbox, addressed to the company, asking for three years of emails, wire records, and board decks. The case is already underway.
Nobody kicked in a door. No agent flashed a badge in the lobby. A courier or an email attachment did the work, and now the clock is running on a return date that a prosecutor picked without consulting anyone at the company.
White-collar investigations have changed shape over the past decade. The dramatic raid still happens, but it is the exception. The rule is a document request that lands in an inbox and reorganizes the next six months of a finance team’s life.
Why Did This Arrive as a Subpoena Instead of a Search Warrant?
Prosecutors reach for a subpoena when they think the records will still be there tomorrow. A search warrant requires probable cause and a judge’s signature, and it burns the element of surprise for good. A subpoena requires neither. Rule 17 of the Federal Rules of Criminal Procedure authorizes the government to command the production of books, papers, documents, and data in a criminal case, and the grand jury version of that power is remarkably broad.
Courts have long held that the tight relevance test used for trial subpoenas does not follow the grand jury into its own room. A grand jury can ask for material simply because it might illuminate whether a crime occurred. That is a low bar, and prosecutors know it.
Companies that comply on a rolling basis rarely make the news. A well-drafted subpoena gets the government what it wants without a single camera crew in the parking lot, and it shifts the burden of preservation, review, and production onto the recipient.
Is the Company the Target, or Is Someone in the Room the Target?
This is the first question experienced defense counsel asks, and it rarely has an obvious answer on day one. Federal prosecutors sort the people and entities they encounter into witnesses, subjects, and targets. A subpoena served on the company does not, by itself, tell you which bucket the CFO or the CEO sits in.
Sometimes the subpoena is the whole message. Other times it comes paired with a target letter to an individual, or it arrives before one. Sorting out who is exposed, and to what, is the work that has to happen before a single document goes out the door. Firms that handle white-collar defense matters routinely spend the first week doing exactly this triage, because the answer changes everything about how the company should respond.
If the company is the target, cooperation may unlock leniency. If a specific executive is the target and the company is a witness, the interests can pull apart fast, and separate counsel for the individual usually becomes necessary within days rather than weeks.
What Needs to Happen in the First 72 Hours
The return date on the subpoena creates a false sense of runway. The real deadlines come earlier and draw less attention.
-
Freeze the records. Issue a written litigation hold the same day. Auto-delete rules and routine backup rotations do not pause themselves, and destroying responsive material after service can convert a paper case into an obstruction case.
-
Read the subpoena carefully. Note the return date, the custodian language, the date range, and every defined term. Custodian lists and date ranges are the two levers most often narrowed through negotiation with the prosecutor.
-
Get the right counsel in the room. General corporate counsel alone will not cut it. You want someone who has actually negotiated with the specific U.S. Attorney’s Office involved and understands how that office runs its investigations.
-
Map the privilege. Identify which documents are attorney-client, which are work product, and which sit in the gray zone of communications with in-house lawyers acting in a business capacity.
-
Decide who talks to whom. Employees will hear that something is happening. A calm, lawful, and consistent internal message keeps the company out of an accidental witness-tampering problem.
Should the Company Self-Disclose Before Digging In?
This is the decision that keeps general counsel awake. The Justice Department has spent the last two years pushing hard on the idea that companies get meaningful credit for coming in the door voluntarily. In 2026, it released its first Department-wide corporate enforcement policy for criminal matters, framed around rewarding companies that self-report.
The catch is timing. Self-disclosure only counts if it beats the government to the story. Once a subpoena is in hand, the window has narrowed considerably, though it is not always closed. Rushing a disclosure based on an incomplete internal review can be as damaging as staying silent.
The Case Without a Siren Is Still a Case
A subpoena in an inbox does not feel like a criminal investigation. There is no siren, no perp walk, no press conference. That is precisely why it is dangerous. The absence of drama tempts companies into handling the request as a compliance chore instead of the opening move in a matter that can end in indictments, monitors, or worse.
The response set in the first two weeks tends to shape everything that follows. Prosecutors form early impressions of whether a company is cooperative, whether its counsel is credible, and whether its executives are candid. Handling the paper subpoena with the same seriousness a raid would command is the single most useful instinct a CFO can bring to the moment the email arrives.
