Basic Anatomy of Enforcement Investigations in the United States

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

The regulatory regime

US federal securities laws and the Securities and Exchange Commission

The US federal securities laws and regulations form one of the most complex regulatory regimes in the United States. There are four primary statutes at issue in investigations conducted by the Securities and Exchange Commission (SEC), the principal regulatory and law enforcement authority responsible for investigating and prosecuting violations of the federal securities laws: the Securities Act of 1933 (the Securities Act); the Securities Exchange Act of 1934 (the Exchange Act); the Investment Company Act of 1940; and the Investment Advisers Act of 1940 (the Advisers Act).

The Securities Act and the regulations promulgated under it were designed to create transparency in public company financial statements and disclosures to enable investors to make informed decisions about investments, and to establish laws against misrepresentations and fraudulent activities in the securities markets and prevent fraud in the issuance of securities. Key provisions of the Securities Act require securities issuers to register non-exempt securities with the SEC, submit a prospectus to prospective investors and make additional information available to the public. Generally, the Securities Act requires an issuer to disclose information about the issuer and the offered securities that would help investors form a reasoned opinion about the investment.

The Exchange Act and the regulations promulgated under it primarily regulate securities transactions in the secondary market, with a purpose similar to that of the Securities Act – to ensure greater transparency, protect investors, and prevent fraud and manipulation in connection with trading securities after they are issued. All companies listed on US stock exchanges must follow the requirements of the Exchange Act, but trading in any securities is subject to the Exchange Act’s prohibition on securities fraud. Key provisions of the Exchange Act applicable to public companies address periodic and other disclosures to investors in annual, quarterly and other reports; maintenance of internal controls and accurate books and records; selective communications with investors; foreign corruption; insider trading and other forms of securities fraud; and issues related to whistleblowers. Other important provisions address registration requirements for market participants such as broker-dealers, and regulation of stock exchanges.

The Investment Company Act and the regulations under it require investment companies to register with the SEC prior to offering securities to the public market and to disclose their financial condition and investment policies to investors when investment products are initially sold and, subsequently, on a regular basis. Key provisions of the Investment Company Act address requirements for filings, service charges, financial disclosures and the fiduciary duties of investment companies, the specific requirements of which vary based on the type of investment company and the specific product offering.

The Advisers Act and the regulations under it provide the legal groundwork for monitoring those who advise investment companies, pension funds, individuals and institutions on matters of investing. It requires investment advisers with a certain amount of assets under management – currently US$100 million – to register with the SEC and conform to regulations designed to protect investors, including the exercise of fiduciary duties in acting on behalf of investors.

Broker-dealers are regulated not only by the SEC but by the Financial Industry Regulatory Authority (FINRA), a non-profit organisation or ‘self-regulatory organisation’ (SRO), which, along with the national stock exchanges, is authorised by the SEC to set and enforce rules and regulations on trading securities. FINRA oversees securities firms and their brokers and administers the qualifying exams that securities professionals must pass to sell securities. In its enforcement capacity, FINRA has the power to take disciplinary action against registered individuals or firms that violate FINRA rules.

The SEC comprises five commissioners, each of whom is nominated by the President of the United States and confirmed by the Senate. To reinforce the intended independence of the agency, the Exchange Act requires that no more than three commissioners be from the same political party. The lawyers, accountants, economists and other experts who conduct investigations and litigate enforcement actions are referred to as the Commission’s ‘staff’. While the staff carries out the SEC’s day-to-day enforcement operations, the Commission’s authority is required for certain actions by the staff, such as filing an enforcement action.

Within the staff, there are five major divisions: corporation finance, enforcement, investment management, trading and markets, and economic and risk analysis. The Enforcement Division has more than 1,000 staff attorneys in offices around the country responsible for conducting investigations into potential violations of the federal securities laws and prosecuting such violations. Enforcement also has specialised units that focus on specific and complex areas of securities laws, such as the Foreign Corrupt Practices Act Unit, the Cyber Unit, the Asset Management Unit and the Market Abuse Unit. Enforcement actions can be brought as administrative actions before one of the Executive Branch administrative law judges or in US federal district courts. The SEC enforces violations of federal securities laws through civil remedies such as monetary penalties, disgorgement and injunctions. It also has the ability to bar an individual from serving as a public company officer or director and restrict accountants and lawyers from appearing and practising before the SEC.

Importantly, as discussed further below, within the Enforcement Division is the Office of the Whistleblower, which was set up in 2011 by the Dodd–Frank Wall Street Reform and Consumer Protection Act of 2010 (the Dodd–Frank Act), which was enacted following the financial crisis of 2008 and the Lehman Brothers bankruptcy. The Act set up an incentive programme (including monetary rewards) for members of the public to provide the SEC with information that leads to successful enforcement proceedings. This Office is an important element of the Enforcement Division because of the number of cases it generates and the incentives that it offers to those willing to provide information on potential violations of the federal securities laws.

The US Department of Justice (DOJ) can also bring criminal actions for particularly serious securities law violations. In practice, where a securities law violation raises both criminal and civil exposure, the DOJ and the SEC often conduct their investigations in parallel and bring their respective actions at the same time.

Jurisdictional reach

The SEC’s Enforcement Program has increasingly involved multinational actors, which include foreign companies that may have committed securities law violations in the United States, as well as US companies and their officers that may have engaged in securities law violations abroad but these violations have had an impact in the United States. Through Section 21(a) of the Exchange Act,[2] the SEC has broad power to ‘make such investigations as it deems necessary to determine whether any person has violated, is violating, or is about to violate’ the federal securities laws. However, the SEC’s subpoena powers to command testimony of witnesses and production of documents is limited to ‘any place in the United States or any State’; thus, outside the United States, the SEC has no direct ability to compel production of evidence by subpoena.[3] As a practical matter, however, the Enforcement Division regularly coordinates with its counterparts overseas through mutual lateral assistance treaties or memoranda of understanding to collaborate on evidence collection outside the SEC’s jurisdiction. The SEC’s investigation of multinational matters often involves complex issues of jurisdiction, privilege, privacy and coordination with international securities regulators and law enforcement agencies.

Evidence in SEC investigations

Once an SEC investigation begins, it may take the form of an ‘informal’ investigation or a ‘formal’ investigation. Informal investigations are initiated by the Enforcement Division in an attempt to obtain voluntary cooperation from a party; such investigations do not carry subpoena power to compel testimony or production of documents. It is only upon the issuance of a formal order of investigation that subpoenas may be issued. Pursuant to 17 CFR Section 202.5(a), the Commission may issue a formal order to determine whether any person has violated, is violating or is about to violate any provision of the federal securities laws or the rules of an SRO (such as FINRA). The formal order of investigation authorises the initiation of the investigation and delegates broad fact-finding and investigative authority to the SEC staff.


The SEC staff uses various mechanisms for obtaining witness statements, primarily including voluntary interviews, voluntary on-the-record testimony and testimony under oath pursuant to subpoena. Interviews and testimony often are crucial components in an SEC investigation, both for the staff and the responding party. The staff relies on witness testimony to build cases and to ascertain the scope and breadth of its investigation. For the responding party, interviews and testimony are important opportunities to educate the staff, provide context for certain documents and address the staff’s concerns.

If the staff asks for a voluntary interview, there are no direct sanctions that can be imposed upon a witness for refusing to appear for the interview, for refusing to provide certain information during the voluntary interview or for terminating the interview once it has started. There are, however, several reasons as to why a witness might agree to submit voluntarily to an interview. For example, it may be clear that the witness is not the target of the investigation and the witness may want to facilitate the investigation against others. A refusal to submit for voluntary testimony may indicate lack of cooperation or suggest the witness is concerned about his or her role in the matter under investigation. Moreover, the staff’s broad subpoena powers mean that refusal to provide voluntary testimony may lead to the issuance of a subpoena, and some entities and individuals prefer government investigations to proceed on a voluntary basis. A witness who is willing to provide a voluntary interview may request a subpoena if, for example, the witness is under a legal duty not to disclose certain information unless compelled to do so. In all instances, a witness will be provided the opportunity to engage counsel and for counsel to participate in the interview, upon request.

Once the staff issues an investigative subpoena for testimony, failing to respond to or appear as directed by the subpoena will likely cause the SEC to seek to enforce the subpoena. Section 21(c) of the Exchange Act provides that, in the case of a refusal to obey a subpoena, the SEC may invoke the aid of a federal district court.[4] Section 21(c) further provides that failure to comply with such order may be punished by an order of contempt, a fine of up to US$1,000 or imprisonment up to one year, or a combination of these.[5] As discussed below, the SEC cannot compel a witness who is located outside the United States to appear for testimony, but the SEC Enforcement Manual provides several mechanisms through which questioning may nevertheless be conducted.

Preparation for SEC testimony is very important. The staff’s perception of a witness is often a key factor in its assessment of whether to institute a proceeding and what charges to pursue, against which individuals and entities, and senior staff members tend to give considerable deference to the perceptions of the staff members regarding the credibility of witnesses. Accordingly, counsels’ approach to SEC interviews will often differ substantially from a deposition in traditional litigation. A witness’s goal in providing SEC testimony is often to provide full answers and context regarding the documents and information that are the subject of the staff’s questions, to facilitate the staff making an informed decision regarding what enforcement action, if any, to recommend to the Commission. Failure to be forthcoming and cooperative or invoking a constitutional privilege not to testify under the Fifth Amendment in SEC testimony may result in adverse inferences by the staff and negative consequences for the witness, or his or her company.

There is no standard practice with respect to obtaining information from the staff prior to an interview, for example with respect to the focus of the investigation or particular documents or subjects that might be raised during the interview. Staff practices vary with respect to sharing with defence counsel the documents and topics about which they intend to question a witness. Prior to the interview, the staff may ask the witness to submit a voluntary response to a background questionnaire. Once an interview begins, the questioning proceeds in a similar manner to depositions, although the Federal Rules of Civil Procedure and the Federal Rules of Evidence do not apply and questioning may be led by multiple staff members, including non-lawyers (e.g., staff accountants).

The SEC Rules provide that all formal investigative proceedings are non-public.[6] The staff typically will allow only the witness, the witness’s counsel and the experts assisting the witness’s counsel to attend the testimony. Accordingly, even if the witness is an officer of a company, the staff typically will permit company counsel to attend the testimony only if company counsel also represents the witness, which is not uncommon.[7] The staff typically opens the testimony session by providing copies of the formal order and the SEC’s Form 1662, which accompanies all subpoenas and provides information regarding how the SEC might use the documents and information (including sharing the material with other agencies), the rights of the witness and the penalties for failure to respond completely or truthfully. Questions will be asked regarding documents produced or called for by the subpoena. A witness or his or her counsel (or both) can assert any of the federal privileges, the most common of which are the attorney–client privilege and protection under the work-product doctrine.

Document production

Nearly all SEC investigations involve requests for documents, either by letter requesting voluntary production or by a subpoena compelling production, and the manner in which a party responds to such a request is important in determining the pace and substantive path of the investigation, including the ultimate outcome.

As with witness testimony, the staff may request a voluntary production prior to or in lieu of the issuance of a subpoena. While not legally required (if the receiving party is not associated with a regulated entity), a letter from the SEC Division of Enforcement requesting voluntary production is typically treated as if it were a subpoena, because failure to respond may result in a subpoena for the same and perhaps even more documents, and negotiation of that subpoena may be more difficult given the prior refusal. Moreover, cooperation (or non-cooperation) is often a significant factor considered in resolution, as discussed below.

The Exchange Act expressly authorises the SEC to require the production of any records reasonably relevant to a lawful inquiry,[8] and a receiving party is not entitled to move to quash an SEC subpoena. The staff may seek to enforce a subpoena in a federal district court, however, and its burden in persuading a court to compel production under the subpoena is low.[9] Once a subpoena is received or a decision to produce voluntarily has been made, the respondent should identify and preserve the responsive information (both electronic and on paper); collect the information; sort and analyse the information in a reasonable, efficient manner, including making privilege determinations; and produce the responsive non-privileged material.

Multinational coordination

There are a number of tools available to the SEC when seeking to gather evidence abroad. One of the tools used most often in recent years is a memorandum of understanding (MOU), an agreement between two or more jurisdictions that establishes a commitment to assist each other in the collection of evidence in jurisdictions beyond each party’s regulatory reach. MOUs can often be used to gather evidence for both civil and criminal investigations. Since the 2017 SEC Enforcement Manual was published, the SEC has entered into over 30 MOU arrangements with various foreign counterparts.[10]

In 2002, the International Organization of Securities Commissions (IOSCO) issued a multilateral MOU (the IOSCO Multilateral MOU), to which the SEC is one of over 120 signatories.[11] The IOSCO Multilateral MOU, which was subsequently revised in 2012, allows its signatories to obtain materials relating to transactions in both brokerage and bank accounts, as well as information pertaining to the corresponding account holders and beneficial owners; compel testimony or official statements (or both) from individuals; and share regulatory agency files across borders.[12] The IOSCO Multilateral MOU further provides that the parties that collect such information may use it directly in both administrative and civil venues, as well as provide it to criminal authorities, such as the DOJ.[13] In 2019, the SEC became a signatory to IOSCO’s Enhanced Multilateral MOU, which addressed the significant increase in globalisation, interconnection of financial markets and advancements in technology (including the need to analyse electronic data to investigate potential financial misconduct), as well as lessons learnt from the global financial crisis. Article 3 of the Enhanced Multilateral MOU provides for additional information-sharing powers not found in the initial MOU – for example, requirements that signatories obtain and share audit work papers, compel a person’s physical attendance for testimony, obtain and share internet service provider records and telephone records, and, at the request of another signatory, freeze assets where possible.[14]

Other types of international agreements to assist the SEC in gathering evidence in multinational investigations include mutual legal assistance treaties (MLATs), letters rogatory, ad hoc arrangements and voluntary cooperation.[15] MLATs provide for the exchange of information in criminal matters and are administered by the DOJ. Some jurisdictions permit the SEC to obtain information, including sworn testimony, through MLATs, but US criminal interest in the matter may be a prerequisite.[16] Recently, MLATs have been read to permit criminal authorities to share information obtained pursuant to an MLAT request with other regulatory enforcement authorities, including the SEC, provided that criminal prosecution or referral is contemplated by the investigation.[17] A letter rogatory is a formal request from a court in one country to the appropriate judicial authority in another country, but is generally only used in litigation and, thus, may have limited use in SEC investigations.[18] The SEC’s ability to secure assistance of foreign authorities or individuals themselves on a voluntary basis depends on the jurisdiction and specific facts of the investigation. As noted above, the SEC’s Office of International Affairs provides guidance to the staff on matters involving foreign connections. Coordinating the resolution of multinational investigations often proves difficult, as each regulator faces its own unique political pressures in its home country that may affect both its willingness to enter into a global settlement and the terms of any such settlement. Parties that are the subject of a multinational investigation typically seek to reach contemporaneous settlements with the entire group of regulators, but where such efforts fall short, individual settlements with each jurisdiction may be required.


Since the implementation of the SEC’s whistleblower programme in 2011 under the Dodd–Frank Act,[19] pursuant to which the SEC established the Office of the Whistleblower under the Division of Enforcement to administer the programme, the law and culture of whistleblowing have developed rapidly in the United States. The whistleblower programme provides for financial incentives to individuals who provide information that leads to successful SEC enforcement action. Whistleblower awards can range from 10 per cent to 30 per cent of the money collected when the monetary sanctions exceed US$1 million.[20] Since the inception of the whistleblower programme, whistleblower tips have enabled the SEC to recover more than US$2.5 billion in financial remedies.

The SEC has seen a growing number of tips each year – in 2020, it reported over 6,500 tips from around the world. The SEC announced on 15 September 2021 that it has paid more than US$1 billion to whistleblowers since the programme made its first award in 2012. The US$1 billion-plus in awards has been paid to 207 whistleblowers, including a recent payment of US$100 million, the second-highest award in the programme’s history, following an award of over US$114 million in October 2020. Gary Gensler, the SEC Chairman, stated: ‘Today’s announcement underscores the important role that whistleblowers play in helping the SEC detect, investigate, and prosecute potential violations of the securities laws. The assistance that whistleblowers provide is crucial to the SEC’s ability to enforce the rules of the road for our capital markets.’[21]

In addition to the Dodd–Frank Act, the Sarbanes–Oxley Act of 2002 requires public issuers to establish complaint procedures for accounting issues and to implement an anti-retaliation policy that prohibits employers from taking adverse action against whistleblowers.[22] The Dodd–Frank Act also prohibits retaliation against whistleblowers, and provides for SEC enforcement. Notably, however, since the Supreme Court’s February 2018 ruling in Digital Realty Trust, Inc v. Somers, whistleblowers must report potential securities law violations directly to the SEC, and not just internally to their supervisors, to qualify for the Dodd–Frank anti-retaliation provisions.[23]

Wells process

At the conclusion of an SEC investigation, the staff may issue a Wells notice. The notice is named after John Wells, who led an advisory committee to then-SEC Chair William Casey in 1972 to review enforcement practices and policies, specifically in connection with an informal practice by experienced SEC lawyers to submit a written statement advocating the merits of their client’s position to the staff. To make the enforcement process fairer, the 1972 Wells Committee recommended that prospective defendants be notified of the opportunity to make a submission to the staff.

Rule 5(c) of the SEC’s Rules of Informal and Other Procedures now states that, ‘[p]ersons who become involved in . . . investigations may . . . submit a written statement to the Commission setting forth their interests and position in regard to the subject matter of the investigation.’[24] The rule further provides that, ‘[u]pon request, the staff, in its discretion, may advise such persons of the general nature of the investigation, including the indicated violations as they pertain to them, and the amount of time that may be available for preparing and submitting a statement prior to the presentation of a staff recommendation to the Commission for the commencement of an administrative or injunction proceeding.’[25] Pursuant to this rule, the staff may issue a Wells notice, which is a communication from the staff to the subject of the investigation that: (1) informs the person that the staff has made a preliminary determination to recommend that the Commission file an action or institute a proceeding against them; (2) identifies the securities law violations that the staff has preliminarily determined to include in the recommendation; and (3) provides notice that the person may make a submission to the Division and the Commission concerning the proposed recommendation.[26]

The Wells notice itself does not provide information regarding the facts of the particular investigation. Consequently, discussions with the staff that follow receipt of the Wells notice are important to gain a better understanding of the charges under consideration and the factual and legal basis for them. Such discussions often evolve into settlement negotiations, which, if successful, result in the staff recommending a negotiated resolution to the Commission. Wells notices also provide an opportunity for the charges under consideration by the staff to be narrowed before being presented to the Commission.

The decision to provide a Wells notice is at the staff’s discretion. In practice, the staff provides Wells notices in most cases; the exceptions are where such notice would be contrary to public interest or interfere with the administration of justice (e.g., emergency relief to freeze assets or cases involving a flight risk).


Once all documents and testimony and other evidence have been obtained to the staff’s satisfaction, the investigation may be resolved in one of several different ways. The staff may determine to take no enforcement action and issue a termination letter. However, if the staff has agreed with a party to settle the matter with charges and, possibly, sanctions, or initiate litigation, the staff is required to obtain the authority of a majority of the Commission. The Commission may vote to accept the recommendation, to accept with modifications or to reject the recommendation.

A key factor in the staff’s recommendation is often the degree to which the party under investigation has cooperated with the staff’s investigation. In 2001, the SEC’s policy that, in certain circumstances, it might decline to charge a corporation that provides extraordinary cooperation was made public in the ‘Seaboard Report’.[27] The SEC has since articulated an analytical ‘cooperation framework’, which provides for more formal and prosecutorial tools for encouraging and facilitating cooperation, such as proffers, criminal immunity, cooperation agreements, deferred prosecution agreements and non-prosecution agreements.[28] Proffers of information and evidence can be offered by an individual or company as a mechanism to initiate a discussion with the staff regarding the potential benefits of cooperation. A proffer is generally required to evaluate whether the various cooperation tools will be considered.[29] Criminal immunity can be offered as an incentive to witnesses that are considering whether to cooperate – the staff can request the DOJ’s permission to enter a witness immunity order for individuals who have provided or have the potential to provide substantial assistance in the SEC’s investigations and related enforcement actions.[30]

An individual’s or an entity’s cooperation can be memorialised in one or more agreements with the SEC. In a cooperation agreement, the staff agrees to recommend to the Commission that the individual or company receive credit for cooperating in the investigation and any related enforcement actions, provided that the individual or company cooperates and provides substantial assistance to the staff.[31] Deferred prosecution agreements (DPAs) involve an agreement by the staff to forgo taking enforcement action for a specified period while the statute of limitations is tolled, in exchange for an agreement to engage in no further wrongdoing, to comply with other various undertakings (such as compliance actions) and to cooperate truthfully and fully with the investigation.[32] DPAs with companies can include an agreement by the company to engage an outside compliance monitor to assist with remediation. Non-prosecution agreements (NPAs) carry similar terms but do not have a specified duration.[33] In each case, if the agreement is violated, the staff retains its ability to recommend an enforcement action to the Commission against the individual or company, without limitation.[34]

The SEC’s framework for evaluating cooperation by individuals considers assistance provided by the individual, the importance of the underlying matter, the SEC’s interest in holding the individual accountable, and the individual’s personal and professional profile.[35] The framework for evaluating cooperation by companies considers the company’s self-policing mechanisms, the extent of self-reporting, remediation efforts and the degree of cooperation with the staff’s investigation.[36] It is the SEC’s position that cooperation by individuals and entities in SEC investigations and related enforcement actions can contribute significantly to the success of the agency’s mission by providing SEC investigators access to high-quality, first-hand evidence, which results in stronger cases and faster shutdowns of fraudulent schemes, and provides cooperating parties appropriate credit for facilitating such success.[37]


1 John D Buretta and David M Stuart are partners and Lindsay J Timlin is a practice area attorney at
Cravath, Swaine & Moore LLP.

2 15 U.S.C. § 78u(a).

3 See CFTC v. Nahas, 738 F.2d 487, 491 (D.C. Cir. 1984) (refusing to enforce an investigative subpoena served on a foreign citizen in a foreign state).

4 15 U.S.C. § 78u(c).

5 id.

6 SEC Rules Relating to Investigations, Rule 5, 17 C.F.R. § 203.5.

7 The SEC Enforcement Manual acknowledges that ‘[i]t is not unusual for counsel to represent more than one party (employees of the same company, for example)’. SEC Enforcement Manual, § (2017),

8 15 U.S.C. § 78u(b).

9 See 15 U.S.C. § 78u(c).

10 SEC Enforcement Manual §

11 20 Int’l Org. of Sec. Comm’ns, Multilateral Memorandum of Understanding Concerning Consultation and Cooperation and the Exchange of Information (hereinafter ‘IOSCO Multilateral MOU’),; IOSCO Signatories to Appendix A and Appendix B List,

12 IOSCO Multilateral MOU, ¶ 7(b).

13 id., ¶ 10(a)(ii).

14 IOSCO’s Enhanced Multilateral Memorandum of Understanding Concerning Consultation and the Exchange of Information, Article 3(2),

15 SEC Enforcement Manual §

16 id.

17 See, e.g., Agreement on Mutual Legal Assistance between the United States of America and the European Union Article 8 § 1, U.S.–EU, June 25, 2003, T.I.A.S. No. 10-201.1.

18 id.

19 The Dodd–Frank Act amended the Exchange Act by, among other things, adding Section 21F, titled ‘Securities Whistleblower Incentives and Protection’. Pub. L. No. 111-203, tit. IX, § 922(a), 124 Stat. 1841 (2010).

20 15 U.S.C. § 78u-6.

21 ‘SEC Surpasses $1 Billion in Awards to Whistleblowers with Two Awards Totaling $114 Million’, | SEC Surpasses $1 Billion in Awards to Whistleblowers with Two Awards Totaling $114 Million.

22 15 U.S.C. §§ 78j-l(m).

23 138 S. Ct. 767 (2018).

24 17 C.F.R. § 202.5(c).

25 id.

26 SEC Enforcement Manual § 2.4.

27 Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, Securities Exchange Act Release No. 44969 and AAER-1470 (Oct. 23, 2001) (

28 SEC Enforcement Manual § 6.1.2-6.2.4.

29 id., § 3.3.7.

30 id., § 2.5.3.

31 id., § 6.2.1.

32 id., § 6.2.2.

33 id., § 6.2.3.

34 id.

35 id., § 6.1.1.

36 id., § 6.1.2.

Unlock unlimited access to all Global Investigations Review content