How SEC Investigations Work: Process, Defense Strategies & Legal Guidance

Introduction -Why How SEC Investigations Work: Process, Timeline, Subpoenas and Defense Strategies

Updated August 2026 to reflect the SEC Division of Enforcement’s revised Enforcement Manual and Wells process.

The short answer

An SEC investigation is a confidential inquiry by the Securities and Exchange Commission’s Division of Enforcement into possible violations of the federal securities laws. The staff may begin with voluntary requests for information. If the Commission authorizes a formal investigation, designated staff members can issue subpoenas for documents and sworn testimony.

An investigation does not mean that the SEC has concluded anyone violated the law. After gathering and evaluating the evidence, the staff may close the matter without recommending charges, seek a settlement, issue a Wells notice, or recommend that the Commission authorize an enforcement action.

The most important early steps are to preserve potentially relevant information, identify who counsel represents, determine whether the request is voluntary or compulsory, and develop a coordinated response before producing documents or giving testimony.

SEC investigation process at a glance

Stage	What happens	Why it matters
1. Referral or detection	The SEC receives a tip, identifies suspicious activity, reviews a filing, or receives information from another regulator.	The person or firm involved may not know an inquiry has begun.
2. Preliminary inquiry	Staff reviews public information and may request documents or interviews voluntarily.	A voluntary request should still be treated seriously; statements and productions can shape the case.
3. Formal investigation	A formal order authorizes designated staff to use subpoena power.	The SEC may compel documents and sworn testimony.
4. Evidence development	Staff reviews emails, financial records, trading data and testimony, and may consult experts or coordinate with other authorities.	Early legal and factual errors can become difficult to correct later.
5. Wells process	Staff may give prospective defendants or respondents notice of proposed charges and an opportunity to respond.	This is often the best formal opportunity to argue against charges or remedies before the Commission decides.
6. Commission decision	The Commission considers the staff’s recommendation and any Wells submission.	The Commission may authorize an action, decline to do so, or seek additional information.
7. Resolution	The matter may close, settle, proceed in federal court, or proceed administratively where legally available.	Remedies may include injunctions, penalties, disgorgement, bars and undertakings.

This is a useful roadmap, but real investigations do not always proceed in a neat sequence. The staff may open a formal investigation immediately, request additional documents after testimony, conduct settlement discussions before a Wells notice, or pursue different subjects on different timelines.

What triggers an SEC investigation?

The Division of Enforcement receives information from many sources, including:

• investor complaints and whistleblower submissions;
• market surveillance and suspicious trading alerts;
• SEC examinations of broker-dealers, investment advisers and investment companies;
• public-company filings and financial restatements;
• referrals from FINRA, exchanges, state regulators and other government agencies;
• self-reports by regulated firms or public companies;
• media reports, litigation filings and public information; and
• trading, communications and other data analyzed by the SEC.

Common subjects include insider trading, market manipulation, misleading disclosures, accounting fraud, unregistered offerings, broker-dealer and investment-adviser misconduct, custody or safeguarding failures, conflicts of interest, and misappropriation of investor funds.

Unusual trading alone does not establish insider trading. For example, the SEC may request customer-identifying information from every broker-dealer involved in trading around a market event. A firm receiving such a request may be only an information source, while the staff determines who traded and why.

Informal inquiry versus formal SEC investigation

Preliminary or informal inquiry

During a preliminary inquiry, SEC staff can review public records and ask companies, firms and individuals to provide information voluntarily. The staff may request documents, ask for an interview, or contact third parties.

“Voluntary” does not mean inconsequential. Before responding, counsel should determine the client’s status, the subject matter under review, the likely sources of relevant information, and whether providing an interview or broad production is strategically appropriate.

Formal investigation

A formal order of investigation authorizes designated staff members to issue subpoenas, administer oaths, take testimony and compel the production of relevant evidence. In 2025, the Commission changed its delegation framework so that formal investigative authority again required Commission authorization rather than unilateral authorization by senior Enforcement staff.

A recipient of an SEC subpoena should request the formal order. The order can identify the statutes and general conduct under investigation, although it usually does not reveal the staff’s complete theory, all potential subjects, or the evidence already obtained.

Does an SEC subpoena mean you are a target?

No. An SEC subpoena means the staff is using formal investigative authority to obtain documents or testimony. The recipient may be a witness, a custodian of records, a subject, or a potential defendant. The subpoena itself may not disclose which status applies.

Counsel can often obtain useful context by speaking with the staff, reviewing the formal order and analyzing the requests. The staff may not provide a definitive label, and a person’s status can change as the investigation develops.

Responding to an SEC document subpoena

SEC document subpoenas commonly seek emails, text messages, messaging-app content, trading records, bank records, compliance materials, board documents, investor communications and internal analyses.

A defensible response generally includes:

1. Preserve information immediately. Suspend routine deletion and issue an appropriately tailored legal hold. Preserve relevant phones, personal accounts and messaging applications when business communications may be located there.
2. Analyze scope and deadlines. Identify vague, burdensome or disproportionate requests and discuss practical modifications with the staff before the deadline.
3. Map custodians and systems. Determine where responsive information resides and who controls it.
4. Protect privilege. Separate privileged material, document the basis for withholding it and avoid unnecessary waiver.
5. Review for substance, not merely responsiveness. Counsel should understand what the production shows, identify problematic documents and prepare for likely follow-up questions.
6. Maintain accuracy and consistency. Production representations, testimony and later submissions must align with the underlying records.

Never alter, delete, conceal or fabricate evidence. Obstruction, false statements and perjury can create exposure separate from the conduct that prompted the investigation.

For a detailed discussion, see Responding to an SEC Subpoena.

What happens during SEC investigative testimony?

SEC investigative testimony is usually taken under oath before a court reporter. Enforcement attorneys question the witness, and the witness’s attorney may advise the witness and protect applicable privileges, but the proceeding is not a conventional deposition with opposing counsel conducting a cross-examination.

Preparation should include:

• reviewing the subpoena, formal order and key documents;
• reconstructing the relevant chronology;
• identifying areas of uncertainty rather than guessing;
• practicing how to answer accurately, directly and completely;
• analyzing privilege, individual-versus-company representation, and potential criminal or regulatory overlap; and
• anticipating exhibits and follow-up requests.

The goal is truthful, precise testimony—not memorized answers. A witness should listen to the question, answer only after understanding it, and distinguish personal knowledge from assumption or reconstruction.

Are SEC investigations confidential?

SEC investigations are conducted privately. That confidentiality protects the integrity and fairness of the inquiry, but it is not an absolute guarantee that the matter will remain unknown. A public company may have disclosure obligations; third parties may learn of subpoenas; parallel proceedings may become public; and any filed enforcement action is ordinarily announced publicly.

Recipients also should review SEC Form 1662, which explains, among other things, the uses the SEC may make of information supplied during an investigation and circumstances in which information may be shared.

Cooperation: benefits and risks

The SEC considers cooperation when deciding whether to recommend charges and remedies. Relevant conduct can include self-policing, prompt self-reporting, remediation, preserving and producing evidence, making witnesses available, and providing meaningful assistance.

Cooperation should be deliberate, not reflexive. Producing information quickly without understanding the facts can create inconsistencies, privilege problems or unnecessary exposure. Counsel should evaluate:

• whether the client is a witness, subject or likely defendant;
• whether parallel criminal, FINRA, state or civil proceedings exist;
• what remediation is appropriate;
• whether individual and company interests diverge; and
• how any presentation to the staff will affect later litigation.

In its fiscal year 2025 results, the SEC reported matters in which meaningful cooperation and remediation contributed to reduced penalties or a decision not to recommend an enforcement action. That makes cooperation potentially valuable, but the appropriate strategy depends on the facts.

The Wells notice and Wells submission

A Wells notice tells a prospective defendant or respondent that the staff has made a preliminary decision to recommend an enforcement action. It ordinarily identifies the proposed charges and remedies and offers an opportunity to respond before the staff presents its recommendation to the Commission.

Under the Enforcement Manual updated in February 2026:

• recipients ordinarily receive four weeks to make a Wells submission;
• staff should identify the salient, probative evidence gathered in the investigation that the recipient may not know, subject to confidentiality and other limits;
• accepted Wells submissions are provided to the Commission with the staff’s recommendation;
• post-submission Wells meetings are typically granted and should occur within four weeks after the submission; and
• the meeting should include an Enforcement Division leader at the Associate Director level or above.

A Wells submission is not simply a denial of wrongdoing. The strongest submissions focus on issues that could change the outcome, such as:

• a missing element of a proposed claim;
• evidence inconsistent with the staff’s factual theory;
• controlling law or litigation risk;
• the absence of scienter where it is required;
• materiality, reliance, causation or jurisdictional defects where relevant;
• cooperation, remediation and proportionality of remedies; and
• policy consequences or collateral effects.

Anything in a Wells submission may later be used in an SEC action and may be discoverable by third parties. The decision to make a submission—and what to include—therefore requires careful judgment.

See also Responding to a Wells Notice.

What can happen when the investigation ends?

An SEC investigation generally ends in one of four ways:

1. Closure without an enforcement recommendation

Staff may decide not to recommend charges. The 2026 Enforcement Manual states that the Division’s general policy is to notify individuals and entities at the earliest appropriate time after making that determination. A termination notice is welcome, but it is not a ruling on the merits and does not bind other regulators or private parties.

2. Negotiated settlement

The parties may negotiate charges, findings, monetary relief, bars, undertakings and other terms. Settlement discussions can occur before or after a Wells notice and, in some cases, after an action is filed.

3. Federal district court action

The Commission may authorize a civil complaint in federal court. Depending on the claims and facts, the SEC may seek injunctions, civil penalties, disgorgement and prejudgment interest, officer-and-director bars, conduct-based injunctions and other equitable relief.

4. Administrative proceeding

The SEC may institute an administrative proceeding where authorized. The permissible forum and available remedies depend on the claims and governing law. The Supreme Court’s 2024 decision in SEC v. Jarkesy held that defendants facing civil penalties for securities-fraud claims were entitled to a jury trial in federal court, limiting the SEC’s ability to pursue those claims through an in-house adjudication.

The SEC is a civil enforcement agency. It does not prosecute crimes or send people to prison. It may, however, share information with the Department of Justice or other criminal authorities, and SEC and criminal investigations can proceed in parallel.

How long does an SEC investigation take?

There is no standard deadline. A focused inquiry may close within months; a complex investigation involving many witnesses, large data sets, expert analysis or parallel authorities may last several years.

The SEC Office of Inspector General reported that, for investigations producing a first enforcement action, the average time from opening an investigation to the first filed action was approximately 22.8 months in fiscal year 2021. That figure does not predict the duration of a particular matter and does not include every investigation closed without charges.

Factors affecting duration include:

• the number of people and entities involved;
• the volume and location of documents;
• overseas evidence or third-party subpoenas;
• accounting, valuation or trading analysis;
• cooperation and discovery disputes;
• parallel criminal or regulatory investigations; and
• statutes of limitation or tolling agreements.

A long period of silence does not prove that the matter is closed. Counsel may seek a status update and, when appropriate, ask the staff for a termination notice.

What should you do after receiving an SEC request or subpoena?

1. Do not ignore it. Calendar all response and appearance dates.
2. Preserve documents and communications. Stop automatic deletion and protect relevant devices and accounts.
3. Do not contact other witnesses to coordinate accounts. Legitimate fact gathering should be directed by counsel.
4. Determine who counsel represents. Company counsel may not represent individual employees, officers or customers.
5. Do not volunteer an interview before preparing. Even an informal conversation can affect the staff’s view of the case.
6. Identify parallel exposure. Consider DOJ, FINRA, state regulators, employment issues, insurance notice and private litigation.
7. Retain experienced securities-enforcement counsel early. Early strategy can narrow requests, prevent avoidable errors and sometimes resolve a matter before charges are recommended.

How experienced SEC defense counsel can help

Experienced counsel should do more than collect documents. Counsel can investigate the facts independently, determine the staff’s likely theory, negotiate subpoena scope, prepare witnesses, make factual and legal presentations, evaluate cooperation and remediation, manage parallel proceedings, respond to a Wells notice, and negotiate or litigate a resolution.

The attorneys at Sallah Astarita & Cox, LLC represent financial professionals, broker-dealers, investment advisers, public companies, executives and witnesses in SEC and FINRA investigations nationwide. The firm includes former SEC attorneys and brokerage-firm counsel with more than 100 years of combined securities-law experience.

Representative matters include:

• obtaining SEC termination or declination letters in investigations involving brokerage activity and public-company financial reporting;
• securing a defense jury verdict for a physician in an SEC insider-trading case, SEC v. De La Maza, No. 09-21977 (S.D. Fla.);
• obtaining dismissal with prejudice of a Securities Act Section 17(b) claim in SEC v. Recycle Tech, Inc., No. 12-21656 (S.D. Fla.); and
• obtaining dismissal of the SEC’s claim against a relief defendant in SEC v. ECareer Holdings, Inc., No. 15-80446 (S.D. Fla.).

Past results do not guarantee a similar outcome. Every investigation depends on its particular facts and law.

To discuss an SEC subpoena, testimony request, Wells notice or enforcement investigation, contact Sallah Astarita & Cox, LLC at 212-509-6544.

Frequently asked questions

Is an SEC investigation public?

Ordinarily, no. SEC investigations are conducted privately. The matter may become public through a company disclosure, a parallel proceeding, a third party, or the filing of an enforcement action.

Does an SEC subpoena mean the recipient violated the law?

No. A subpoena is a compulsory demand for evidence or testimony. A recipient may be a witness, record custodian, subject or potential defendant.

Can the SEC subpoena text messages and personal devices?

Yes, if the information is relevant and within the scope of the SEC’s authority. Business communications may be responsive even when they occurred on a personal phone, email account or messaging application.

Can you refuse an SEC subpoena?

A recipient can assert valid objections and privileges and negotiate scope or timing, but should not simply disregard the subpoena. The SEC may seek a federal court order compelling compliance.

Can the SEC bring criminal charges?

No. The SEC brings civil enforcement actions. It can refer evidence to the Department of Justice, which decides whether to pursue criminal charges.

Does everyone receive a Wells notice before the SEC files a case?

No. The Wells process is customary but not legally required in every matter. The staff may proceed without notice in circumstances described in the Enforcement Manual, including when advance notice could jeopardize the investigation or investor protection.

How long do you have to answer a Wells notice?

Under the SEC Enforcement Manual updated in February 2026, recipients ordinarily receive four weeks to submit a response. The notice controls the actual deadline, and extension requests should be made promptly and in writing.

Can an SEC investigation close without charges?

Yes. The staff may close an investigation without recommending an enforcement action. The Division’s policy is generally to send a termination notice at the earliest appropriate time after making that decision.

Authoritative sources

U.S. Supreme Court, SEC v. Jarkesy, 603 U.S. 109 (2024)

SEC Division of Enforcement, Enforcement Manual (updated Feb. 24, 2026)

SEC Division of Enforcement: How Investigations Work

SEC Investor Bulletin: SEC Investigations

SEC Form 1662: Information for Persons Supplying Information

SEC, 2026 Enforcement Manual Update

SEC Office of Inspector General, Enforcement Investigations: Measures of Timeliness (2023)

The attorneys at Sallah Astarita & Cox, LLC are former SEC Staff Attorneys and brokerage firm counsel, with over 100 years of collective experience. If you have received a subpoena from the SEC, a document request from FINRA, or have a dispute with a brokerage firm, call 212-509-6544 for a free consultation. The firm represents investors and financial professionals nationwide.

SEC & FINRA Investigations: Legal Guidance You Need

Defense of an SEC Enforcement Investigation

Last updated on August 1st, 2026