By the time a federal white-collar indictment is unsealed, the investigation behind it has usually been running for one to three years. The grand jury has heard testimony. Subpoenas have been issued and complied with. Cooperators have been signed up. Forensic accountants have walked the prosecutors through the documents. The defense, in most cases, has been engaged for months or longer — and the work that mattered most happened well before any charges existed.
This pre-indictment phase is where federal white-collar cases are won and lost. Defendants who treat an investigation as something to worry about only after charges are filed routinely discover that the most consequential decisions had already been made — by other people, on incomplete information, while no one was advocating on their behalf.
How Federal White-Collar Investigations Actually Begin
Most federal white-collar investigations originate from one of a few sources. A regulatory referral — from the SEC, the FDIC, the Office of Inspector General of a federal agency, or a similar body — flags conduct that may also involve criminal exposure. A whistleblower files a complaint, often with a financial incentive attached. A cooperating defendant in another case identifies new targets. A bank’s suspicious activity report flags a transaction pattern. A civil lawsuit produces deposition testimony or documents that prosecutors find interesting.
Whatever the source, the early stages tend to look the same from the outside: very little. The U.S. Attorney’s Office and the relevant agency — typically the FBI, IRS-Criminal Investigation, HHS-OIG, or another federal investigative agency — begin gathering information quietly. Subpoenas may be issued to banks, accountants, or other third parties without the target’s knowledge. Witnesses may be approached. The grand jury may be presented with summaries of the evidence as it accumulates.
By the time most subjects of federal investigations learn they are being investigated, prosecutors already have a substantial portion of the documentary record and have formed preliminary views about what the case looks like.
The Three Categories: Witness, Subject, Target
Federal practice distinguishes between three categories of people involved in a grand jury investigation. The distinctions matter, because they signal what the prosecutor believes about a person’s role and what the strategic posture of the defense should be.
A witness is someone the government believes has relevant information but is not currently considered a participant in any wrongdoing. A subject is someone whose conduct is within the scope of the investigation — the government has questions about what this person did. A target is someone the prosecutor believes, based on substantial evidence, has committed a federal offense.
The Department of Justice’s Justice Manual sets out the policies that govern how prosecutors are supposed to handle each category, including when target letters are issued and what notifications are required. These categories are fluid: a witness can become a subject, and a subject can become a target, as the investigation develops. Defense counsel monitoring an investigation is partly trying to read where the prosecutor’s thinking is moving.
Why Pre-Indictment Defense Work Is Decisive
The conventional intuition — that the time to fight is at trial — significantly understates what happens in federal white-collar cases. A few features of federal practice make pre-indictment work decisive in ways that surprise people whose mental model of criminal defense comes from television.
Charging decisions are largely irreversible. Once a federal indictment is returned, the prosecutor’s institutional incentive to drop or substantially reduce charges drops sharply. Cases that look weak after indictment generally still get litigated. Cases that look weak before indictment can be resolved through a declination — a decision not to charge — which leaves no public record of the matter at all. Firms with a record in federal white-collar work, such as Withers Law, focus heavily on the pre-indictment window for this reason: it is the phase in which the universe of possible outcomes is widest and the investment in advocacy has the highest leverage.
Prosecutors rely on information from third parties. In white-collar cases, the prosecutor’s understanding of what happened is built largely from documents and from the testimony of witnesses other than the target. If those documents are incomplete, or if those witnesses are wrong about what the target’s role actually was, the prosecutor’s working theory of the case may diverge meaningfully from what actually occurred. Defense counsel who engages early can sometimes correct that picture — through written submissions, presentations to the prosecutor, or productions of additional documents — before the theory hardens into a charging decision.
Cooperation decisions have to be made early. In any white-collar matter with multiple potential subjects, there is a queue. The first person to cooperate generally gets the most favorable treatment; the second person less so; the last person, often, no benefit at all. Targets who delay engaging counsel sometimes discover that the cooperation slot they would have wanted has already been taken. The decision whether to seek a proffer, and on what terms, has to be made on a timeline that does not always align with the target’s psychological readiness to confront the situation.
Parallel Proceedings
White-collar investigations frequently run alongside parallel civil and regulatory proceedings, and the interaction is treacherous.
A target facing an SEC enforcement investigation, an IRS audit, a qui tam civil case, and a parallel federal grand jury investigation has four sets of obligations operating at once. Statements made to one tribunal can be obtained by the others. Privilege assertions made in civil discovery can be challenged based on positions taken in criminal proceedings. Settlement of the civil case can affect the criminal exposure, and vice versa.
The Department of Justice’s policy on parallel proceedings, set out in the Justice Manual, reflects long-standing practice that civil and criminal investigations may proceed simultaneously, with information shared between them in many circumstances. Defense counsel who handle only the criminal piece without coordinating across the parallel matters often produce outcomes in one forum that damage their client in another.
The Defense Posture That Tends to Work
Effective pre-indictment defense in federal white-collar cases tends to share certain features. Counsel engages early, before the prosecutor’s theory has hardened. Counsel develops an independent factual record — not relying on the government’s view of what happened — through interviews, document review, and engagement with the client’s own contemporaneous records. Counsel makes strategic decisions about whether and how to communicate with the prosecutor, recognizing that the goal is not to “explain” the case but to influence how the prosecutor evaluates it.
Where the facts support it, counsel may make a written submission to the prosecutor’s office before any charging decision — sometimes called a “white paper” or “prosecution memorandum response” — explaining why charges should not be brought, or should be brought in a different form. These submissions do not always succeed, but they can. The U.S. Attorney’s Office for any given district publishes information about its priorities and procedures through pages such as the Southern District of Georgia U.S. Attorney’s Office, which can inform how submissions are framed.
The defense work that happens before indictment rarely makes the news. The cases that resolve through declination, or through reduced charges, or through carefully structured cooperation that limits exposure, do not produce dramatic verdicts. But for the people inside those cases, those outcomes are often the difference between a manageable resolution and a public, expensive, multi-year ordeal.
The Practical Takeaway
Federal investigations move slowly until they don’t. The targets who get the best outcomes are usually the ones who treated the investigation as serious from the moment they first sensed it — who engaged experienced federal defense counsel early, who avoided the temptation to handle communications with investigators themselves, and who understood that the most important decisions were being made well before any indictment was on the table.
The cases where the defense was effective often look, in hindsight, like the cases where nothing happened. That is the point.
