Secil Law PLLC Logo Full Color
Close this search box.

What if it's an SEC investigation?

SEC investigations begin and are tracked, completed, resolved, and ultimately closed in accordance with the SEC’s processes and procedures. Accordingly, the progress of an investigation and the next steps in the process can be understood and anticipated.

Matter Under Investigation

SEC staff members, after receiving information about potential securities law violations from any of a number of potential sources (including, potentially, their own reaction to information disclosed in a news story), may log into the SEC’s tracking system and initiate a Matter Under Investigation (“MUI”).

“Opening” a MUI does not mean that a formal investigation has begun—that happens in a subsequent step; it merely requires an Enforcement staff member, in consultation with or at the direction of his or her assistant director, to write a narrative justification for why an investigation is warranted, considering the threshold question of whether a sufficiently credible source or body of information suggests that an enforcement action would address conduct that violates the federal securities laws. The initial report is routed to the associate director, who must approve its opening. SEC senior officers (officials at or above the level of associate director or regional associate director) receive weekly reports on MUIs opened in the prior week.

In theory, within 60 days, the SEC staff assigned to the MUI must, following the gathering of additional information, make a second threshold recommendation centered on whether the MUI should be converted into an investigation or closed. It should be noted that not every investigation begins with the MUI process—in some cases, the investigation is opened immediately. Converting a MUI to an actual investigation (or simply opening an investigation without going through the preliminary step of opening a MUI) requires the staff to assess whether it is an appropriate use of resources to open an investigation, which is answered in the affirmative if the information at hand suggests a possible violation of the federal securities laws involving fraud or other serious misconduct. The staff may interview witnesses and obtain documents on a voluntary basis in order to inform its recommendation about converting a MUI into an investigation. At this stage, staff members may reach out to a company’s internal legal department or general counsel, or contact individual executives or employees, in an attempt to evaluate whether it is worth pursuing an investigation.

If the SEC Enforcement staff contacts me, should I hire legal counsel?
If Enforcement staff contacts you or your company, you should consider retaining legal counsel with expertise in SEC investigations and Enforcement actions. Doing so early in the process can help you and/or the company address the SEC’s concerns using an operational strategy that hopes for the best and prepares for the worst. The Enforcement staff expects contacted individuals and companies to retain legal counsel, and it is entirely unremarkable.

What is a “formal SEC investigation?”

A formal investigation is an investigation in which the SEC has obtained a formal order of investigation by which the Commission grants the Enforcement staff its subpoena powers.

What is a “formal order of investigation?”

This is a document that the SEC’s secretary signs and that confirms that the Commission has delegated to the Enforcement staff the Commission’s authority “to investigate,” including through the use of subpoenas. Under the relevant securities laws (Securities Act § 19(c), Exchange Act § 21(b), Investment Advisers Act § 209(b), and Investment Company Act § 42(b)), SEC Commissioners or officers designated by them are authorized to issue subpoenas compelling the production of documents or the taking of witness testimony. The formal order of investigation loosely identifies the time period to be investigated and the possible securities law violations to be considered. It is often written broadly so that the scope of the Enforcement staff’s subpoenas for documents and testimony are within the authorized scope in time and topic. Assuming an investigation is warranted, the decision must (again) be routed to and authorized by the appropriate associate director in the SEC’s tracking system. Reports of opened investigations are also provided weekly to senior officers.

The Commission has delegated authority to the Director of the Enforcement Division to issue formal orders and to designate officers, which may be supplemented or changed from time to time. (17 C.F.R. § 200.30-4(a)(1)).

May I see or obtain the formal order of investigation?

Although a copy of the formal order must be shown (if requested) to a person compelled to produce documents or provide testimony, that person does not have the right to retain a copy. There is a process for requesting a copy in writing, but the staff does not have to provide it if they conclude providing the copy would violate the privacy of persons involved in the investigation or would impede the investigation. If the staff refuses to provide the formal order of investigation in a circumstance other than testimony, if is probably unwise to argue the point; the order rarely contains specific information to assist a witness.

Enforcement staff’s investigative plan

At some point early in the investigation, unless a decision has been made not to prepare one, Enforcement staff members conducting the investigation will prepare one or more written investigative plans, which can often be modified as the investigation proceeds. These plans are intended to map out the direction and distance an investigation must go to accomplish its objective of determining whether violations occurred and who was responsible. They are now also used to assist with “case tracking,” as discussed below. The investigative plan is revised from time to time and staff members need to keep it up to date so they have something to discuss with their supervisors during mandatory Quarterly Case Reviews.

Quarterly Case Reviews

There’s an entire administrative process behind SEC investigations and a tracking system in which the status of each investigation has to be updated and maintained. Arguably, this does more to bog down an investigation than it does to encourage progress. In this process, Enforcement staff reports up the chain of command on the progress of each investigation on a regular basis. Each quarter, Assistant Directors review each of their staff members’ matters, then report up to their Associate Directors (or Unit Chiefs) on “significant investigations.” Then each Associate Director/Unit Chief meets (also quarterly) with the Enforcement Division Director or Deputy Director (or the appropriate Regional Director, for Associate Directors in the Regions). At each level, significant issues are discussed, timing of investigation completion is updated, and administrative reporting is entered into the tracking system.

Everyone in the chain of command is, at some level, busy supervising the staff members who actually conduct the investigation—a heavily bureaucratic process that does nothing to speed investigations along, even though that is supposed to be part of the purpose of all the scrutiny.


Often, the first indication that an SEC investigation is underway—if the staff did not contact the company in the MUI process—is when a subpoena for the production of data and documents is served on the company involved in the investigation. This is usually done at an early stage so as to ensure that the company preserves the information relevant to the investigation. We’ve separately discussed what to do and what not to do when in receipt of a subpoena, but the subpoena will—to the trained eye—often provide a wealth of information about what the SEC is actually interested in investigating and what they may be thinking in terms of potential theories of liability.

Usually, subsequent to a subpoena for documents, the SEC staff will issue subpoenas for individual testimony from individuals, employees and/or executives, who may have relevant knowledge about the underlying facts and circumstances that led to the events under investigation. The company’s outside auditors and other outside professionals used by the company may also receive subpoenas for both documents and, eventually, testimony. These third parties also have their own potential liability concerns under the securities laws.

With respect to witnesses, the usual course will be for the SEC to seek testimony from lower-placed employees less likely to have been in decision-making roles before moving “up the chain” to higher-placed executives who the staff views as having greater responsibility (and hence liability) for making decisions and directing actions that may have violated, or caused the company to violate, the securities laws.

Parallel Criminal Investigations

A quick word about parallel criminal investigations. The SEC may, and often does, work together with the Department of Justice in cases where there is a view that a crime may have been committed (all securities law violations may also constitute crimes if committed with a criminal state of mind—i.e., if the violation was committed knowingly and intentionally; not all criminal violations of the securities laws are necessarily prosecuted, however). In fact, providing information to the DOJ for use in investigating potential criminal violations of the securities laws is explicitly contemplated in both the Securities Act (§ 20(b)) and the Exchange Act (§ 21(b)).

If this happens, the relationship is often a one-way street: the SEC provides information to the DOJ, the DOJ does not provide information to the SEC. This is particularly true if the DOJ has begun to bring information about its investigation to a grand jury because of the “grand jury secrecy rule,” found in Rule 6(e) of the Federal Rules of Criminal Procedure, which prohibits disclosure of “matters occurring before the grand jury” (basically, materials provided to or testimony given before a grand jury), the violation of which could result in the disclosing prosecutor (or anyone who participated in the hearing except witnesses) being held in contempt. Although that rule is limited to grand jury proceedings, in practice it means that the DOJ prosecutors and agents, as a general rule, will not provide information to other government agencies in any investigations involving a grand jury (besides generalized information such as the status of the investigation and potential future steps).

If asked by a witness or counsel for a witness whether a DOJ investigation is occurring in parallel, the SEC staff are supposed to make no representation and refer to the SEC’s Form 1662 (which will have been attached to the subpoena), a document that notes the “routine uses” to which information gathered by the SEC may be put—including sharing the information with other government agencies, among them the DOJ.

Wells Process

Once the SEC’s investigative staff reach a point where they feel they are ready to make a recommendation as to whether or not to recommend an enforcement action against any company or individual based on the investigation, the staff will typically provide notice of its decision to prospective respondents. This is the first step of what is informally known as the “Wells process” which, although generally followed by the SEC staff, is not mandatory.

This process came into existence following a report to the SEC by an advisory committee chaired by John Wells, a lawyer and founder of the New York firm that became Rogers & Wells. The “Wells Committee” was charged by Chairman William Casey to review the SEC’s enforcement policies and practices and make recommendations. In 1972, the Wells Committee provided a report which, among over 40 other recommendations, recommended that “[e]xcept where the nature of the case precludes, a prospective defendant or respondent should be notified of the substance of the staff’s charges and probable recommendations in advance of the submission of the staff memorandum to the Commission recommending the commencement of an enforcement action and be accorded an opportunity to submit a written statement to the staff which would be forwarded to the Commission together with the staff memorandum.”

Although the Commission did adopt the above recommendation, it also noted that “[w]hile it agrees that the objective is sound, it has concluded that it would not be in the public interest to adopt formal rules for that purpose,” which had been another Wells Commission recommendation, “[r]ather, it believes it necessary and proper that the objective be attained, where practicable, on a strictly informal basis . . . .” Accordingly, there is no absolute right to the Wells process in all cases and its administration remains subject to a certain amount of discretion exercised by the staff.

Wells Notice

The “Wells Notice” is a letter from the SEC Enforcement staff (usually less than three pages, excluding attachments) which specifies exactly which charges the staff has preliminarily determined it will recommend to the Commission, notifies the recipient of the right to make a written or video submission to the Commission (along with timing, page or length limitations, etc.), explains the purpose of the “Wells Submission,” and informs the recipient as to where to direct it.

The Wells Notice provides no particularly useful detail beyond what violations are to be recommended. Competent counsel in receipt of a Wells Notice to a client will not simply sit down and write the submission. Instead, they will seek additional information from the staff directly, asking questions geared to understanding what additional information the staff would need to come to a different conclusion, determining what troubled the staff about counsel’s client specifically, and what facts are leading the staff to the conclusion that the client violated the securities laws. In addition, competent counsel will seek to obtain portions of the investigative record not previously available, such as the investigative file, relevant documents and witness testimony, and other information that may not have been available earlier in the investigation or which came from third parties unavailable to the client or client’s counsel. The staff does not have to provide such access (except, with a few exceptions, to the transcript of the client’s own testimony) but often will provide at least some—even a telephone call with the staff can be very helpful in understanding what the Wells Submission should address.

Wells Submission

The Wells Submission is a final opportunity to convince the SEC staff who conducted the investigation about a variety of things: either (1) they are wrong about the involvement of a client in the alleged securities violations, (2) they are wrong about whether or not the conduct properly understood in fact constitutes a violation or violations of the securities laws, or (3) they should understand that the SEC will be unable to sustain its burden of proof if the case ever goes to trial. Although the Commission is going to see it if the staff recommends an action, the real audience for the Wells Submission is the investigation staff.

Audience for the Wells submission

If the real audience is the staff and not the Commission, then this dictates the tone, tenor, and message of the submission. So a fair question is, why is the audience the staff, after all, haven’t they already made up their minds? Yes and no. The staff’s perception of the case has been shaped over months (and, often, years) of reviewing emails, powerpoint slide decks, memoranda, letters, instant messages, and the testimony of many witnesses.

They have synthesized their thinking to the point of being ready to make a recommendation—they may have drafted an action memorandum (discussed below). But the investigative staff’s thinking so far has been geared toward demonstrating that a case should be brought. This singular focus of the investigation has the effect of shutting off alternative views of the evidence, the intentions of individuals involved, and contrary legal theories—all of these may have been disregarded or avoided in the quest to prove a violation; not because the staff members aren’t well-intentioned, but because it’s human nature. All that effort that went into the investigation must have been in the service of a positive result (addressing the misconduct of a wrongdoer).

The message of the Wells Submission is: here are some things you haven’t taken into account or properly factored in. The benefit of this approach is that, without pounding the table or insulting the professionals who have spent significant time and resources on the investigation, a space is created where rational discussion can take place—if not with the staff who are making the recommendation, then with the more senior staff members at the Associate Director and Director level who must, ultimately, approve an enforcement recommendation. And, at the end of the day, if the Commission reviews the Wells Submission, they (and their staffs) will appreciate the underlying message and are more likely to pay attention to a well-reasoned, dispassionate analysis than to a self-righteous diatribe.

Settlement discussions

At some point between the transmission of a Wells Submission and the ultimate recommendation to the Commission (if not initiated at an earlier stage), there is the potential to enter into settlement discussions with the staff. These settlement discussions are usually (but not always) initiated by counsel for respondents. From the perspective of a settling company, the idea is to dispense with the issues, if possible, while avoiding the additional delays and uncertainty incident to going to trial. The existence of an SEC investigation will often have been disclosed to the securities markets and, for public companies, the uncertainty can be a drag on the company’s stock price (for private companies, it can delay or preclude a lucrative sale of the company). For individuals, the calculus is very different, more personal, and often not aligned with the company’s interests of moving forward and leaving the underlying events in the rear view mirror.

Settled action or administrative proceeding

If a settlement negotiation proves fruitful, then the staff’s enforcement recommendation will change to recommend that the Commission adopt the settlement posture recommended by the Staff—which the Commission usually does (again, as with everything, there are (rare) exceptions when the Commission disagrees with the staff’s recommendation and either refuses to settle or pushes settlement on different terms). Among the benefits of settlement is the ability to negotiate the wording of the public documents that will be disclosed upon settlement.

Enforcement does not want to sue: the termination notice
If the Enforcement staff decides not to recommend any enforcement action to the Commission concerning a particular matter (or company or individual in a matter), Enforcement notifies that party of this decision by means of letter containing a termination notice.

Who receives a termination notice?

Enforcement staff send letters containing notice of the termination of a matter to any potential respondent (1) listed in the caption of the formal order of investigation; (2) that received a Wells Notice; (3) that requested such a notice; or (4) that could have a reasonable belief the staff had considered recommending an enforcement action against them.

What is the effect of the termination notice?

The termination notice contains a statement that the recipient ““must in no way” construe the notice as the SEC’s statement that the recipient “has been exonerated or that no action may ultimately result from the staff’s investigation of that particular matter.” The notice simply means that Enforcement staff have completed the investigation and, as of the date of the letter containing the notice, they will not recommend an Enforcement action against that individual or company to the Commission. This is a courtesy that the SEC had not always extended; when an investigation ceased, witnesses and potential defendants and respondents received no information about what the SEC might or would do. The practical effect of the termination notice in many instances is that the witnesses and potential defendants or respondents have the statute of limitations working for them. Even though Enforcement may (in very rare circumstances) reopen the investigation on the very same matter, the time remaining to commence an action or proceeding has been significantly depleted.

Enforcement requests the Commission to sue

If Enforcement believes that the Commission should institute a legal action in U.S. district court or an in-house administrative proceeding against one or more of the individuals and companies investigated, it must ask the Commission to act. Only the Commission has the authority to bring a lawsuit or an administrative proceeding against a proposed defendant or respondent, and the Commission acts by majority vote at a Closed Commission Meeting.

Enforcement Action Memorandum

Before the meeting, the Enforcement staff members prepare an Action Memorandum to the Commission, recommending and requesting that the Commission “act” against an alleged violator or violators and implicitly offering, of course, to continue doing the work as the agents of the Commission in prosecuting the case. This document contains the staff’s recitation of the relevant facts, analysis of the legal issues as applied to those facts, a conclusion as to the violations uncovered during the investigation, a response to the Wells Submissions of the various parties, and, ultimately, a recommendation about what violations should be alleged and in what forum the SEC should proceed to a lawsuit. The Action Memorandum, when fully completed and signed, is a recommendation and request that Enforcement submits to the Commission to have the Commission commence a legal action or administrative proceeding against certain defendants or respondents for specified violations for certain forms of relief.

Buy-in to Enforcement’s action memorandum

Typically, the Enforcement staff circulates its proposed Action Memorandum to other SEC divisions and offices for their input and buy-in before finalizing the document. For instance, in accounting matters, Enforcement will ask or consult with the SEC’s Office of the Chief Accountant (OCA) to provide input on Enforcement’s view of the relevant accounting principles, and in matters involving an investment adviser or a mutual fund, Enforcement offers the SEC’s Division of Investment Management an opportunity to provide input on the recommendations pertaining to the enforcement of the Investment Advisers Act or Investment Company Act.

Delivery of the Enforcement action memorandum

Enforcement staff members deliver the completed Action Memorandum to the Commissioners in advance of the next scheduled Closed Commission meeting.

Closed Commission Meeting

Normally, the Commission considers and votes on Enforcement recommendations in “closed meetings.” Although the Sunshine Act requires access to governmental meetings, 5 U.S.C. § 552b and SEC regulations exempt meetings concerning Enforcement’s recommendations to institute, modify, or settle or otherwise resolve a legal action. 17 C.F.R. § 200.402(a).

Enforcement staff orally present their recommendation about the disposition of an enforcement matter and answer any questions before the Commission votes on the recommendation. A majority vote is required to authorize the staff to proceed to filing any action or agreeing to any settlement.

Alternatively, if consideration at a scheduled closed Commission meeting is impracticable for some reason, the Chairman may decide to route the decision via “seriatim” consideration. Here, each Commissioner reports their vote on the recommendation to the Secretary of the Commission, using a seriatim coversheet. The matter is not authorized until each Commissioner has recorded a vote (or indicated that they are not participating). Any Commissioner may pull a recommendation from the seriatim process and instead place it on a closed meeting agenda.

Once the Commission authorizes an enforcement action, then the SEC’s trial unit will proceed with filing a Complaint in federal court and serving defendants or, in the case of an administrative proceeding, serving an Order Instituting Proceeding upon respondents.

Closing an Investigation

The staff should close an investigation as soon as it becomes apparent that no enforcement action will be recommended. Once a Termination Notice has been provided (if necessary), then the staff has to prepare a short memorandum which serves as the record summarizing what the staff did in the investigation and why it recommended closing the investigation. An investigation that entailed an enforcement action is closed only after all actions authorized by the Commission are completed

Legal FAQs answered by SECIL Law group photo featuring Janet DeCosta, Lionel Andre, and Adriaen Morse

Get in Touch

“SECIL” stands for what we do: Securities Enforcement Compliance Investigations & Litigation.  We help companies and individuals with sophisticated criminal and civil litigation, whistleblower disclosures, compliance and anti-corruption programs, and a range of other services.