Fintech Focus: Surviving Crypto Winter: Steps to Prepare for a Regulatory Inquiry

Three Steps to Prepare for a Regulatory Inquiry

1. Anticipate Potential Review of Public Statements. Regulators will frequently identify public statements and ask for the factual basis for each statement. If you expect a regulatory inquiry, identify past statements that the regulator may question and gather contemporaneous factual support for the statement when it was made. When making future public statements—whether on a blog, in a press release, on Twitter, or in any other public forum—ensure that all factual information in those statements has been thoroughly vetted. Each piece of information should be tied to a specific source; if a source cannot be located for a statement, it may be better to revise the statement. Keep a file of the evidentiary backup for public statements so that if an investigation becomes necessary, you can be confident that your public statements are fully supported—and you can easily provide the documentation to prove it. Not only is this good business practice, but it will dramatically reduce the cost of having outside counsel try to retroactively identify support for what was said.
   
   Equally important, any entity should make clear who does and does not have authority to speak on its behalf, and what statements are made on behalf of the entity as opposed to individual contributors or community members. Appropriate company policy and training on appropriate engagement with the media, and especially with social media, can mitigate the risk of unauthorized statements creating difficulty for the business.
2. Implement a Document Retention Policy. Retention of important documents is critical for the proper functioning of any business. But that does not mean it is necessary, or advisable, to always save everything. Particularly in businesses that are rapidly expanding and experiencing high turnover, failure to have policies that properly address both document retention and destruction will quickly lead to terabytes of data, with no one at the company who knows what is in it. By the time you get an investigatory inquiry, you will likely have a duty to preserve information—which, without proper policies in place, can leave you with a massive amount of data and no sense of its relevance to the area of inquiry. The cost to have outside counsel sift through it all can be staggering.
   
   While it may not make sense to save everything, it is certainly worse to selectively delete and be suspected of trying to destroy evidence of wrongdoing. Clear policies help mitigate these risks. A proper document retention policy can specify what is and is not retained, and for how long. The policy should be created with the guidance of counsel to ensure all requirements are being met under applicable regulations. Substantial portions of the retention and deletion policy can often be automated.
   
   When document retention and destruction is approached thoughtfully in advance, it can improve data management and drive down costs of any future investigation, while protecting you from accusations of improper destruction of evidence.
3. Create an Investigation Response Gameplan. Companies often learn of an investigation when they receive a subpoena from the government requesting a response in a very short time. For the unprepared, this can lead to panic and crisis-mode response. It is far better to think through the possibilities and have a plan in advance, which you can easily put into action the day a subpoena or other inquiry arrives.
   
   Preparing a gameplan to respond to a regulatory inquiry does more than just decrease costs and streamline the first days of an investigation. Being in position to respond promptly to regulators can go a long way toward increasing credibility and establishing good faith cooperation, which can have a meaningful impact on the regulator’s view of the company and, thus, the substantive outcome of the regulatory inquiry.

Here are a few key components:

• Designate Internal Team Members and Process Owners. Decide in advance who will be responsible for managing the company’s response to a regulatory request. For a small company, this may be just one person. Larger organizations may need one point person and a contact in each relevant department or function (human resources, IT, etc.) to assist them. Determine which of these internal team members own which process and ensure that each is aware of and prepared to execute their responsibilities. Who will interface with outside counsel? Who will communicate with employees? Who will collect documents? Who is responsible for public statements? Who will keep stakeholders informed? Mapping out each required step of the investigation process and assigning a process owner saves time and confusion and will result in a
  much more streamlined and effective process.
• Plan for Document Collection Procedures. You will almost certainly need to collect and produce a variety of documents. This will include email and other messaging services and internal corporate documents. Decide who will be in charge of this effort and make sure they are familiar with what systems are used, what documents are kept, and how to collect them. If you receive a subpoena, you may also have an obligation to preserve documents. You can prepare a template document preservation notice in advance, drafted with the assistance of outside counsel, which is ready to update and distribute to the relevant employees to ensure proper preservation of documents. Document collection is a significant burden, but taking these steps will lessen that burden and increase responsiveness.
• Identify Outside Counsel. Before receiving any contact from regulators, give thought to who will serve as outside counsel assisting in the response to regulators. Not only will this reduce the time needed to retain outside counsel in the initial stages of the investigation, but it can also serve as an opportunity to ensure that someone familiar with your business is retained, reducing the time spent on the investigation itself. Outside counsel can also assist in developing your investigation response gameplan.

Concluding Thoughts

Fortune favors the prepared. Plan now to substantially reduce the risks and future expense of responding to a regulatory inquiry. The above steps are just a few examples. Experienced counsel can help implement these steps and identify others properly tailored to protect your business, for this night and all the nights to follow.