Responding to ED, RBI and SEBI notices

1. The first 72 hours

Begin by reading the notice as a legal instrument rather than a communication. Which authority issued it, under which provision, in what capacity, what precisely is demanded, by when, and does it require appearance by a named individual or production by the company? A summons, an inspection intimation, a pre-notice enquiry and a show cause notice call for entirely different responses, and the difference is not always obvious from the covering language.

Immediately issue a documented preservation hold covering email, file systems, collaboration tools, chat, mobile devices, and backups, suspending routine deletion and rotation. Record who was notified, when, and what they were told. Simultaneously restrict circulation of the notice itself to a defined group, because uncontrolled distribution generates internal speculation in writing, which is the material most likely to be produced later and least likely to be helpful.

Then engage external counsel and brief the board or audit committee. Two decisions should be taken at this stage rather than drifted into: who owns the response internally, and whether the individuals named or implicated need separate representation because their interests may diverge from the company's. Both become considerably harder to arrange once positions have been taken.

Almost every avoidable enforcement problem we are asked to repair began with an informal reply sent quickly, to be helpful, before anyone established the facts.

2. Understanding what you actually received

Enforcement Directorate communications typically arise under the Foreign Exchange Management Act or the Prevention of Money Laundering Act, and the distinction matters enormously. FEMA proceedings are civil in nature, directed at contraventions of exchange-control law, and generally lead to adjudication and penalty. PMLA proceedings are criminal in character, can involve attachment of property, statements recorded under statutory provisions and arrest powers, and require a fundamentally more cautious approach from the first interaction.

Reserve Bank communications range from routine information requests and inspection observations to show cause notices and directions, alongside the compounding process for FEMA contraventions. Many RBI matters begin as apparently administrative queries about filings, reporting or documentation, and companies answer them casually. Those answers become the foundation of anything that follows, so they deserve the same care as a formal reply.

SEBI communications include summons for information, investigation notices, show cause notices proposing action against a company, its promoters, directors or intermediaries, and administrative warnings. For listed entities, a further layer applies immediately: whether the matter triggers a disclosure obligation to the stock exchanges under the listing regulations, which must be assessed on receipt rather than after the reply is filed. Other regulators, from tax authorities to sector-specific bodies, follow broadly similar architecture, and a single set of facts frequently generates parallel proceedings across several of them.

3. Preservation, privilege and confidentiality

Preservation is the obligation companies most often fulfil late and regret first. Routine mailbox deletion, device refresh cycles, log rotation and departing-employee account closure all destroy material that the company will later need to defend itself, and the destruction is often innocent but very difficult to explain. Issue the hold in writing, name the custodians, describe the categories, suspend the automated policies specifically, and follow up to confirm compliance.

Privilege in India is narrower than in several other jurisdictions and does not extend to in-house counsel communications in the same way. Structure accordingly: engage external counsel with a defined mandate, route investigation work including any forensic or accounting support through counsel, keep advice separate from operational correspondence, mark documents appropriately without treating labels as protection, and limit distribution to a defined group with a recorded rationale. Assume that anything written in an open channel may be read by the regulator.

Confidentiality also has an external dimension. Consider early whether the matter must be disclosed to auditors, lenders under facility covenants, insurers under policy conditions, investors under shareholder agreements, and for listed companies to the exchanges. Late disclosure to any of these creates a second problem alongside the first, and the assessment should be documented as a board decision rather than left to individual judgment.

4. Running the internal investigation

Scope the investigation deliberately by reference to the allegations, with a written mandate covering the questions to be answered, the period, the entities and the custodians. Scope creep wastes time and generates findings the company then has to address; scope that is too narrow produces a reply that is contradicted by the regulator's own material. Both are avoidable with a scoping exercise done properly at the outset.

Collect before you interview. Reconstruct the chronology from primary records: contracts, board and committee minutes, approvals, bank statements, filings, correspondence and system logs. Where deleted material or personal devices are relevant, use forensic collection with proper authorisation and a chain of custody. Only then interview, in a planned sequence from peripheral to central, with appropriate cautions about who counsel represents, and with a note-taker and a consistent record.

Assess findings against three questions: what actually happened, whether it contravenes the provision invoked, and what has been or should be remediated. Distinguish clearly between a technical or procedural lapse with no gain or intent, a substantive contravention, and an allegation the evidence does not support. That distinction drives everything downstream, including whether contesting, compounding or voluntary disclosure is the right route.

5. Building the reply

A reply to a show cause notice is a case, not a letter. Address each allegation specifically, in the order the notice puts them, with the factual answer, the evidence relied on and the legal position. Annex the primary documents rather than describing them, provide a clear chronology, and where a figure or a date in the notice is wrong, correct it with the record instead of arguing around it. Regulators respond well to submissions that make verification easy.

Deal with intent and materiality expressly where they are relevant to the provision. Explain the commercial context, the controls in place at the time, the absence of any gain where that is true, the promptness of detection, and any remediation already implemented. Remediation completed before the reply is filed is worth substantially more than remediation promised in it, and it should be evidenced with dates and documents.

Where something went wrong, say so precisely and without theatre. Overstated denials that the record contradicts are the fastest way to convert a penalty matter into a credibility problem, and credibility, once lost with a regulator, affects every subsequent interaction including in unrelated matters. Equally, do not concede characterisations the facts do not support merely to appear cooperative. Precision serves both objectives.

Regulators are not persuaded by tone. They are persuaded by a chronology they can verify against documents you have given them.

6. Summons, appearance and recorded statements

Where a summons requires personal appearance, preparation is not coaching. The witness should be taken through the documents that will be discussed, the chronology, the limits of their own knowledge, and the discipline of answering only what is asked, accurately, without speculation. The most damaging answers in recorded statements are usually not admissions; they are guesses offered helpfully about matters the witness did not actually know.

Statements recorded under statutory provisions can carry significant evidentiary weight, particularly in proceedings of a criminal character, and the position on self-incrimination and on the use of statements differs by statute. Where criminal exposure exists, individual representation for the witness, separate from the company's counsel, is frequently appropriate, and the question should be raised before the appearance rather than during it.

Practical discipline matters too: attend on the date or seek an adjournment properly and in advance, carry the documents required, keep a contemporaneous record of what was asked and produced, obtain acknowledgements for everything handed over, and review any statement carefully before signing, correcting inaccuracies at the time rather than disputing them later. A clean procedural record is itself part of the defence.

7. Compounding, settlement and voluntary disclosure

For FEMA contraventions, compounding through the Reserve Bank is often the pragmatic resolution. An application sets out the contravention, its cause, its duration and its remediation, and the compounding amount is determined by reference to published guidance and factors including the amount involved, the period of the contravention and any gain. Voluntary application before detection generally produces a better outcome than compounding after enforcement contact, which is a strong argument for regularising known lapses proactively rather than hoping they go unnoticed.

For SEBI proceedings, the settlement mechanism permits certain matters to be resolved without admission or denial of guilt, on payment of a settlement amount and, where applicable, non-monetary terms such as debarment periods or undertakings. Not every proceeding is eligible, and the application has timing constraints, so the strategic decision between contesting and settling has to be taken early, with a clear view of exposure, precedent value, business consequences and the realistic timeline of a contested matter through adjudication and appeal.

The choice should be made on analysis rather than instinct. Contesting is right where the facts are genuinely defensible, the point matters beyond this matter, or an adverse finding would be disproportionate. Settling or compounding is right where the lapse is real, the exposure is quantifiable, and management attention and business certainty are worth more than the principle. What is always wrong is drifting into a contested proceeding by default because no one made the decision.

8. Board governance and director exposure

The board's role during an enforcement matter is oversight with a record. Establish a reporting line to the board or a committee, receive regular counsel briefings, record decisions on scope, resolution strategy, disclosure and expenditure, and document the basis on which each was taken. That record is what later demonstrates that the board exercised diligence, and its absence is what makes individual defences difficult to run.

Director exposure varies by statute and by role. Executive directors and officers in default carry the widest exposure; independent and non-executive directors have defences tied to knowledge and diligence, but those defences depend on evidence of what was reported to them, what they asked and what they recorded. Where interests between the company and named individuals may diverge, separate representation should be considered early, along with the position on indemnification, directors' and officers' insurance notification and advancement of legal costs.

For listed companies and regulated entities, there is a parallel governance workstream: disclosure to exchanges, communication with auditors and their assessment of the matter, lender and investor covenants, and the effect on ongoing regulatory approvals or licences. These should be mapped on receipt of the notice, because each carries its own timeline that does not wait for the enforcement matter to develop.

9. After the matter closes

Whatever the outcome, close the loop on the cause. Enforcement matters almost always reveal a control gap: a filing nobody owned, an approval process that was informal, an intercompany arrangement never documented, a monitoring routine that did not exist. Fix the gap, assign an owner, and evidence the fix, because the same regulator or the next one will ask what changed.

Preserve the file. Retain the notice, the investigation record, the reply and annexures, the correspondence, the order and any appeal, in an organised form with a defined retention period. These will be requested in future diligence, credit and licensing processes, and being able to produce a complete, coherent file with a short explanatory note is far better than reconstructing a partial one years later.

Finally, use the experience. A post-matter review with the board covering what triggered the notice, how the response ran, what worked and what did not, and what the organisation now does differently, converts an expensive episode into durable capability. Companies that do this handle the second notice in a fraction of the time and at a fraction of the cost.

Frequently asked questions