Kunal Gupta
Senior Partner – Forensic Investigation, Data Analytics & Risk Consulting
Lawyer · Company Secretary · Certified Fraud Examiner · 12+ years
Investigations
Crisis Management & Regulatory Response
A written crisis protocol, role-specific preparation and a rehearsed first-72-hours response, so every function knows what is expected of it when a regulator arrives unannounced or an enforcement action begins.
The questions a crisis asks
- Who verifies the warrant and its scope, and who notifies counsel?
- How quickly can counsel, forensic and PR support reach each site?
- What may staff say to officials, and what must they never do?
- How is privileged material identified and protected before seizure?
- Who shadows and logs every document, device and question taken?
- What do the Board, auditors, lenders and disclosure rules require in the days after?
Indian enforcement is now faster, more coordinated and more personal. The Enforcement Directorate, CBI, SFIO, CCI, DRI/DGGI and SEBI increasingly arrive unannounced, often in parallel, and the exposure frequently attaches to individual officers, not just the balance sheet. How an organisation behaves in the first 72 hours of an unannounced regulatory visit, a search and seizure or an enforcement action is the one variable it still controls. We build that readiness through a documented crisis protocol and role-specific preparation, and we work alongside counsel when the protocol is activated, so that the organisation is cooperative with the authorities, protective of privilege and incapable of accidentally obstructing.
How we do it
Our method
- 1
Diagnostic
Map regulatory exposure, sites, custodians and the current state of privilege, retention and response arrangements.
- 2
Role-specific simulated sessions
Separate tracks for senior management and the Board, finance, IT and systems, legal and compliance, and front-office and general staff.
- 3
Organisational crisis simulation
A full tabletop simulation of an unannounced regulatory visit that tests the protocol, the call tree and every function's response under pressure.
- 4
Written crisis policy
A customised protocol, call tree, privilege guide, employee card and Board escalation matrix as the takeaway.
- 5
Counsel-delivered legal modules
Modules that turn on legal advice, including privilege and personal liability, are delivered by or jointly with the client's counsel.
- 6
Response when the protocol is activated
When an enforcement action begins, we work alongside counsel to activate the protocol, preserve evidence under chain of custody and prepare officers for summons.
Deliverables
- Customised written crisis policy: protocol, call tree, privilege guide, employee card and Board escalation matrix
- Role-specific simulated training sessions
- Full organisational crisis simulation (tabletop)
- Privilege architecture, retention and litigation-hold arrangements, and a named response team
- Pre-approved counsel, forensic and PR panel and site maps
- Quarterly red-flag health-check
Role-segregated training tracks
- 01
Senior management & Board
Regulatory exposure, escalation ownership, external and investor messaging, personal liability and privilege.
- 02
Finance
Red-flag transactions, record-keeping, handling data requests, preservation with legal.
- 03
IT & systems
Data preservation, access control, device and backup handling, a single point for legal's data requests.
- 04
Legal & compliance
The command centre: privilege management, document logging, officer coordination and response strategy.
- 05
Front office & general staff
Do's and don'ts with officials, immediate notification protocol, avoiding inadvertent waiver.
The crisis protocol: before, during and after
- 01
Before: preventive readiness
Privilege architecture. Retention and litigation hold. Named response team and call tree. Pre-approved counsel, forensic and PR panel. Site maps. Quarterly red-flag health-check.
- 02
During: immediate response
Verify warrant and scope. Notify counsel. Shadow and log every document, device and question. Assert privilege. Truthful, brief answers. No deletion or backdating, ever.
- 03
After: stabilisation and response
24-hour debrief and seizure inventory. Group litigation hold. Privileged review of exposure. Representations and bail readiness. Board, auditor, lender and disclosure obligations.
The enforcement climate
- Enforcement Directorate: PMLA s.17 search and seizure, s.19 arrest, s.50 summons. Scheduled offences now span the PC Act, Companies Act fraud and customs. FEMA s.37 enquiries run alongside.
- CBI and State ACBs: the Prevention of Corruption Act with the 2018 amendments, s.8 (bribe giver), s.9 (commercial organisations) and the s.17A sanction regime. Corporate liability is now on the statute book.
- SFIO, DRI/DGGI, SEBI and CCI: Companies Act s.212/447 probes, Customs s.105 and CGST s.67 searches, SEBI Act s.11C seizure reaching personal devices, and CCI s.41(3) dawn raids in cartel matters.
Case studies
How it plays out in practice.
Illustrative composites. Names, figures and timelines are indicative; no client is identifiable.
Also in Investigations
- Internal InvestigationsCounsel-led fact-finding with forensic execution. Findings that hold up before boards, audit committees, auditors and regulators.
- Digital Forensics & E-Discovery ReviewsDefensible preservation, recovery and review of digital evidence across devices, mailboxes, chat and logs, turned into an evidence trail that stands up before regulators and courts.
- Market IntelligenceDiscreet market, vendor and competitor enquiry through pretext outreach, discreet calls and on-ground checks. Understanding the market as it really is: priced, positioned and behaving.
- OSINT & Desktop ProfilingDeep open-source research and digital-footprint analysis to profile entities and individuals remotely and at scale. A complete picture, built entirely from open, lawful sources.
- Asset TracingLocating and mapping hidden, undisclosed or dissipated assets across property, banking and corporate structures, and building the trail to recover them.
- Skip TracingLocating absconding individuals, from debtors and guarantors to fraudsters, and confirming their whereabouts on the ground.
How an engagement starts
Tell us what you can’t see.
Every engagement starts with a confidential conversation. No matter is too early, or too sensitive, to raise. A partner replies within one working day.
- 01
A 30-minute call
To align on the question, the team and the sites involved.
- 02
A fixed-scope proposal
A tailored scope and fee note within five working days.
- 03
Discreet execution
Small senior teams, conflict-checked, DPDP and GDPR compliant handling.