The First 72 Hours: The Regulatory Intelligence You Wish You’d Had Earlier

When an enforcement matter surfaces, the firm’s posture is set in the first three days, long before most teams have assembled the facts.

It tends to begin with a phone call, an internal flag, or a whistleblower complaint that lands on a Friday. For the next three days, a firm that has spent years building a compliance programme finds itself improvising: pulling fragments of information from different systems, running manual research against rules nobody has read closely in months, and drafting careful words to a regulator with far less clarity than the moment deserves.

The uncomfortable part is that those three days often matter more than everything that follows. In many enforcement contexts, the opening hours set the trajectory of the entire matter: the tone taken with the regulator, the scope of the internal investigation, the decision on whether and what to disclose. All of it turns on what the firm actually knows, and how quickly it can know it.

The gap is not information. It is retrieval.

Most firms in this situation are not short of information. They are drowning in it. Compliance holds part of the picture, legal holds another, operations and the front office hold the rest. The specific rules and guidance the issue triggers are scattered across sources. The prior enforcement cases that would tell the firm how regulators have treated this exact fact pattern are sitting in public records that no one has time to assemble at speed.

So the problem is rarely a missing document. It is the inability to surface the right information at the right moment, and that inability is never more expensive than in the first hours of an inquiry.

The symptoms are familiar to anyone who has lived through one. Document collection goes deliberately over-broad, as a defensive reflex. Early communications turn vague and over-cautious, in a way that can later read as evasive. The investigation gets scoped around whatever data is easiest to pull rather than what is most relevant. Each of these tells the regulator the same thing: this firm does not yet have control of its own situation.

Credibility in an enforcement matter is built in the first three days, and it is built on how quickly the firm can see its own position clearly.

What the first 72 hours look like when the gap is closed

The firms that come through these moments well are usually the ones that could establish the facts and the regulatory exposure quickly, while there was still time to shape the response. That is less about having more people on the phone and more about being able to answer three questions fast.

What rules and precedent does this actually trigger? Rather than starting from a blank page, the team can identify the specific rules, guidance, and enforcement precedents the issue raises across the relevant jurisdictions, and read them against the facts in hand. This is precisely the kind of on-demand research a tool like Sherlocq is built for: a direct question returning a sourced, traceable answer in minutes, not days of manual trawling.

What does our own documentation actually show? Document analysis surfaces the gaps and benchmarks what the firm has against the applicable standard, so the team works from a structured view of what happened rather than a half-remembered one.

What scope can we defend? With the rules mapped and the facts established, the firm can set a controlled scope and engage the regulator from genuine understanding rather than defensive instinct.

The compounding effect is what matters. When an issue can be mapped to specific rules and precedent in hours, early communications become controlled and credible. When the investigation is scoped on real data rather than instinct, fewer surprises emerge later. And when remediation begins promptly and demonstrably, regulators tend to treat that as a genuine mitigating factor. Firms that reach a negotiated settlement rather than a protracted, contested enforcement action are very often the ones that showed early, credible control, control that was established in the first three days.

Build the capability before you need it

None of this can be assembled at the moment. The intelligence that changes the first 72 hours has to be in place before the call comes, not as a standing surveillance system watching the firm, but as the ability to research the regulatory landscape quickly and precisely when something surfaces.

You will not control whether a 72-hour moment arrives; most regulated firms eventually face one. What you can control is whether, when it does, you can see your own position clearly while it still makes a difference. Increasingly, regulatory outcomes are shaped not only by what happened but by how capable a firm responded once it came to light, and that capability is a choice made well in advance.

See how compliance and legal teams use Sherlocq to map an issue to the relevant rules and enforcement precedent across jurisdictions in minutes. Book a private demo at sherlocq.com