Our firm has seen a marked rise over the past year in regulatory subpoenas, civil investigative demands, and other investigative inquiries directed at debt settlement and debt relief law firms by state attorneys general and state financial regulators. The trend reflects the continued expansion of state UDAP and UDAAP authority, together with a broader enforcement environment in which state offices increasingly act as primary consumer-protection enforcers, particularly where federal enforcement priorities shift.[1] Equally important, these investigations frequently look beyond UDAP and UDAAP to whether the law firm’s activities in the state comply with that state’s debt adjustment, debt management, or debt settlement statute, which in most jurisdictions imposes licensing, fee, and disclosure requirements that are independent of the deception-based UDAP analysis.
For a law firm receiving one of these demands, the threshold concern is substantive. A significant portion of the material the issuing office will demand is likely to be protected by the attorney-client privilege, the work product doctrine, or the firm’s ethical obligations of confidentiality to its clients. Productions made without a worked-through privilege framework are very difficult to claw back, and even an inadvertent disclosure can be construed as a waiver. Two questions therefore arise at the threshold: how to narrow the scope of the demand to what the law actually requires, and how to identify and assert privilege over material that cannot be disclosed without client consent.
I. The Privilege Issue at the Threshold
In a debt relief practice, retainer files, intake records, fee ledgers, settlement correspondence with creditors, internal supervision memoranda, and time records may all reflect communications protected by the attorney-client privilege as articulated in Upjohn Co. v. United States[2] or work product protected under analogous federal and state authorities. The point is not that these categories are categorically privileged. They often are not. The point is that, in a law firm debt relief practice, seemingly administrative records may embed legal advice, client confidences, settlement strategy, creditor-specific analysis, or attorney mental impressions, and a careful review is required to identify what is protected before any production is made.
Two principles structure the analysis. First, the privilege belongs to the client, not the lawyer. A firm cannot waive it for convenience, and ordinarily, absent a valid non-disclosure restriction or other legal limitation, the firm should notify the client of the demand so that the client can decide whether to assert, waive, or seek protective relief on its own. The New York City Bar addressed this directly in Formal Opinion 2022-1, which provides that a lawyer receiving a subpoena seeking client information must communicate with the client, seek consent, and, if consent is not received, assert reasonable objections and produce only what is not subject to those objections.[3] Most jurisdictions impose similar obligations under their versions of Model Rule 1.6. It is worth noting that ethical confidentiality under Rule 1.6 is broader than evidentiary privilege, but it is not identical to privilege and does not, by itself, resolve whether a particular document must ultimately be produced in response to lawful compulsory process. It does, however, require the firm to treat the demand as a client-protection issue rather than a routine records request.
Second, work product is independent of the attorney-client privilege and protects materials prepared in anticipation of litigation. In a debt relief practice, work product may include attorney notes concerning settlement strategy, internal memoranda evaluating creditor positions, litigation-risk assessments, and communications prepared because of anticipated disputes or litigation. Inadvertent disclosure to a state office can be construed as waiver, as illustrated by SEC v. Herrera, where a federal court found waiver based on a law firm’s oral briefing of witness interviews to the SEC during an investigation.[4]
One related issue worth flagging is dual-purpose communications. Many internal communications in a debt relief firm combine legal direction with operational discussion of consumer accounts, fee handling, or account servicing. The Supreme Court declined to resolve the circuit split between the “primary purpose” and “significant purpose” tests in In re Grand Jury[5], so the applicable test depends on the jurisdiction. Identifying and segregating these communications early is generally the most reliable way to preserve protection.
II. Narrowing the Scope of the Demand
The first step on receipt of a subpoena or CID is to preserve procedural rights. State CID statutes typically provide short windows in which to file an objection or a motion to quash or modify the demand, and missing those windows can waive the right to challenge overbreadth, burden, or privilege later. In New York, for example, CPLR 2304 requires that a motion to quash be made “promptly” in the court in which the subpoena is returnable.[6] Preserving these procedural rights does not mean exercising them immediately. In most matters, the better practice is to keep them in reserve while pursuing resolution through dialogue with the issuing office.
The next step is usually a short letter to the issuing office confirming receipt, identifying counsel, and requesting an initial meet-and-confer. That conversation should include a request that the office articulate, with reasonable specificity, the conduct or theory under investigation. In many matters, state offices are willing to engage on this point, because a focused production is more useful to them than a warehouse of documents that they then have to triage. The conversation should also identify, in general terms, the categories of material the law firm believes are subject to attorney-client privilege or work product protection, and propose narrowing the scope of the demand to exclude them.
Several techniques tend to produce results. Phased production allows threshold materials to be produced first, typically organizational documents, retainer templates, fee structures, and marketing pieces, before turning to client-specific records. Sampling is appropriate when a demand reaches thousands of consumer files. Temporal narrowing addresses lookback periods that exceed the statute of limitations or predate statutory amendments. Custodian narrowing limits ESI collection to identified custodians rather than the full firm, which matters in a law firm setting because broad collection sweeps in unrelated client matters. Public-records exposure should also be addressed, as material submitted to a state office may, once the investigation closes, become subject to that state’s freedom-of-information statute. Where production is ultimately required, the firm should also consider whether materials should be produced subject to a written confidentiality agreement, statutory confidential-treatment request, protective order, or express reservation that production is not a waiver of attorney-client privilege, work product, client confidentiality, or objections to future use.
III. Asserting Privilege, and Court as a Last Resort
Scope and privilege should be approached as parallel workstreams, and concessions on scope should not become implicit concessions on privilege. A privilege log should be prepared contemporaneously with each tranche of production, with enough specificity to support the assertion but without disclosing the protected substance. Entries that are too cryptic invite motion practice. Entries that are too detailed risk waiver.
Client notification is a recurring and sometimes overlooked element. The privilege belongs to the client, and the obligation to notify rarely disappears because notification is administratively inconvenient. Where the demand contains a non-disclosure provision, the scope of that provision can be addressed with the issuing office so that the firm can satisfy its obligations under Rule 1.6 and Formal Opinion 2022-1 without breaching the order. Where notification is permitted, it should be documented contemporaneously, and clients should have the opportunity to assert their own privilege rights or retain separate counsel if they prefer.
Disagreements with the issuing office over privilege are not unusual. Most are resolved through dialogue: discussing what is and is not privileged, what should be withheld, and how the scope of the demand can be narrowed to exclude protected material. If the issuing office accepts a properly framed assertion of privilege, the matter typically proceeds on that basis. Where the office disagrees with the privilege assertion and is unwilling to accept narrowing, challenging the subpoena in court, including by motion to quash, may become an option. That route, however, is a last resort and should be approached with care. Judicial intervention is costly, time-consuming, and visible on the public docket, and it is rarely the outcome either side wants. In most matters, the better path is to resolve the disagreement short of court, through in camera review, attorney affidavits, supplemental log detail, or a narrowing of the disputed category.
[1]See Fostering Affordability and Integrity Through Reasonable Business Practices Act, ch. 708, 2025 N.Y. Sess. Laws (S.B. S8416) (signed Dec. 19, 2025) (amending N.Y. Gen. Bus. Law § 349 to add prohibitions on unfair and abusive acts and practices); see also CFPB, Strengthening State-Level Consumer Protections (Jan. 2025) (recommending that state attorneys general “should not have to petition a court prior to issuing a subpoena or civil investigative demand”); New York Enacts FAIR Business Practices Act, Debt Relief Watch (Jan. 8, 2026). State attorneys general also possess concurrent authority to enforce the federal consumer financial laws under 12 U.S.C. § 5552.
[2]Upjohn Co. v. United States, 449 U.S. 383 (1981).
[3]N.Y.C. Bar Ass’n Comm. on Prof’l Ethics, Formal Op. 2022-1 (2022).
[4]SEC v. Herrera, No. 17-20301 (S.D. Fla. Dec. 5, 2017).
[5]In re Grand Jury, 23 F.4th 1088 (9th Cir. 2022), cert. dismissed as improvidently granted, 143 S. Ct. 543 (2023) (per curiam).
[6]N.Y. C.P.L.R. § 2304.