German Dawn Raid at Your Company: What to Do When Investigators Arrive

A German dawn raid, with your company’s investigators arriving unannounced usually early in the morning at your reception desk, is one of the most stressful moments any business leader will face, and the decisions made in the first hour can shape the entire criminal proceeding that follows. This guide is written for in-house counsel, compliance managers, security teams and members of the C-suite who need calm, practical direction the moment a search begins. 

The single most important action is to stay composed, document everything, and contact experienced criminal defence counsel without delay.

Quick overview, what a “dawn raid” is under German law

A “dawn raid” (Durchsuchung) is an unannounced search of business or private premises carried out by investigating authorities to secure evidence relevant to a criminal or regulatory investigation. The term reflects the practical reality that searches often begin early in the morning to catch a company before documents can be moved or systems altered. In Germany, the powers to search and seize are governed principally by the StPO, which sets out both the authority to act and the safeguards that protect those being searched.

Legal basis (StPO)

First, a preliminary investigation is required. For that, all that is required is what is known as “initial suspicion”: Concrete factual indications, based on criminal investigative experience, are sufficient to establish that a crime has been committed and to start formally an investigation.

Searches and seizures are regulated by the search and seizure provisions of the StPO (in particular §§ 94 et seq. on seizure and §§ 102 et seq. on searches). These provisions establish that a search must generally be authorised by a judicial order, define the scope of what may be searched and seized, and set out the procedural rights of those affected. The key issue is whether the search of her company constitutes a search of a suspect (§ 102) or a search of other individuals (§ 103). Only in the first case  the preliminary proceedings are directed against the company’s responsible parties and/or the company itself. In the second case, the investigation is directed against one of your business partners, for example, but the investigating authorities are searching your premises for documents, data, etc.. 

Who may attend and typical triggers

A range of authorities may appear at your door. The public prosecutor’s office (Staatsanwaltschaft) usually directs the investigation, supported by police officers, and in significant matters by the Federal Criminal Police Office (Bundeskriminalamt, BKA) or specialist units. In tax matters, tax investigation officers (Steuerfahndung) may attend. In regulatory or competition matters, specialist investigators, including officials of the Federal Cartel Office (Bundeskartellamt), may be involved. In cases involving certain offenses, such as illegal employment, customs officials may appear. Investigations by the European Commission or other European institutions are also possible. Typical triggers include suspected white-collar offences such as fraud, corruption, embezzlement, tax evasion, money laundering, and competition law infringements. When investigators cross the threshold, it usually means a formal criminal investigation is already under way and your organisation is either a suspect or a source of evidence.

Do investigators need a warrant? 

The general rule under the StPO is that a search requires a judicial search warrant issued by a judge. This judicial reservation exists to ensure that an independent authority has assessed the grounds for the search before your premises are entered. However, the law recognises limited exceptions, and understanding them is essential to knowing how to respond when investigators arrive.

Reviewing the warrant, what to check

When investigators present themselves, your first substantive step is to ask to see the written search warrant (Durchsuchungsbeschluss) and to record its details carefully. Note the following:

• Issuing court. Which court issued the order, and is it competent?
• Date and signatures. When was it issued and is it properly signed by a judge?
• Scope. What premises, what categories of documents or data, and what suspected offence does it cover?
• Named persons or entities. Who is the suspect, and is your company named as a target or a third party?
• Age of the order. Case law indicates that a search order that has not been executed within roughly six months of issue may lose its legitimising force; note the date carefully.

Make a photocopy or photograph of the warrant if permitted, and record the names and service identification of the officers present. Forward a copy to your defense lawyer for verification. The scope of the warrant defines the lawful boundaries of the search, items and areas outside that scope generally cannot be searched or seized without further justification. Please note, however, that investigative authorities today are so professionally organized that they can have the necessary amendments to a search warrant made promptly—in some cases, within hours. 

Two principal situations allow a search without a prior judicial warrant. The first is genuine consent, where the person entitled to the premises voluntarily agrees to the search. The second is Gefahr im Verzug, danger in delay, where obtaining a judicial order would risk the loss or destruction of evidence. 

Immediate actions when investigators arrive, the 12-step checklist

The operational playbook below covers the critical first hours. When investigators arrive, discipline and documentation are your best allies. Establishment of appropriate procedures and written guidelines for conduct in the event of an emergency, as well as training for the individuals involved will help you.

1. Stay calm and courteous. Greet investigators professionally and do not attempt to delay their lawful entry.
2. Clarification of the identity of the search officers, or at least of the officer in charge of the search.
3. Ask to see the warrant and read it carefully. Record the issuing court, date, scope and named suspects.
4. Immediate notification of company management and the defense counsel. Reception staff should have a list of key contacts (management, external criminal defense counsel, etc.) that includes their contact information (Mobile, Email., etc.). All major decisions are made solely by the responsible team (if necessary, with the involvement of external criminal defense counsel)
5. If formal interrogations are to take place: Clarification of the status of the person to be interrogated (suspect or witness). It is advisable to remain silent—avoid making statements, spontaneous remarks, and even seemingly.
6. Determine where the evidence covered by the search warrant is physically located. Employees are not
   required to actively cooperate, nor are they required to provide information. Depending on the allegations, various departments may be involved, but at a minimum these include the legal department, the compliance office, accounting, etc.
7. Who will accompany the officials? (Caution: “shadowing”)
8. Where is the IT department? What measures are required to mirror the server? What support should the company’s own IT staff provide in this regard? In principle, there is no obligation to disclose passwords for computers or cell phones. In individual cases, it makes sense to do so to prevent the entire computer system or hard drive from being taken away.
9. Ensure proper supervision of the preparation of the seizure inventories. Request a copy. Have any objections to the seizure recorded in the minutes.
10. Do not resist; remain calm and objective. Under no circumstances should officials be obstructed, documents be removed, data be deleted, or third parties be warned. Suspending automatic deletion is critical. Any obstruction of the officials’ work may result in severe sanctions for the company/institution and the individuals involved; for the latter, this may include pretrial detention due to the risk of tampering with evidence.
11. Notify the necessary internal stakeholders, the board, the data protection officer and, if appropriate, senior compliance, on a need-to-know basis.
12. Begin a written incident report capturing the sequence of events, the officers involved, the items seized and the times.

Who should speak to investigators, internal spokespeople and example scripts

One of the most damaging errors during a search is uncontrolled communication. Multiple employees speaking to officers, offering informal explanations or “helping” by volunteering context can generate statements that are later used against the company. When investigators are on site, channel all substantive communication through a single, designated spokesperson.

Example scripts

• Requesting the warrant: “May I please see the written search order and identify the officers present? I would like to record the details for our records.”
• Declining to volunteer information: “I am the designated company contact. We will cooperate with the lawful scope of the warrant, but I am not able to answer questions on the substance until our counsel is present.”
• Requesting time for counsel: “Our external lawyer is on the way. We ask that you allow us to consult before any statements are taken.”
• Offering document locations: “The documents within the scope of your order are located in the following area; we will bring them to a central point for review.”

Common mistakes that undermine later defence

Many of the errors that damage a company’s position are avoidable and stem from panic rather than bad faith. When investigators are present, awareness of these pitfalls is itself a form of protection.

• Obstructing investigators. Physical interference or refusing lawful access can constitute an offence and undermines credibility.
• Destroying or altering files. Shredding documents or deleting data after a search begins is among the most serious mistakes and may create fresh criminal exposure.
• Unsupervised access to seized systems. Allowing staff to touch sealed or imaged systems compromises the chain of custody and your defence.
• Giving verbal admissions. Informal, unrecorded statements to officers are frequently the most damaging evidence.
• Allowing copying of privileged files. Permitting review of privileged material without objection can prejudice later protection.
• Poor documentation. Failing to record what happened leaves you unable to challenge irregularities later.

Real-world patterns

Common anonymised patterns illustrate the risk. A manager, hoping to appear cooperative, explains the “background” to a transaction and inadvertently supplies the prosecution’s narrative. An IT administrator, trying to be efficient, restarts a server and disrupts a forensic image. An assistant, following a routine, empties a shared drive of “old” files hours into a search. Each of these well-intentioned acts can transform a defensible position into a serious problem.

Documenting the search and post-raid steps

Thorough, contemporaneous documentation is your strongest tool for later challenge and internal accountability. The goal is a clear, timestamped record of everything the investigators did and everything they took.

Template for minutes of search

Maintain a “minutes of search” record that captures: the date and times of arrival and departure; the names and identification of officers; the warrant details; each area searched; every item inspected and seized; who from the company accompanied each officer; any statements requested or made; and any objections or privilege claims asserted. Have the record signed off by your spokesperson at the end of the search, and cross-check it against the investigators’ own seizure list (Sicherstellungsverzeichnis or Beschlagnahmeverzeichnis).

Evidence chain best practices

Insist on receiving a written seizure list detailing every item taken, with serial numbers where relevant. Photograph seized items and packaging where permitted. Record who handled forensic images and how they were sealed and transported. After the search, consolidate the minutes, the seizure list, photographs and the incident report into a single secure file, retain your own lawful copies of business-critical data, and consider whether the board, shareholders or regulators need to be informed. Coordinate any external communications carefully to avoid prejudicing the defence.

Emergency contacts, who to call

Speed matters. Keep a printed emergency contact card at reception, in the legal department and with security so that the right people are reached within minutes of a search beginning.

Example contact priority order

• External criminal defence counsel. The first call, before any substantive engagement with investigators.
• Internal legal / compliance lead. To coordinate the on-site response and designate the spokesperson.
• IT and forensic support. To preserve systems, suspend deletion routines and manage imaging.
• Data protection officer. To manage GDPR and BDSG obligations where personal data is accessed.
• Board contact and communications lead. For governance notifications and controlled external messaging.

Practical annexes, checklists, scripts and templates

Prepare the following assets in advance so they can be deployed instantly during a search. Store them where they can be reached without accessing systems that may be sealed.

• One-page dawn raid checklist. A printable card summarising the first-hour steps for reception and security.
• Minutes of search template. A structured document to record officers, times, areas searched and items seized.
• Emergency contact sheet. The priority call list with counsel, IT, forensics, DPO and board contacts.

Conclusion and next steps

When investigators arrive for a German dawn raid, the outcome of the ensuing investigation is influenced heavily by the first sixty minutes: see the warrant, appoint one spokesperson, call counsel, preserve rather than destroy, and document everything. Prepare the checklists, scripts and templates in this guide now, while there is time to do so calmly, so that your team can act with discipline under pressure. If investigators are on site now, contact experienced German criminal defence counsel immediately for case-specific assistance.

Sources

1. Strafprozessordnung (German Code of Criminal Procedure, StPO)
2. Grundgesetz, Article 13 (inviolability of the home)
3. Bundesministerium der Justiz (Federal Ministry of Justice)
4. Bundesverfassungsgericht (Federal Constitutional Court)
5. Bundesgerichtshof (Federal Court of Justice)
6. Deutscher Anwaltverein (German Bar Association)
7. GDPR (Regulation (EU) 2016/679), EUR-Lex
8. Bundesamt für Sicherheit in der Informationstechnik (BSI)
9. Max Planck Institute for the Study of Crime, Security and Law