Home › SOX Certification › Section 906
⚠️ Section 906 · 18 USC §1350 · Criminal Certification

SOX Section 906
Criminal Certification

12-item checklist covering all Section 906 criminal certification requirements. The highest personal liability provision in SOX — $5M and 20 years for willful violations.

$5M
Max Fine (Willful)
20yr
Max Prison (Willful)
$1M
Max Fine (Knowing)
10yr
Max Prison (Knowing)

⚠️ Criminal Liability Warning

Section 906 certifications expose CEOs and CFOs to federal criminal prosecution. There is no materiality threshold — any false statement in the certification, however minor, can trigger prosecution if knowingly made. This checklist is for preparation purposes only. Consult qualified securities counsel before filing.

⚖️ Section 906 Penalty Schedule (18 USC §1350)

Violation Type Max Fine Max Prison Standard of Intent
Knowing false certification $1,000,000 10 years 18 USC §1350(c)(1)
Willful false certification $5,000,000 20 years 18 USC §1350(c)(2)
Document destruction (obstruction) Fine per 18 USC §3571 20 years 18 USC §1519 (Section 802)
Securities fraud Up to $5,000,000 25 years 18 USC §1348
Certification Readiness
0%
1. Certification Content Requirements 18 USC §1350 · SEC Rule 13a-14(b)
Report fully complies with Exchange Act Section 13(a) or 15(d)
The Section 906 certification must affirmatively state that the periodic report "fully complies" with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934. Officers must verify that all required disclosures are present and the report meets all applicable Exchange Act form requirements — including timing, signature, and content.
18 USC §1350(a) · Section 13(a) Exchange Act · Rule 13a-14(b)
Critical
Information fairly presents financial condition and results
The certification must state that information in the report "fairly presents, in all material respects, the financial condition and results of operations of the issuer." Unlike Section 302's GAAP-centric language, Section 906 uses a broader "fairly presents" standard — requiring accurate portrayal even if technical GAAP compliance exists. This is the most heavily litigated element of Section 906.
18 USC §1350(b) · SEC Release 33-8212 (2003)
Critical
Officers have independent basis for certification — not solely relying on Section 302
Section 906 is a separate criminal certification from Section 302. Officers should have an independent basis for signing — typically sub-certifications from their direct reports, review of audit committee findings, management representation letters, and internal audit reports. Signing Section 906 based solely on signing Section 302 (without independent verification) increases criminal exposure if Section 302 underlying assertions were inaccurate.
DOJ Prosecution Guidance · SEC v. CEO guidance
Critical
2. Exhibit 32 Preparation and Filing SEC Rule 13a-14(b) · S-K Item 601(b)(32) · Release 33-8212
Exhibit 32.1 uses exact statutory certification language
Section 906 certification language is prescribed by statute (18 USC §1350). The certification cannot be modified, qualified, or conditioned. Common errors: adding "to my knowledge" qualifiers (not in the statute), limiting to material respects (the statute says "fully complies"), or adding hedging language. Exhibit 32.1 is furnished, not filed — but criminal liability under §1350 applies regardless of this distinction.
18 USC §1350(a)–(b) · S-K Item 601(b)(32) · Release 33-8212
Critical
Both CEO and CFO sign Exhibit 32
Section 906 requires signatures from both the CEO (principal executive officer) and the CFO (principal financial officer). This can be a single Exhibit 32.1 with both signatures or separate Exhibits 32.1 and 32.2. Neither officer can omit signing. If the CFO role is vacant or in transition, the acting CFO must sign.
18 USC §1350 · Rule 13a-14(b) · S-K Item 601(b)(32)
Critical
Exhibit 32 "furnished" not "filed" — understand the distinction
Per SEC Release 33-8212, Exhibit 32 is "furnished" pursuant to 18 USC §1350 rather than "filed." This means it is not automatically incorporated by reference into registration statements and is not subject to Section 18 liability for false statements. However: (1) criminal liability under 18 USC §1350(c) is unaffected; (2) SEC civil enforcement authority remains; (3) private securities fraud claims may still reach Section 906 certifications via other theories.
SEC Release 33-8212 (2003) · S-K Instruction to Item 601
High
Exhibit 32 submitted concurrently with the periodic report
The Section 906 certification must accompany each 10-K and 10-Q at filing — it cannot be filed as an amendment after the fact. Late filing of Exhibit 32 constitutes a separate disclosure violation. If an officer cannot sign at filing time due to medical or other emergency, companies should consult counsel immediately — there is no formal late-filing procedure for Section 906 certifications.
Rule 13a-14(b) · SEC Release 33-8212
High
3. Criminal Exposure Risk Management DOJ Prosecution Guidance · 18 USC §1350(c)
No known misstatements in the periodic report before signing
Officers must confirm — through independent review and sub-certification process — that they are not aware of any false statements of material fact or material omissions in the report at the time of signing. Knowledge of a false statement before signing transforms the certification into a "knowing" violation triggering criminal liability under 18 USC §1350(c)(1). No de minimis exception exists.
18 USC §1350(c)(1) · DOJ Criminal Division guidance
Critical
Officers reviewed audit committee reports and auditor findings before certifying
Before signing Section 906, officers should confirm they reviewed: (1) audit committee meeting minutes and findings; (2) management representation letters to external auditors; (3) external auditor's Summary Review Memorandum or clearance communications; (4) internal audit reports for the period; (5) any SEC comment letter responses. These reviews form the factual basis for the certification and reduce criminal exposure.
DOJ Prosecution Standards · SEC Enforcement Division
Critical
Outside securities counsel reviewed certification before filing
Given criminal exposure, best practice requires outside securities counsel review of: (1) the Exhibit 32 certification text for statutory compliance; (2) any concerning disclosures in the report that might affect the "fully complies" assertion; (3) any known SEC investigations, restatements under consideration, or audit disputes. Counsel review is a strong affirmative defense element in criminal prosecutions ("reliance on counsel").
Best Practice · DOJ Prosecution Factors
High
No ongoing SEC investigation or restatement discussion that would affect the certification
Officers must assess: Is there an active SEC informal or formal inquiry? Are there any pending restatement discussions with the auditor? Has the audit committee received any whistleblower tips that have not been resolved? Certifying while aware of an ongoing investigation or potential restatement significantly increases criminal exposure and should trigger immediate consultation with outside counsel.
18 USC §1350(c) · DOJ Criminal Enforcement Priorities
High
Officers documented the basis for their certification (file memo)
Best practice: CEOs and CFOs should prepare a brief certification memo — a written record of the key information sources reviewed before signing (audit committee reports, sub-certifications, auditor communication, material items reviewed). This documentation protects against "willful" prosecution by demonstrating the officer exercised reasonable diligence and acted in good faith based on available information.
Best Practice · DOJ McNulty Memorandum standards
Medium

Assess Your Section 906 Risk Exposure

After marking your checklist, click below. AI analyzes your certification readiness and identifies specific criminal exposure vectors based on incomplete items.

—
—
—

🚨 Criminal Exposure Vectors

📋 Risk Reduction Steps

Generate Section 906 Certification Package

Export your Section 906 readiness findings for your legal team and audit committee.

Free

Criminal Risk Summary

1-page summary of your Section 906 certification readiness, risk exposure, and immediate actions needed.

  • Current checklist completion status
  • Active criminal exposure vectors identified
  • Pre-signing action items
  • Statutory certification language reference
Premium · $79

Full 906 Compliance Package

Complete Section 906 documentation package for your attorneys and compliance team.

  • Statutory certification language template (Exhibit 32.1)
  • Officer certification memo template (knowledge basis)
  • Pre-certification review checklist for legal counsel
  • Criminal exposure risk assessment with DOJ factor analysis
  • Reliance-on-counsel documentation template
  • Audit committee briefing on Section 906 obligations

Section 906 FAQs

Under 18 USC §1350, each periodic report must be accompanied by a written statement by the CEO and CFO certifying: (1) the report "fully complies" with Section 13(a) or 15(d) of the Exchange Act; and (2) information in the report "fairly presents, in all material respects, the financial condition and results of operations." Filed as Exhibit 32.1 (furnished, not filed). Knowingly false: $1M + 10yr. Willfully false: $5M + 20yr.

Knowing (§1350(c)(1)): Officer certifies knowing the certification is false — i.e., officer had actual knowledge that the report contained false statements or omissions. Max: $1M + 10yr. Willful (§1350(c)(2)): Officer intentionally certifies with deliberate disregard of known legal obligations — a higher standard requiring evidence of intentional unlawfulness. Max: $5M + 20yr. In practice, DOJ typically charges "knowing" violations based on circumstantial evidence (officer had access to correcting information, ignored red flags from subordinates, etc.). "Willful" requires stronger evidence of affirmative intent to deceive.

Yes. Section 906 certifications are required with every 10-K (annual) and every 10-Q (quarterly). They must accompany each filing — not just the annual report. Foreign private issuers filing on Form 20-F (annual) and Form 6-K (certain current reports) must also provide Section 906 certifications where applicable. The certification is attached as Exhibit 32 (furnished) to each filing, alongside the Section 302 certifications (Exhibits 31, filed).

Not necessarily. The Section 906 standard is "fairly presents, in all material respects, the financial condition and results of operations" — this is a broader standard than GAAP compliance. In SEC v. Lucent Technologies and related enforcement actions, the SEC has argued that technical GAAP compliance does not automatically satisfy the "fairly presents" standard if the presentation is misleading in context. Officers should not assume GAAP compliance is sufficient protection — substance-over-form concerns, non-GAAP presentation issues, and misleading MD&A language can all potentially implicate Section 906 even with clean audit opinions.

← All SOX Certifications §302 Quarterly Cert §404 ICFR Assessment Full Penalty Reference SOX Pulse Score SOX Framework Guide
Assess Risk Now →