No New Named Enforcement Actions — Week of June 9–16, 2026
Bottom line: No new SEC or PCAOB SOX-specific enforcement actions published this week. The SEC's SOX enforcement group, announced March 31, 2026, remains in early-stage operational ramp. Named cases typically trail policy infrastructure changes by 12–18 months. Expect activity in late 2026 or early 2027.
Honest note: This is the third consecutive “no new actions” week. If this continues through June, it means the enforcement group is still in formation and hasn’t begun prosecutions. That changes your risk calculus: you have a window. Use it.
Reference Enforcement Baseline (2024–2025) — Verified Cases
These remain the enforcement pattern to build your posture against. All sourced to SEC Enforcement Releases:
Violation: False Section 906 certification; $20M in sham transactions; CFO certified accuracy he hadn’t verified
Outcome: CFO permanently barred from serving as public company officer; $100K+ disgorgement
What went wrong: Accounts payable controls completely circumvented; certifying officer couldn’t demonstrate any review process.
Violation: ICFR deficiency known in Q3; not disclosed until Q4 annual report; CEO/CFO each certified to accuracy with known control failure
Outcome: $2.75M civil; CEO + CFO each $150K individual penalty
What went wrong: Timing of disclosure — knew in Q3, disclosed in Q4. Section 906 certification was made to a report with a known, undisclosed ICFR failure.
Violation: Revenue recognized before earned; ICFR failed to catch manipulation; CEO/Controller certified accuracy
Outcome: Each $250K civil penalty; restatement required
What went wrong: Certifying to data that hadn’t been verified — the same pattern that triggers 906 exposure.
Violation: No disclosure committee; no formal review procedure; repeated Section 302 failures
Outcome: $3.5M civil penalty; independent consultant required
What went wrong: Certification was a rubber stamp — no process, no documentation, no contemporaneous review.
Violation: Section 404 deficiency identified; remediation started; then abandoned without completion
Outcome: Public enforcement action
What went wrong: Starting remediation then abandoning it — management knew of the issue and walked away.
The enforcement shift is from big financial fraud to certification process failures — officers who signed to disclosure controls and ICFR effectiveness they couldn’t prove they had. The standard isn’t “did you try” — it’s “did you know, and did you certify anyway?”
Sources:
- SEC Enforcement Releases: 2025-041 (Feng), 2025-095 (NuScale), 2025-068 (MicroStrategy), 2025-112 (MathWorks), 2024-089 (Primoris)
Section 906: The Standard That Lands Executives in Prison
Every SOX compliance discussion mentions Section 906. Almost none explain what it actually means for the people signing the quarterly reports.
What Section 906 Actually Requires (18 USC §1350)
Statutory basis: Section 906 sits in the U.S. Criminal Code — not the securities law statutes. It was designed as a criminal backstop to the civil Section 302 certification. The CEO and CFO must certify in each periodic report that: (1) the report fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act; and (2) the information fairly represents, in all material respects, the financial condition and results of operations.
Criminal Penalty Standards: Knowing vs. Willful
| Standard | Maximum Penalty | What It Means |
|---|---|---|
| Knowing violation | Up to $1 million fine + 10 years imprisonment | The officer knew the report contained a material misstatement or omission and certified anyway |
| Willful violation | Up to $5 million fine + 20 years imprisonment | The officer acted with reckless disregard for the truth — prosecutors argue that certifying to controls you don’t have meets this standard |
The willful standard is the one that puts people in prison. Not knowing. Not negligent. Willful. And prosecutors have gotten more aggressive about arguing that certifying to a disclosure controls process you don’t have — while knowing the controls were deficient — meets that standard.
The Critical Difference: Section 302 vs. Section 906
| Section 302 (15 USC §7241) | Section 906 (18 USC §1350) | |
|---|---|---|
| Type of liability | Civil | Criminal |
| Maximum penalty | $5 million | $5M + 20 years (willful) |
| Who certifies | CEO + CFO | CEO + CFO |
| Standard | Reasonable basis | Knowing / willful |
| Prosecution | SEC enforcement (civil) | DOJ prosecution (criminal) |
| Can you go to prison? | No | Yes |
| D&O insurance coverage | Typically covers civil defense | Often excludes intentional/criminal conduct |
- D&O insurance typically covers your Section 302 civil defense
- It may NOT cover a Section 906 criminal prosecution — willful conduct is often not insurable
- Your personal exposure is not fully hedged by corporate insurance
Who Gets Prosecuted? DOJ Selection Factors
DOJ and the U.S. Attorney’s office don’t prosecute every Section 906 case. They select based on:
DOJ Prosecution Selection Criteria:
Defensible Section 906 Certification Process
You can’t testify that you had a reasonable basis for your certification if you don’t have a documented process for how you got that basis.
Components of a defensible certification process:
The Subsidiary & Pre-IPO Trap
Section 906 applies to any officer certifying a periodic report filed with the SEC. The criminal standard extends to:
- CFOs at subsidiaries of public companies who certify to parent company auditors
- Pre-IPO CFOs building certification habits that apply the moment the S-1 is effective
- Officers at companies with debt agreements requiring SOX-like certifications to lenders
Enforcement Trend: Individual Accountability
DOJ has been on a multi-year push for individual accountability in corporate fraud cases:
The SEC refers criminal Section 906 cases to DOJ — and has been doing so more aggressively since 2022. Individual sentences have included actual prison time. The “willful blindness” doctrine has been applied where officers argued they “didn’t know” — courts found that deliberately avoiding learning the truth meets the willful standard.
The question isn’t just “do our numbers add up?” It’s “can our certifying officers show, in documented form, that they had a reasonable basis to certify — and if a prosecutor asks for that documentation, does it exist?”
Sources:
- 18 USC §1350; Pub. L. 107-204 (SOX), Title III, Section 302
- DOJ Individual Accountability Initiative
- SEC Enforcement Referrals to DOJ (FY2024)
- SingerLewak SOX Criminal Liability Analysis (2025)
Audit Your Section 906 Certification Defense File — Before June 30
📋 Pull your Section 906 certifications for the past 4 quarters.
For each one, ask: If a DOJ prosecutor asked the CFO to show documentation of reasonable basis to sign this — would there be anything to show? If the answer is “not really” — that’s your gap.
Run your SOX Pulse → Free, no loginWhat to Build This Week
Three deliverables before June 30:
Why this week: Q2 certification deadlines are imminent. June 30 (non-accelerated filers) is two weeks away. If you don’t have the documentation process in place before you sign, you won’t have it after.
Get your personalized SOX readiness score
Section 302/404/906 status — free, no login required
Filing Deadlines & Upcoming Rule Changes
Q2 2026 Filing Deadlines
| Filer Type | Q2 10-Q Deadline | Notes |
|---|---|---|
| Accelerated Filer | June 9–13, 2026Passed | Depends on fiscal year-end |
| Smaller Reporting Co. | June 16, 2026This Week | Extended to 45 days |
| Non-Accelerated Filer | June 30, 2026Soon | Standard 40-day window — 2 weeks away |
| Large Accelerated Filer (FY Dec 31) | Filing complete | Passed May 30 |
Two SEC Proposals — Comment Deadline July 6, 2026
Proposed: Raises Large Accelerated Filer threshold from $700M to $2B public float; adds 60-month seasoning requirement; exempts ~2,200 additional companies from Section 404(b) auditor attestation.
Action needed: If your company would newly qualify as non-accelerated, submit a comment by July 6 at sec.gov/rules/submitcomment.htm.
Proposed: Allow companies to adopt semiannual (rather than quarterly) reporting. Effect: Section 302 certifications drop from 4/year to 2/year.
Action needed: If your organization has a position, submit by July 6.
December 15, 2026 — 6 Months Away: The PCAOB Standard Cluster
Six PCAOB standards change simultaneously
- AS 2201 (Amended) — Top-down, risk-based ICFR audit approach. Re-scope your controls inventory now.
- AS 1215 (Amended) — 14-day audit documentation deadline (from 45 days). Your team must produce documentation in 2 weeks post-fieldwork.
- QC 1000 — Firm-wide quality control systems. Your audit firm is managing this — ask them how in Q3.
Source: PCAOB Quality Control page; SEC Press Release 2026-46; Harvard Law Forum on Corporate Governance, May 18, 2026