Last Modified: October 14, 2026
Table of Contents
SEC Rule 13a-14, codified at 17 C.F.R. § 240.13a-14 under the Securities Exchange Act of 1934, implements the certification requirements of Sections 302 and 906 of the Sarbanes-Oxley Act of 2002, requiring the principal executive officer and principal financial officer of every issuer filing periodic reports under Section 13(a) of the Exchange Act to provide individual written certifications with respect to each annual and quarterly report.
The rule establishes two parallel certification regimes that operate in conjunction but carry different legal consequences: the Section 302 civil certification under Rule 13a-14(a), which is filed as part of the periodic report and subjects certifying officers to civil liability for false statements, and the Section 906 criminal certification under Rule 13a-14(b), which is furnished alongside the report and exposes certifying officers to federal criminal liability under 18 U.S.C. § 1350 for knowingly or willfully certifying a non-compliant report.
Together these certifications represent the most direct form of individual accountability imposed on senior corporate officers by the federal securities laws — the personal attestation, signed under penalty of law, that the officer has reviewed the report, accepts responsibility for its accuracy, and can vouch for the adequacy of the controls through which the information was gathered and presented.
The Sarbanes-Oxley Act of 2002 was enacted in the wake of a series of major corporate accounting scandals — Enron, WorldCom, Tyco, and others — in which senior executives had claimed ignorance of financial misstatements in their companies' periodic reports while collecting substantial compensation during periods when the reported results were false.
The certification requirements of Sections 302 and 906 were Congress's direct response to this accountability gap. By requiring the company's principal executive and financial officers to personally certify the accuracy of every annual and quarterly report, Sarbanes-Oxley transformed the certification from a collective corporate act — signed by the company with officers acting in their representative capacity — into an individual personal attestation carrying direct personal liability.
The officer who signs a false Section 302 certification cannot subsequently claim that the financial statements were prepared by others whom the officer trusted, because the certification explicitly includes attestation to the officer's own review of the report and personal knowledge of the disclosures it contains.
The regulatory purpose of Rule 13a-14 is therefore accountability rather than disclosure — the rule does not require new categories of information to be disclosed but requires that existing disclosure obligations be personally vouched for by the officers most directly responsible for ensuring the company's reports are accurate. This distinction between substantive disclosure requirements and personal accountability mechanisms is what makes Rule 13a-14 unique within the Exchange Act's periodic reporting framework.
Rule 13a-14 derives its statutory authority from Section 302 of the Sarbanes-Oxley Act, which directed the Commission to adopt rules requiring the principal executive officer and principal financial officer of each issuer filing periodic reports under Section 13(a) or Section 15(d) of the Exchange Act to certify the information contained in those reports.
Section 906 added the criminal certification requirement directly to the United States Code as 18 U.S.C. § 1350, without requiring Commission rulemaking, though Rule 13a-14(b) establishes the specific manner of furnishing the Section 906 certification as an exhibit to periodic reports.
The Commission adopted Rules 13a-14 and 15d-14 on August 28, 2002 — Securities Exchange Act Release No. 34-46427, published at 67 FR 57288, September 9, 2002 — with an effective date of August 29, 2002, implementing the Section 302 certification requirement.
The Section 906 certification had taken effect by its own force on July 30, 2002, the date Sarbanes-Oxley was signed into law. The Commission subsequently amended Rule 13a-14 on August 14, 2003 in connection with the adoption of the internal control reporting rules under Section 404, updating the Section 302 certification language to add the paragraphs relating to the certifying officers' responsibility for establishing and maintaining internal control over financial reporting and for disclosing significant deficiencies and material weaknesses to the audit committee. The rule was technically amended on February 8, 2005 and August 16, 2018, with no substantive changes to the certification framework in either amendment.
Rule 13a-14(a) establishes the Section 302 certification requirement. Each report filed on Form 10-Q, Form 10-K, Form 20-F, or Form 40-F under Section 13(a) — other than a report filed by an asset-backed issuer or a Form 20-F filed under Rule 13a-19 — must include certifications in the form specified in the applicable exhibit filing requirements of the report, filed as an exhibit. Each principal executive officer and each principal financial officer of the registrant must sign a separate individual certification. The certifications must be filed as Exhibit 31 to the applicable report.
The substantive content of the Section 302 certification is prescribed in the exhibit requirements and has been stable since the 2003 amendment. Each certifying officer must certify six matters. First, that the officer has reviewed the report. Second, that based on the officer's knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading.
Third, that based on the officer's knowledge, the financial statements and other financial information in the report fairly present, in all material respects, the financial condition and results of operations of the issuer for the periods presented.
Fourth, that the certifying officers are responsible for establishing and maintaining disclosure controls and procedures — as defined in Rule 13a-15(e) — and internal control over financial reporting — as defined in Rule 13a-15(f) — and have designed those controls to ensure that material information is made known to them; evaluated the effectiveness of those controls within 90 days prior to the filing date; and presented their conclusions about those controls' effectiveness in the report. Fifth, that the certifying officers have disclosed to the audit committee and to the issuer's auditors any significant deficiencies or material weaknesses in the design or operation of internal control over financial reporting, and any fraud — whether or not material — that involves management or other employees with a significant role in internal control over financial reporting. Sixth, that the certifying officers have indicated in the report whether there were significant changes in internal controls or in other factors that could significantly affect those controls subsequent to the date of their most recent evaluation.
The requirement that the Section 302 certification attest to the officer's own review of the report — rather than merely to the accuracy of the information — is what gives the certification its personal accountability character. An officer who has not actually reviewed the report cannot truthfully certify paragraph 1, and an officer who has reviewed the report and found it accurate bears personal responsibility for that finding regardless of how the report was prepared.
The certification's reference to the officer's knowledge — rather than the company's knowledge — reinforces this personal responsibility framing throughout paragraphs 2 and 3.
Rule 13a-14(b) establishes the Section 906 certification requirement. Each report filed on Form 10-Q or Form 10-K pursuant to Section 13(a) must be accompanied by a written statement by each officer required to certify the disclosure under Rule 13a-14(a).
The Section 906 certification must state that the report fully complies with the requirements of Section 13(a) or 15(d) of the Exchange Act and that the information contained in the report fairly presents, in all material respects, the financial condition and results of operations of the issuer.
The Section 906 certification is furnished rather than filed — it is submitted as Exhibit 32 and is specifically not incorporated into the periodic report for liability purposes under Section 18 of the Exchange Act. This furnished rather than filed status removes the Section 906 certification from the strict liability framework that applies to other components of the annual and quarterly reports, but it does not insulate certifying officers from criminal liability under 18 U.S.C. § 1350.
The criminal penalty structure of Section 906 is qualitatively distinct from Section 302's civil liability framework. An officer who knowingly certifies a non-compliant report faces fines of up to $1 million and imprisonment of up to ten years under 18 U.S.C. § 1350(c)(1). An officer who willfully certifies a non-compliant report faces fines of up to $5 million and imprisonment of up to twenty years under 18 U.S.C. § 1350(c)(2).
The knowing versus willful distinction tracks the general federal criminal law hierarchy in which willful violations — those involving actual awareness of wrongdoing — carry greater penalties than knowing violations, which require only that the officer was aware that the certification statement was false, without necessarily being aware that the falsity constituted a crime.
Rule 13a-14(f) establishes a specific exclusion for interactive data files — the XBRL-formatted versions of financial statements required to be submitted with periodic reports under Rule 11 of Regulation S-T. Interactive data files are explicitly excluded from the scope of the Section 302 certification requirements, reflecting the Commission's determination that the machine-readable XBRL tagging of financial information is an ancillary presentation requirement rather than substantive disclosure content subject to personal officer certification.
Rule 13a-14 applies to every issuer subject to Rule 13a-1's annual reporting obligation that files its annual reports on Form 10-K, Form 20-F, or Form 40-F, and every issuer subject to Rule 13a-13's quarterly reporting obligation that files quarterly reports on Form 10-Q. The certification requirements apply to transition reports on Form 10-Q and Form 10-K filed when an issuer changes its fiscal year end. Asset-backed issuers are specifically excluded — their periodic reports do not require Section 302 or Section 906 certifications because the principal executive and financial officer certification framework is not appropriate for the special purpose vehicle structures typical of asset-backed securities programmes. Section 302 certifications are not required in Form 8-K current reports or Form 11-K employee benefit plan reports.
Each principal executive officer and each principal financial officer must provide a separate certification — the certifications cannot be combined into a single document signed jointly or signed by one officer on behalf of both positions. A company with co-chief executive officers must obtain a Section 302 certification from each co-CEO. The rule's reference to principal executive officer and principal financial officer — rather than to named positions such as CEO and CFO — acknowledges that different companies use different nomenclature and that the certification obligation attaches to the substantive function rather than the title.
Rule 13a-14's certification requirements are inseparable from Rule 13a-15's internal control framework, which defines the key terms — disclosure controls and procedures in Rule 13a-15(e) and internal control over financial reporting in Rule 13a-15(f) — that the Section 302 certification references in its fourth paragraph. The certifying officers' attestations to the design, maintenance, and evaluation of those controls are given meaning by the definitions and evaluation standards of Rule 13a-15, making the two rules operationally interdependent.
The Section 302 certification's attestation that the financial statements fairly present the company's financial condition and results of operations connects directly to the Form 10-K's audited financial statements and the Form 10-Q's reviewed financial statements — the substantive disclosure documents that the certification vouches for. Where those financial statements contain material misstatements, the certifying officer's fair presentation attestation is potentially false, exposing the officer to civil liability under the Exchange Act's antifraud provisions, to Section 13(a) liability for the false periodic report, and potentially to Section 906 criminal liability if the officer knew or willfully ignored the falsity.
The May 2026 Semiannual Reporting proposal would extend Rule 13a-14's certification requirements to the new Form 10-S semiannual reports through conforming amendments, ensuring that both Section 302 and Section 906 certifications accompany semiannual interim reports filed by registrants that elect semiannual reporting under the proposed amended Rule 13a-13.
Rule 13a-14's certification framework has been substantively stable since the 2003 amendments that updated the Section 302 certification language to incorporate internal control references. The rule's stability reflects Congress's deliberate design of the certification as a fixed personal accountability mechanism rather than a disclosure requirement subject to ongoing evolution and refinement. The two subsequent technical amendments — February 2005 and August 2018 — made no substantive changes to the certification content or the filed versus furnished distinction that defines the liability difference between Section 302 and Section 906.
The broader enforcement environment surrounding Rule 13a-14 has evolved significantly since 2002, with the Department of Justice bringing periodic Section 906 criminal prosecutions against individual officers whose companies filed materially false periodic reports. These prosecutions have established that the criminal certification requirement is a genuine enforcement tool rather than a symbolic deterrence mechanism, and have reinforced the individual accountability function that Sections 302 and 906 were designed to achieve.
The Commission's enforcement of Rule 13a-14 has taken two distinct forms. The first involves civil enforcement for false Section 302 certifications — proceedings under Section 13(a) and Rule 10b-5 against certifying officers who signed Section 302 certifications in periodic reports that contained material misstatements.
The Commission has brought enforcement actions against CFOs and CEOs who certified false financial statements, treating the false certification as an independent violation of Rule 13a-14(a) in addition to the underlying antifraud and reporting violations arising from the misstatements themselves. The personal certification requirement has enabled the Commission to pursue individual officer accountability in circumstances where proving that the officer was the actual author of the false statements would have been difficult.
The second enforcement form involves criminal prosecutions under 18 U.S.C. § 1350 for false Section 906 certifications — brought by the Department of Justice rather than the Commission, though typically coordinated with parallel Commission civil proceedings. The criminal penalties available under Section 906 — up to $5 million in fines and twenty years imprisonment for willful violations — represent among the most severe sanctions available under the federal securities laws for conduct by individual corporate officers, reflecting Congress's determination that the personal certification of a company's periodic reports is a particularly consequential act of individual responsibility warranting severe consequences for wilful falsification.
The Commission has also addressed the procedural failure of omitting required certifications — either through failure to include the Section 302 certification as a filed Exhibit 31 or failure to furnish the Section 906 certification as Exhibit 32. A periodic report that lacks required certifications is defective and, for purposes of Form S-3 eligibility, is not considered a timely filed report. Issuers that discover omitted certifications must file amendments to include them, and the Commission has confirmed through C&DI guidance that the failure to file an amendment within the required period renders the original report untimely for form eligibility purposes.
Rule 13a-14 and the Sarbanes-Oxley certification framework are among the most consistently examined governance concepts across the Series 7, Series 65, and Series 66 examinations. The fundamental distinction between Section 302 and Section 906 — civil versus criminal, filed versus furnished — is the primary examination content, together with the identity of the required certifying officers and the specific forms and reports to which the certification requirements apply.
The practical consequence of the filed versus furnished distinction for liability purposes — Section 302 certifications are subject to Section 18 strict liability while Section 906 certifications are not, though both remain subject to Rule 10b-5 antifraud liability and Section 906 carries its own criminal penalty structure — is examined at the Series 65 level in the context of officer liability and governance accountability frameworks.
The key points to retain are these. Rule 13a-14 implements the CEO and CFO certification requirements of Sarbanes-Oxley Sections 302 and 906. Section 302 certifications under Rule 13a-14(a) are filed as Exhibit 31 to Form 10-K and Form 10-Q and require personal attestation by each principal executive and financial officer to their review of the report, the absence of material misstatements, the fair presentation of financial information, the design and evaluation of disclosure controls and internal controls, and the disclosure of control deficiencies and fraud to the audit committee.
Section 906 certifications under Rule 13a-14(b) are furnished rather than filed as Exhibit 32 and carry criminal penalties of up to $1 million and ten years imprisonment for knowing violations and up to $5 million and twenty years for willful violations under 18 U.S.C. § 1350. Interactive data files are excluded from Section 302 certification requirements. Asset-backed issuers are excluded from both certification requirements. Section 302 certifications are not required in Form 8-K. The May 2026 Semiannual Reporting proposal would extend both certification requirements to new Form 10-S semiannual reports.
