Back to Resources

    SOX Compliance for European Companies Listed in the US: What FPIs Actually Need to Know

    April 24, 2026

    The FPI SOX requirements for a European company listed in the US as a foreign private issuer (FPI) are: CEO and CFO certifications under Sections 302 and 906 in every annual report on Form 20-F, effective disclosure controls, an audit committee that meets SEC Rule 10A-3 and, from its second annual report, management’s assessment of internal control over financial reporting (ICFR) under Section 404(a). The auditor’s attestation under Section 404(b) applies only to accelerated and large accelerated filers that are not emerging growth companies (EGCs), so a company with annual revenue below USD 1.235 billion that qualifies as an EGC can defer it for up to five years after its IPO.

    SOX is therefore not a massive, undifferentiated burden for an FPI. What matters is knowing which rules apply to you, which ones you can legitimately defer, and where shortcuts will cost you later.

    FPI SOX requirements: Section 404(a) and 404(b)

    The distinction between 404(a) and 404(b) drives the entire SOX workload conversation.

    Section 404(a): management’s assessment

    Section 404(a) requires management to report on the effectiveness of ICFR in the annual Form 20-F (Item 15(b)). Management runs an assessment, documents the controls, evaluates them against a recognized framework (almost always COSO 2013) and concludes either that ICFR is effective or that it is not. Management cannot conclude that ICFR is effective if there are one or more material weaknesses. The report is management’s statement, and the CEO and CFO certifications under Section 302 refer to it.

    Section 404(b): the auditor’s attestation

    Section 404(b) is the audit firm issuing its own opinion on ICFR. It is more thorough and more expensive, and it applies to FPIs on the same basis as US domestic companies: an accelerated or large accelerated filer that is not an EGC must include it (Form 20-F Item 15(c)). Non-accelerated filers are exempt. As of October 2026, an accelerated filer has a public float of at least USD 75 million and less than USD 700 million, and a large accelerated filer USD 700 million or more, in each case after at least 12 months of SEC reporting and at least one annual report. FPIs filing on Form 20-F cannot use the smaller reporting company revenue test that takes some low-revenue domestic companies out of accelerated filer status.

    If you qualify as an EGC (annual gross revenues below USD 1.235 billion, the inflation-adjusted threshold set in 2022), you are exempt from 404(b) for as long as you remain an EGC. EGC status ends on the last day of the fiscal year following the fifth anniversary of your IPO, or earlier if revenue reaches USD 1.235 billion, you issue more than USD 1 billion of non-convertible debt in three years, or you become a large accelerated filer. EGC status does not defer 404(a).

    When each requirement starts

    • First Form 20-F after the IPO: Section 302 and 906 certifications and the conclusion on disclosure controls are required. Management’s 404(a) report and the 404(b) attestation are not, under the SEC transition period for newly public companies (Instructions to Item 15 of Form 20-F).
    • Second Form 20-F: management’s 404(a) assessment is required for every FPI, whether or not it is an EGC.
    • 404(b): required from the first annual report for which the company is an accelerated or large accelerated filer and no longer an EGC.

    In practice, an EGC is not paying for two parallel opinions in its early years. The audit firm does not issue an attestation on controls, although it must still communicate any material weaknesses it identifies during the financial statement audit to the audit committee (PCAOB AS 1305). Your costs are tighter, and you can build your control environment in phases rather than all at once.

    FPI status itself depends on where you are incorporated. A company that has completed a Delaware flip is a US domestic issuer and cannot use FPI status (Exchange Act Rule 3b-4).

    The COSO framework behind your ICFR assessment

    COSO is a framework published by the Committee of Sponsoring Organizations of the Treadway Commission. It is the de facto global standard for internal control design. SEC rules require management to evaluate ICFR against a suitable, recognized control framework, and COSO is the framework the SEC named as an example when it adopted the Section 404 rules in 2003. COSO 2013 has five components.

    1. Control environment. This is the tone at the top: your values, your ethics policy, how you hire and train people, and how seriously management demonstrates a commitment to financial reporting integrity. It can seem less concrete than the other components, but it is not optional. Without a strong control environment, every other control you build is fragile. Your home country may have a more implicit approach to governance. SOX does not work that way. You need explicit documentation, training, a whistleblower policy and clear accountability.
    2. Risk assessment. This is your systematic identification of risks that could affect the accuracy of your financial reporting: revenue recognition, expense accrual, close procedures, intercompany transactions, currency translation, anything that feeds the financial statements. You document the risks, document who is responsible for mitigating each one, and revisit the assessment annually.
    3. Control activities. These are the actual controls: the procedures and systems that reduce risk to acceptable levels. A control might be: "The accounts payable supervisor reviews and approves every vendor invoice over 50,000 euros before payment." Or: "System access to the general ledger is restricted to the controller and one backup, with monthly access reviews." You do not need 500 controls. You need enough to reliably prevent or detect misstatement.
    4. Information and communication. This covers how financial information flows through the organization and how people report control issues or suspected fraud: your close calendar, your consolidation procedures, how foreign subsidiaries report to the parent, how information systems are configured, and your whistleblower mechanism.
    5. Monitoring. This is your testing and oversight: management’s ongoing review and formal control testing by the internal audit function or an outsourced provider. Monitoring tells you whether your controls are still effective or have deteriorated.

    All five components need to work together. Controls deteriorate as people leave and procedures are circumvented informally, so SOX requires an ongoing program, not a one-time documentation exercise.

    CEO and CFO certifications under Sections 302 and 906

    Section 302 requires CEO and CFO certifications filed as exhibits to every Form 20-F. FPIs do not file quarterly reports on Form 10-Q. They furnish reports on Form 6-K, which do not carry Section 302 certifications, so the certification covers the 20-F annually. In it, the CEO and CFO certify that they have reviewed the report, that it does not contain untrue statements of material fact, that the financial statements fairly present the company’s financial condition, that they are responsible for disclosure controls and ICFR, and that they have disclosed significant deficiencies, material weaknesses and any fraud involving management or employees with a significant role in ICFR to the auditor and the audit committee.

    This is not a formality. The SEC has brought enforcement actions against CEOs and CFOs over certifications they signed. You need a documented process: someone (usually the controller or CFO) gathers control test results, identifies any deficiencies, assesses whether they are material weaknesses, and prepares a summary for the executives to review before signing. Most companies support this with sub-certifications from the people closest to the numbers:

    • Finance leads of each subsidiary, confirming that their reported figures are complete and that they know of no unreported deficiencies, fraud or significant changes in controls
    • Process owners for revenue, purchasing, payroll and the close
    • The IT lead, for system access and change management
    • Legal, for litigation, claims and regulatory matters

    Section 906 adds criminal penalties under 18 U.S.C. 1350: a fine of up to USD 1 million and up to 10 years in prison for certifying a report knowing that it does not comply, and up to USD 5 million and 20 years for doing so willfully. This is why you need actual evidence supporting the certification, not an assumption that things are fine.

    Where FPIs can follow home country practice and where they cannot

    FPIs have more flexibility on governance than US domestic companies, but the boundaries matter.

    You can generally follow home country practice in place of most NYSE or Nasdaq governance rules, such as board and committee composition outside the audit committee, provided you disclose the significant differences in your Form 20-F (Item 16G). FPIs can also follow home country practice for executive compensation decisions and, where home country law permits, disclose executive compensation on an aggregate basis.

    You cannot avoid:

    • An audit committee that meets Rule 10A-3. Each member must be a board member and independent: no consulting, advisory or other compensatory fees from the company other than for board service, and not an affiliate. At IPO, at least one member must be independent, a majority within 90 days and all members within one year of the registration statement becoming effective. FPIs have specific exemptions, for example for employee representatives on the board and for companies with a board of auditors.
    • The audit committee’s Rule 10A-3 responsibilities: oversight of the auditor, procedures for complaints and whistleblower reports, authority to engage advisers, and funding.
    • Section 302 and 906 certifications, disclosure controls and procedures, and the ICFR assessment and disclosures.
    • Disclosure of an audit committee financial expert. Item 16A of Form 20-F requires you to disclose whether the audit committee has at least one audit committee financial expert and, if not, why not. This is a disclosure requirement, not a requirement to appoint one, although underwriters and investors generally expect one.

    Neither exchange applies its three-member minimum to FPIs. The NYSE requires listed FPIs to comply only with Sections 303A.06 (Rule 10A-3), 303A.11 and 303A.12(b) and (c) of its Listed Company Manual. Nasdaq Rule 5615(a)(3) allows an FPI to follow home country practice in place of the three-member requirement, provided the audit committee meets Rule 5605(c)(3) and its members meet the Rule 10A-3 independence test. Rule 10A-3 itself sets no minimum size. Home country board structures usually change most visibly in the audit committee, because every member must meet that independence test.

    Common mistakes European companies make with SOX

    • Underestimating the timeline. Most European companies assume they can go from planning to compliant in six months. It is usually 18 to 24 months from serious planning to the first Form 20-F that includes management’s ICFR assessment. Plan for at least one full fiscal year of operating controls before that first assessment. Start early.
    • Treating SOX as a one-time project. SOX is an ongoing program. Controls deteriorate, people leave and new risks emerge. You need a dedicated owner responsible for maintaining the control environment, testing controls annually and updating documentation. Budget for it as a permanent function, not a one-time investment.
    • Underestimating IT controls. European companies often have strong financial controls and weak IT controls. SOX treats IT general controls as foundational: system access, segregation of duties, change management, backup and disaster recovery. Involve your IT team from the start.
    • Assuming home country controls are good enough. Many European companies have strong controls in practice but have not documented or tested them in the way SOX requires. It is usually not a redesign, but it is a project.
    • Treating the transition relief as an exemption. Newly public companies get one annual report before 404(a) applies, and EGCs get up to five years of relief from 404(b). Use both periods to reach full compliance; neither is a permanent exemption. Build your control environment during the grace period so you are ready when it ends.

    A realistic 24-month SOX roadmap

    • Months 1 to 3: Hire your compliance lead (and do not ask a new finance hire to do this alongside a conversion). Conduct a gap analysis. Start control documentation. Establish your steering committee.
    • Months 4 to 12: Design your control environment. Map key financial processes. Document control activities. Build testing workpapers. Start running control tests.
    • Months 13 to 18: Run a full cycle of control tests. Remediate failures. Build your evidence library. Prepare the sub-certification process and a dry run of management’s assessment.
    • Months 19 to 24: Run a second cycle of testing. Finalize management’s ICFR assessment and the SOX disclosures for the first Form 20-F that requires them (usually the second annual report after listing). File.

    This timeline can be shortened if you start early and dedicate resources. Companies that run into trouble almost always discovered IT control gaps or documentation issues late in the process.

    SEC rule changes affecting FPIs in 2026

    • Section 16 reporting for FPI insiders. Since 18 March 2026, directors and officers of FPIs must file Section 16(a) reports on their holdings and transactions in the company’s equity securities, under the Holding Foreign Insiders Accountable Act and SEC rule amendments adopted on 27 February 2026. FPI insiders remain exempt from the Section 16(b) short-swing profit rules, and 10 percent holders are not covered. Your disclosure controls now need to capture these filings.
    • Proposed filer status changes. On 19 May 2026 the SEC proposed (Release No. 33-11419) to raise the large accelerated filer threshold to USD 2 billion of public float, remove the accelerated filer category and limit the 404(b) attestation to large accelerated filers. The comment period closed on 20 July 2026. As of 16 October 2026 the proposal has not been adopted.
    • FPI eligibility. In June 2025 the SEC issued a concept release asking whether to narrow the FPI definition. As of October 2026 the SEC had not proposed amendments to the definition in Exchange Act Rule 3b-4, although its 2026 regulatory agenda lists FPI eligibility at the proposed rule stage.

    SOX is an ongoing program, not a one-time project

    SOX compliance for European FPIs is neither trivial nor overwhelming. You have genuine transition relief, real flexibility on governance and a manageable path. What you cannot do is treat it as a one-time project or assume your existing controls translate automatically. The companies that succeed treat SOX as the foundation for scalable financial reporting and governance, not a one-off regulatory requirement.

    For the complete breakdown of ongoing reporting, PCAOB audits and corporate governance, read the Being Public in the US section of the European Accounting and Reporting Guide.