False Financial Statements: Criminal and Civil Liability

Penalties for false financial statements range from civil fines of a few hundred thousand dollars per violation to 30 years in federal prison, depending on which statute applies and whether the fraud touched a federally insured bank or a publicly traded security. Corporate officers who knowingly certify inaccurate reports face up to 20 years in prison and $5 million in fines under the Sarbanes-Oxley Act alone, and the SEC can permanently bar them from serving as officers or directors of any public company. The severity scales with the defendant’s intent, the dollar amount of harm, and the type of institution deceived.

Criminal Penalties Under Federal Law

Criminal prosecution requires proof of willful intent to defraud beyond a reasonable doubt. Prosecutors routinely stack charges under several overlapping statutes, and because each mailing or electronic transmission can count as a separate count, the paper exposure in a single case can run into centuries.

Mail and Wire Fraud

Using the mail, a private carrier, or any electronic communication to carry out a fraudulent scheme carries up to 20 years in prison per count.¹ The wire fraud statute carries the same 20-year maximum.² Every email, fax, or mailing used to further the scheme can be charged separately, so a multi-year scheme generating routine financial reports can produce dozens or hundreds of counts.

When the fraud affects a financial institution, both statutes escalate. The maximum prison term jumps to 30 years and the maximum fine rises to $1 million per count.²

Securities Fraud

Knowingly executing a scheme to defraud in connection with a publicly registered security carries up to 25 years in prison plus fines.³ Prosecutors don’t need to prove a specific mailing or transmission under this statute. The fraudulent scheme itself is the crime.

Bank Fraud

Submitting false financial statements to a bank or other financial institution to obtain a loan or other financial benefit is separately prosecutable. A bank fraud conviction carries up to 30 years in prison and fines up to $1 million.⁴

False Statements to Financial Institutions

A separate statute makes it a crime to knowingly submit a false statement or report, or to deliberately overvalue property or collateral, in order to influence any federally insured bank, credit union, mortgage lender, or federal lending agency. It covers situations well outside public companies, including overstating income on a mortgage application or inflating collateral value for a business loan. The penalty matches bank fraud: up to 30 years in prison and fines up to $1 million.⁵

Sarbanes-Oxley Certification Penalties

The Sarbanes-Oxley Act created a criminal penalty aimed directly at the CEOs and CFOs of public companies who certify financial reports they know are false. There are two tiers.

A knowing violation, where the officer certifies a report aware that it doesn’t comply with the law, carries up to 10 years in prison and a fine of up to $1 million. A willful violation, where the officer deliberately certifies the false report with the purpose of deceiving investors or regulators, doubles the maximum to 20 years in prison and a $5 million fine.⁶

The distinction between “knowing” and “willful” sounds subtle, but it drives the maximum sentence. Knowing means the officer was aware the report didn’t comply. Willful means the officer chose to certify it anyway with intent to deceive.

SEC Civil Penalties

The SEC operates under a lower burden of proof than a criminal prosecutor, which means the Commission can impose heavy penalties in cases where a criminal conviction would be out of reach. Its toolkit includes injunctions, per-violation monetary penalties, disgorgement of profits, and career-ending bars from serving as a public company officer or director.

Civil Penalty Tiers

Federal securities law establishes three tiers of civil penalties, each applied on a per-violation basis. The statutory base amounts are adjusted annually for inflation. The most recent adjustment sets the caps at roughly:

Tier 1, for technical violations: about $11,800 per violation for an individual or $118,200 for a company.
Tier 2, for fraud or reckless disregard: about $118,200 per violation for an individual or $591,100 for a company.
Tier 3, for fraud causing substantial losses: about $236,400 per violation for an individual or $1,182,200 for a company.⁷

At every tier, the penalty can alternatively be set at the defendant’s total financial gain from the violation if that figure exceeds the per-violation cap.⁸ Because each false filing or misleading statement can be a separate violation, a long-running scheme can produce penalties in the tens or hundreds of millions. In fiscal year 2024, the SEC ordered one investment firm to pay a $70 million civil penalty plus roughly $9.8 million in disgorgement for overvaluing mortgage-backed securities.⁹

Disgorgement

Beyond penalties, the SEC routinely seeks disgorgement, which forces defendants to return any profits earned from the fraud. The Commission can pursue disgorgement in any action brought under the federal securities laws, and courts have broad discretion in calculating the amount.⁸ The disgorgement figure frequently dwarfs the civil penalty. The SEC can also obtain prejudgment interest, which in a multi-year fraud adds millions more.

Officer and Director Bars

The SEC can seek a court order permanently barring an individual from serving as an officer or director of any publicly traded company. For an executive, this is often the sanction that bites hardest, independent of any dollar figure. The Commission can also issue administrative cease-and-desist orders and suspend or revoke the registration of securities professionals.

Executive Compensation Clawbacks

Since December 2023, every company listed on a U.S. stock exchange must maintain a policy to recover incentive-based compensation from executives when a financial restatement occurs. SEC Rule 10D-1 makes these clawbacks mandatory and largely automatic. The company doesn’t need to prove the executive did anything wrong. If the financials get restated and the executive received more incentive pay than they would have earned under the corrected numbers, the company must recover the difference.¹⁰

The rule reaches a broad group of executives: the CEO, CFO, principal accounting officer, any vice president in charge of a major business unit, and anyone else performing a significant policy-making function. The lookback covers the three completed fiscal years before the restatement date, plus any transition period from a fiscal year change.¹⁰ For an executive who collected large stock-based bonuses across several years of inflated earnings, the clawback alone can reach millions before any fines or legal costs enter the picture.

Private Investor Lawsuits

Investors who bought or sold securities based on false financial statements can sue for their losses, usually as a class, because accounting fraud at a public company tends to harm every shareholder at once. To win, investors must prove the company made a material misstatement, the defendant acted with scienter, the plaintiff relied on the false information, the plaintiff suffered a financial loss, and the fraud caused that loss rather than general market conditions.

Courts allow investors in publicly traded stocks to rely on the “fraud on the market” theory, which presumes that a stock trading on an efficient market reflects all publicly available information, including the fraudulent statements. When the truth emerges and the stock price drops, the loss is presumed to flow from the earlier misrepresentation.

The Private Securities Litigation Reform Act requires plaintiffs to plead fraud with unusual specificity, identifying which statements were false, why they were material, and what facts support a strong inference that the defendant intended to deceive. These suits must be filed within two years after the plaintiff discovers the facts showing the violation, and no later than five years after the violation itself.¹¹

Who Faces Personal Liability

Liability doesn’t stop at the company. Real people go to prison and pay personal fines, and the law distributes exposure based on each person’s role and knowledge.

CEOs and CFOs

Sarbanes-Oxley requires the principal executive officer and principal financial officer of every public company to personally certify each quarterly and annual report. The certification affirms that the officer has reviewed the report, that it contains no material misstatements, and that the financial statements fairly present the company’s condition and results.¹² The officer must also certify that internal controls are properly designed and have been recently evaluated.¹³

That personal certification is what makes 18 U.S.C. § 1350 so potent. An officer who signs the certification knowing the report is false has created direct, documented evidence of their own criminal liability. “I didn’t know” becomes extraordinarily hard to argue when the signature on file says the officer reviewed the report and verified its accuracy.⁶

Internal Accountants and Preparers

Employees who actually execute the manipulation face exposure too. An accountant who books fictitious revenue entries or reclassifies expenses to inflate earnings can be charged as a co-conspirator. Exposure depends on what the person knew and when. Someone who was told to book an entry and had no reason to question it stands in a different legal position than someone who raised concerns internally and was told to do it anyway.

External Auditors

Independent audit firms are supposed to catch material misstatements. When they fail because they didn’t look hard enough, or because they looked the other way, they face civil liability to harmed investors and regulatory sanctions from the Public Company Accounting Oversight Board. PCAOB sanctions include censure, temporary or permanent bars from auditing public companies, and monetary penalties. A single failure of professional skepticism can end an audit partner’s career and expose the firm to liability that exceeds the audit fees many times over.

Deadlines for Charges and Lawsuits

Time limits depend on whether the case is criminal or civil, and which statute applies. The deadlines matter because financial statement fraud is often discovered years after it began.

Criminal Time Limits

Securities fraud has a six-year statute of limitations for criminal prosecution.¹⁴ Bank fraud, false statements to financial institutions, and mail or wire fraud affecting a financial institution all carry a 10-year limitations period.¹⁵ Standard mail and wire fraud that doesn’t involve a financial institution runs on the general five-year federal rule.

Civil Time Limits

Private securities fraud suits run on a two-track deadline: the earlier of two years after the plaintiff discovers the fraud or five years after the violation.¹¹ The five-year outer limit is absolute. Even if the fraud was brilliantly concealed, a private lawsuit filed more than five years after the violation is time-barred. SEC enforcement actions aren’t subject to the same private-action deadlines, and the Commission has brought civil cases years after the underlying conduct.

What Makes a Financial Statement Legally False

None of these penalties apply to every accounting mistake. A financial statement crosses the legal line only when it contains a material misstatement or omission and the person responsible acted with intent to deceive.

A misstatement is material when a reasonable investor or lender would consider it important to a decision. Under SEC Staff Accounting Bulletin No. 99, materiality is not determined by hitting a fixed percentage of revenue or assets. Regulators weigh both the dollar size of the error and the surrounding context, including whether it masks a change in earnings trend, turns a loss into a profit, hides a failure to meet analyst expectations, or conceals self-dealing. A relatively small misstatement that accomplishes any of these can be material even when the raw number looks minor.¹⁶

The second element is scienter, the defendant’s mental state. A prosecutor or plaintiff must show the person knew the statement was false or acted with reckless disregard for whether it was true. An honest disagreement over how to apply an accounting rule, or a good-faith estimate that later proves wrong, doesn’t qualify. The question is whether the person chose to deceive or consciously ignored red flags that should have told them the numbers were wrong.

1
Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
2
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
3
Office of the Law Revision Counsel. 18 USC 1348 – Securities and Commodities Fraud
4
Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
5
Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally; Exceptions
6
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
7
U.S. Securities and Exchange Commission. Adjustments to Civil Monetary Penalty Amounts
8
Office of the Law Revision Counsel. 15 USC 78u – Investigations and Actions
9
U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2024
10
eCFR. 17 CFR 240.10D-1 – Listing Standards Relating to Recovery of Erroneously Awarded Compensation
11
Office of the Law Revision Counsel. 28 USC 1658 – Time Limitations on the Commencement of Civil Actions Arising Under Acts of Congress
12
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
13
Securities and Exchange Commission. Certification of Disclosure in Companies Quarterly and Annual Reports
14
Office of the Law Revision Counsel. 18 USC 3301 – Securities Fraud Offenses
15
Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses
16
U.S. Securities and Exchange Commission. Staff Accounting Bulletin No. 99 – Materiality