This guide covers:
• What the HFIA Act changed and who it affects
• Which forms you need to file and when
• Step-by-step instructions for EDGAR and Login.gov setup
• How to troubleshoot the most common technical errors
On December 18, 2025, Section 8103 of the FY2026 National Defense Authorization Act (NDAA) — known as the Holding Foreign Insiders Accountable Act, or HFIA Act — was signed into law. The SEC adopted implementing rules on February 27, 2026.
Until now, directors and officers of foreign private issuers (FPIs) have been fully exempt from the insider reporting obligations that apply to their U.S.-company counterparts under Section 16 of the Securities Exchange Act of 1934. That exemption, as it applies to Section 16(a) reporting, is now removed.
Starting March 18, 2026, directors and officers of FPIs whose equity securities are registered under Section 12 of the Exchange Act must file Section 16 reports electronically and in English through the SEC's EDGAR system.
In plain terms: if you are a director or officer of a foreign company listed in the U.S., you now have the same basic disclosure obligations as a director or officer of a U.S. domestic company.
|
Three important scope boundaries
|
|
1. Directors and officers only — major shareholders (over 10%) are specifically excluded from the new Section 16(a) requirement. The SEC amended Rule 16a-2 to make this explicit. |
2. Short-swing profit rules and short-selling prohibition still do not apply. FPIs retain their existing exemption from Sections 16(b) and 16(c). Only the Section 16(a) reporting obligation is new.
|
|
3. No exemptions were granted in the final rules. While the SEC has authority to exempt persons in jurisdictions where local law already imposes substantially similar requirements, it did not exercise that authority in February 2026. All in-scope directors and officers must comply. |
SEC Chairman Paul S. Atkins described the change as aligning foreign executives' reporting obligations with those of their U.S. counterparts, while noting the SEC continues to evaluate whether future exemptive relief may be appropriate for certain jurisdictions. [1]
The question of who qualifies as an "officer" for Section 16 purposes deserves careful attention — particularly for foreign companies whose executive roles may not map neatly to U.S. titles.
The SEC's definition under Rule 16a-1(f) is functional, not title-based. It covers the president, principal financial officer, principal accounting officer or controller, certain vice presidents with significant unit responsibility, and anyone performing a policy-making function. If someone's role involves making significant decisions about the company's direction, they may qualify — regardless of their actual title.
For companies with two-tier board structures (common in Germany, the Netherlands, and several European and Asian markets), both management board and supervisory board members should be reviewed. The relevant test is whether a person functions as a "director" under Exchange Act Section 3(a)(7) — not whether their specific title is "director."
| Practical step |
|
Your legal team or corporate secretary should compile a list of everyone who might fall within these definitions and make a deliberate determination before March 18, 2026. When in doubt, default to including rather than excluding — and your EDGAR filing agent can help you work through any edge cases. |
Section 16(a) reports are filed using three standard forms, all submitted through EDGAR's Online Forms portal.
This is the first filing every covered director and officer must make. It discloses your current holdings in the company's equity securities — shares, options, restricted stock units, and other equity-linked instruments.
• For everyone already serving as of March 18, 2026: your Form 3 must be filed on March 18, 2026 itself (by 10:00 p.m. Eastern Time). This is a specific HFIA Act requirement — not the standard 10-day window.
• For anyone who becomes a director or officer after March 18, 2026: Form 3 is due within 10 days of assuming that role, even if you hold no securities at the time.
Once you have filed Form 3, Form 4 is used to report changes — purchases, sales, equity award grants, option exercises, tax-withholding share transactions, gifts, and other covered transactions.
Form 4 has a tight deadline: it must be filed by 10:00 p.m. Eastern Time on the second business day following the transaction. For teams coordinating across time zones, this requires a clear internal process for capturing and reporting transactions immediately.
Form 5 is a year-end catch-up form, used to report transactions that were either exempt from or missed in earlier Form 4 filings. It is due within 45 calendar days after the company's fiscal year end, but only when you have transactions that actually require it.
|
Don't forget: company website posting |
|
Companies must post Section 16 reports on their corporate website by the end of the business day following the SEC filing. For foreign issuers who haven't previously maintained this type of disclosure section, this is worth preparing in advance. This requirement can typically be satisfied by linking to the relevant filer's EDGAR page. |
Every director and officer who will file Section 16 reports needs their own individual EDGAR account. Getting set up involves three distinct steps — and starting early is essential, since the process can take two weeks or more.
To create a new EDGAR filer account, submit Form ID through the EDGAR Filer Management portal. Paper applications are not accepted.
Key things to know before you start:
• Review time: SEC staff review of Form ID applications averages one to two weeks. If your application is suspended for missing information or document issues, correction and resubmission add more time. Do not wait until the week before your deadline.
• Two account administrators recommended (one minimum for individuals): Designate at least two where possible. If the administrator is someone other than the applicant, a notarized power of attorney is required.
• Names must be in English, ASCII characters only: EDGAR does not accept foreign-language characters. Use a romanized version of your name if applicable, and be consistent across your Form ID, Login.gov account, and EDGAR records.
• Notarized authenticating document required: The Form ID must include a document signed by you and notarized. If you are outside the U.S., a local foreign notary equivalent or remote online notary recognized under U.S. state law is acceptable.
• Strict PDF rules: Attached PDFs must follow file naming conventions — 32 characters or fewer, all lowercase, no spaces, starting with a letter. Active content in PDFs will cause rejection.
EDGAR Next requires every individual who takes action in EDGAR to use a Login.gov individual account with multi-factor authentication (MFA). Login.gov is operated by the U.S. General Services Administration and is the secure sign-on service used across dozens of U.S. government agencies. [2]
How to set it up for EDGAR:
1. Go to the EDGAR Filer Management portal and click "Sign in with Login.gov."
2. Follow the prompts to create a new Login.gov account using your email address, a password, and at least one MFA method.
3. Use the same email address for Login.gov that you intend to register in EDGAR. A mismatch between the two will prevent you from logging in.
4. After your Login.gov account is created, return to the EDGAR Filer Management portal, sign in, and complete MFA to link your credentials to your EDGAR account.
|
Recommended MFA setup |
|
Primary: An authenticator app (such as Google Authenticator or Microsoft Authenticator) on a personal mobile device you own and control. |
|
Backup: At least one additional method — a backup phone number or saved backup codes stored securely. |
|
Maintain at least two MFA methods on your Login.gov account. This significantly reduces the risk of being locked out. [3] |
|
Note: If you encounter problems with Login.gov itself (forgotten password, lost MFA device), contact Login.gov support directly. EDGAR Filer Support handles EDGAR-specific issues only. |
Once your Form ID is approved and Login.gov is linked to EDGAR, your filing agent needs to be set up as a delegated filer on your account. Under EDGAR Next's account role structure, you can authorize your filing agent's team to submit filings on your behalf — this is the standard arrangement.
Confirm this delegation is in place and tested before March 18, 2026. A last-minute access failure on the day of your initial Form 3 filing is entirely avoidable with advance preparation.
The issues below are among the most frequently encountered by filers new to EDGAR. Being aware of them in advance will save significant time and stress.
|
�� Problem: "Unable to sign in at this time" when logging into EDGAR |
|
What's happening: The email address in your Login.gov account does not match the email registered in EDGAR — or someone has added a second person's email address to a single Login.gov account. EDGAR Next uses your Login.gov email as your individual identity. If two people's emails are associated with one Login.gov account, EDGAR treats it as an identity conflict and blocks access. |
|
Fix: Remove the other email from the Login.gov account. The other individual should create their own separate Login.gov account. Then re-enter the EDGAR Filer Management portal to verify access is restored. If needed, your account administrator can re-invite you to the relevant filer CIKs. [4] |
|
�� Problem: Your EDGAR accounts disappear after deleting and recreating a Login.gov account |
|
What's happening: If you delete your Login.gov account and later create a new one with the same email, EDGAR will not automatically reconnect your filer associations. The link between your Login.gov identity and your EDGAR CIKs is permanently severed when the original account is deleted. |
|
Fix: Do not delete your Login.gov account if you intend to continue using EDGAR. If this has already happened, your account administrator must re-invite you as a user for each CIK you need to access. [4] |
|
�� Problem: EDGAR website won't load, or the same error repeats across sessions |
|
What's happening: Stored browser cache, cookies, or autofill data can interfere with EDGAR's login and filing pages. This is especially common on shared devices or when switching between multiple EDGAR accounts in the same browser session. |
|
Fix: Clear your browser's cache, cookies, and stored history. Use the full standard EDGAR URL — do not rely on browser-autofilled addresses. Disable browser autocomplete for EDGAR form fields. If your organization's firewall settings are strict, add EDGAR's domains to your browser's trusted sites list. [5] |
|
�� Problem: Form ID application is "suspended" by the SEC |
|
What's happening: A "suspension" notice means your Form ID cannot be processed as submitted. Common causes include missing required fields, a PDF that doesn't meet naming or formatting rules, or missing notarization on the authenticating document. |
|
Fix: Read the suspension notice carefully — it will specify the error. Correct the issue and resubmit. Each round of correction adds time, so getting the application right the first time matters. If you are unsure about the document requirements, contact your filing agent before submitting. [6] |
|
Good to know: Late-day filing and the 5:30 p.m. ET window |
|
For Forms 3, 4, and 5, EDGAR's rules are more accommodating than many filers realize. Ownership forms submitted after 5:30 p.m. ET but before 10:00 p.m. ET still receive that same day's filing date and are disseminated immediately. |
|
This provides a meaningful operational window for global teams working across time zones where approvals may arrive late in the U.S. business day. That said, this is not a substitute for building a reliable internal process — Form 4's two-business-day deadline starts the moment a transaction is executed. [7] |
For a foreign issuer managing Section 16 compliance across multiple countries and time zones, the biggest practical risk is not a legal misunderstanding — it's a workflow failure. Form 4's two-business-day deadline is unforgiving, and it starts the moment a transaction is executed.
A reliable process has three components:
Every director and officer should know exactly how and to whom they report a transaction — and they should report it immediately. This is usually a designated compliance or legal contact (or your EDGAR filing agent), reached by a defined method. If the person who executed the transaction has to guess who to call, you have already lost time.
For equity compensation-related transactions — grants, exercises, vesting, tax-withholding share sales — finance, HR, and equity administration teams need to be connected to the compliance and filing workflow. These events are common Form 4 triggers and are easy to miss without an automatic data handoff.
Before March 18, 2026, every covered director and officer should have a live EDGAR account, an active Login.gov credential linked to it, and a confirmed delegation arrangement with their filing agent. Your filing agent should be able to demonstrate that they can access and submit on each person's CIK without last-minute issues.
|
Action |
Owner |
Deadline |
|
Identify all covered directors and officers |
Legal / corporate secretary |
Immediately |
|
Submit Form ID for anyone without EDGAR access |
Each individual + filing agent |
Now — allow 2+ weeks for approval |
|
Set up Login.gov account with MFA |
Each individual |
Before Form ID approval |
|
Link Login.gov to EDGAR; confirm agent delegation |
Individual + filing agent |
Before March 18, 2026 |
|
File Form 3 for all currently serving directors and officers |
Filing agent |
March 18, 2026 (by 10:00 p.m. ET) |
|
Set up company website posting process for Section 16 filings |
IR / legal team |
Before March 18, 2026 |
|
Establish transaction notification channel |
Legal / compliance |
Before March 18, 2026 |
|
File Form 4 for each covered transaction |
Filing agent |
Within 2 business days of each transaction |
|
File Form 5 if required |
Filing agent |
Within 45 days of fiscal year end |
[1] SEC Press Release No. 2026-23, "SEC Adopts Final Rules for the Holding Foreign Insiders Accountable Act" (Feb. 27, 2026). Available at: https://www.sec.gov/newsroom/press-releases/2026-23-sec-adopts-final-rules-holding-foreign-insiders-accountable-act. Statement of Chairman Paul S. Atkins available at: https://www.sec.gov/newsroom/speeches-statements/atkins-statement-final-rules-holding-foreign-insiders-accountable-act-022726. Final rule (Release No. 34-104903) available at: https://www.sec.gov/files/rules/final/2026/34-104903.pdf.
[2] SEC EDGAR Next program information. Available at: https://www.sec.gov/submit-filings/improving-edgar/edgar-next-improving-filer-access-account-management. Login.gov is operated by the U.S. General Services Administration.
[3] Login.gov authentication and account management guidance. Available at: https://www.login.gov/help/. SEC guidance on obtaining Login.gov individual account credentials available through EDGAR Filer Support resources.
[4] SEC EDGAR Next FAQ on Login.gov credential issues, shared accounts, and CIK re-association. Available through the EDGAR Filer Management portal help documentation.
[5] SEC EDGAR browser and technical access guidance. Available through EDGAR Filer Support resources at: https://www.sec.gov/submit-filings/filer-support-resources.
[6] SEC Form ID Guide and EDGAR Filer Manual. Available at: https://www.sec.gov/submit-filings/filer-support-resources.
[7] SEC EDGAR filing date rules for ownership forms. Confirmed in EDGAR Filer Manual, Vol. II, and EDGAR operating hours guidance.
How M&A Strategy Shapes the Path to IPO: Opportunities and Risks
Navigating the Legal Minefield: The Indispensable Role of D&O Insurance in Today's Corporate World
Best Practices for D&O Insurance Renewals