FirstCover
Go back

What to Do Now: A Practical Guide for Foreign Issuers Under the New HFIA Act

As your EDGAR filing partner, we have put together this step-by-step guide to help your directors and officers get set up and stay compliant — from understanding what changed, to registering on Login.gov, to avoiding the most common technical pitfalls.
Regulatory Compliance Mar 07, 2026
hero-image

This guide covers:

 What the HFIA Act changed and who it affects

 Which forms you need to file and when

 Step-by-step instructions for EDGAR and Login.gov setup

 How to troubleshoot the most common technical errors

1.  What Changed, and Why It Matters

On December 18, 2025, Section 8103 of the FY2026 National Defense Authorization Act (NDAA) — known as the Holding Foreign Insiders Accountable Act, or HFIA Act — was signed into law. The SEC adopted implementing rules on February 27, 2026.

Until now, directors and officers of foreign private issuers (FPIs) have been fully exempt from the insider reporting obligations that apply to their U.S.-company counterparts under Section 16 of the Securities Exchange Act of 1934. That exemption, as it applies to Section 16(a) reporting, is now removed.

Starting March 18, 2026, directors and officers of FPIs whose equity securities are registered under Section 12 of the Exchange Act must file Section 16 reports electronically and in English through the SEC's EDGAR system.

In plain terms: if you are a director or officer of a foreign company listed in the U.S., you now have the same basic disclosure obligations as a director or officer of a U.S. domestic company.

 

Three important scope boundaries

1.  Directors and officers only — major shareholders (over 10%) are specifically excluded from the new Section 16(a) requirement. The SEC amended Rule 16a-2 to make this explicit.

2.  Short-swing profit rules and short-selling prohibition still do not apply. FPIs retain their existing exemption from Sections 16(b) and 16(c). Only the Section 16(a) reporting obligation is new.

3.  No exemptions were granted in the final rules. While the SEC has authority to exempt persons in jurisdictions where local law already imposes substantially similar requirements, it did not exercise that authority in February 2026. All in-scope directors and officers must comply.

 

SEC Chairman Paul S. Atkins described the change as aligning foreign executives' reporting obligations with those of their U.S. counterparts, while noting the SEC continues to evaluate whether future exemptive relief may be appropriate for certain jurisdictions. [1]

2.  Who Needs to File

The question of who qualifies as an "officer" for Section 16 purposes deserves careful attention — particularly for foreign companies whose executive roles may not map neatly to U.S. titles.

The SEC's definition under Rule 16a-1(f) is functional, not title-based. It covers the president, principal financial officer, principal accounting officer or controller, certain vice presidents with significant unit responsibility, and anyone performing a policy-making function. If someone's role involves making significant decisions about the company's direction, they may qualify — regardless of their actual title.

For companies with two-tier board structures (common in Germany, the Netherlands, and several European and Asian markets), both management board and supervisory board members should be reviewed. The relevant test is whether a person functions as a "director" under Exchange Act Section 3(a)(7) — not whether their specific title is "director."

 

Practical step

Your legal team or corporate secretary should compile a list of everyone who might fall within these definitions and make a deliberate determination before March 18, 2026. When in doubt, default to including rather than excluding — and your EDGAR filing agent can help you work through any edge cases.

3.  The Three Forms You Need to Know

Section 16(a) reports are filed using three standard forms, all submitted through EDGAR's Online Forms portal.

Form 3 — Initial Statement of Beneficial Ownership

This is the first filing every covered director and officer must make. It discloses your current holdings in the company's equity securities — shares, options, restricted stock units, and other equity-linked instruments.

 For everyone already serving as of March 18, 2026: your Form 3 must be filed on March 18, 2026 itself (by 10:00 p.m. Eastern Time). This is a specific HFIA Act requirement — not the standard 10-day window.

 For anyone who becomes a director or officer after March 18, 2026: Form 3 is due within 10 days of assuming that role, even if you hold no securities at the time.

Form 4 — Statement of Changes in Beneficial Ownership

Once you have filed Form 3, Form 4 is used to report changes — purchases, sales, equity award grants, option exercises, tax-withholding share transactions, gifts, and other covered transactions.

Form 4 has a tight deadline: it must be filed by 10:00 p.m. Eastern Time on the second business day following the transaction. For teams coordinating across time zones, this requires a clear internal process for capturing and reporting transactions immediately.

Form 5 — Annual Statement

Form 5 is a year-end catch-up form, used to report transactions that were either exempt from or missed in earlier Form 4 filings. It is due within 45 calendar days after the company's fiscal year end, but only when you have transactions that actually require it.

 

 

Don't forget: company website posting

Companies must post Section 16 reports on their corporate website by the end of the business day following the SEC filing. For foreign issuers who haven't previously maintained this type of disclosure section, this is worth preparing in advance. This requirement can typically be satisfied by linking to the relevant filer's EDGAR page.

4.  Setting Up EDGAR Access: Your Step-by-Step Path

Every director and officer who will file Section 16 reports needs their own individual EDGAR account. Getting set up involves three distinct steps — and starting early is essential, since the process can take two weeks or more.

Step 1 — Apply for an EDGAR Account (Form ID)

To create a new EDGAR filer account, submit Form ID through the EDGAR Filer Management portal. Paper applications are not accepted.

Key things to know before you start:

 Review time: SEC staff review of Form ID applications averages one to two weeks. If your application is suspended for missing information or document issues, correction and resubmission add more time. Do not wait until the week before your deadline.

 Two account administrators recommended (one minimum for individuals): Designate at least two where possible. If the administrator is someone other than the applicant, a notarized power of attorney is required.

 Names must be in English, ASCII characters only: EDGAR does not accept foreign-language characters. Use a romanized version of your name if applicable, and be consistent across your Form ID, Login.gov account, and EDGAR records.

 Notarized authenticating document required: The Form ID must include a document signed by you and notarized. If you are outside the U.S., a local foreign notary equivalent or remote online notary recognized under U.S. state law is acceptable.

 Strict PDF rules: Attached PDFs must follow file naming conventions — 32 characters or fewer, all lowercase, no spaces, starting with a letter. Active content in PDFs will cause rejection.

Step 2 — Create Your Login.gov Account

EDGAR Next requires every individual who takes action in EDGAR to use a Login.gov individual account with multi-factor authentication (MFA). Login.gov is operated by the U.S. General Services Administration and is the secure sign-on service used across dozens of U.S. government agencies. [2]

How to set it up for EDGAR:

1. Go to the EDGAR Filer Management portal and click "Sign in with Login.gov."

2. Follow the prompts to create a new Login.gov account using your email address, a password, and at least one MFA method.

3. Use the same email address for Login.gov that you intend to register in EDGAR. A mismatch between the two will prevent you from logging in.

4. After your Login.gov account is created, return to the EDGAR Filer Management portal, sign in, and complete MFA to link your credentials to your EDGAR account.

 

Recommended MFA setup

Primary: An authenticator app (such as Google Authenticator or Microsoft Authenticator) on a personal mobile device you own and control.

Backup: At least one additional method — a backup phone number or saved backup codes stored securely.

Maintain at least two MFA methods on your Login.gov account. This significantly reduces the risk of being locked out. [3]

Note: If you encounter problems with Login.gov itself (forgotten password, lost MFA device), contact Login.gov support directly. EDGAR Filer Support handles EDGAR-specific issues only.

Step 3 — Connect with Your Filing Agent

Once your Form ID is approved and Login.gov is linked to EDGAR, your filing agent needs to be set up as a delegated filer on your account. Under EDGAR Next's account role structure, you can authorize your filing agent's team to submit filings on your behalf — this is the standard arrangement.

Confirm this delegation is in place and tested before March 18, 2026. A last-minute access failure on the day of your initial Form 3 filing is entirely avoidable with advance preparation.

5.  Common Technical Issues — and How to Resolve Them

The issues below are among the most frequently encountered by filers new to EDGAR. Being aware of them in advance will save significant time and stress.

 

��  Problem: "Unable to sign in at this time" when logging into EDGAR

What's happening: The email address in your Login.gov account does not match the email registered in EDGAR — or someone has added a second person's email address to a single Login.gov account. EDGAR Next uses your Login.gov email as your individual identity. If two people's emails are associated with one Login.gov account, EDGAR treats it as an identity conflict and blocks access.

Fix: Remove the other email from the Login.gov account. The other individual should create their own separate Login.gov account. Then re-enter the EDGAR Filer Management portal to verify access is restored. If needed, your account administrator can re-invite you to the relevant filer CIKs. [4]

 

��  Problem: Your EDGAR accounts disappear after deleting and recreating a Login.gov account

What's happening: If you delete your Login.gov account and later create a new one with the same email, EDGAR will not automatically reconnect your filer associations. The link between your Login.gov identity and your EDGAR CIKs is permanently severed when the original account is deleted.

Fix: Do not delete your Login.gov account if you intend to continue using EDGAR. If this has already happened, your account administrator must re-invite you as a user for each CIK you need to access. [4]

 

��  Problem: EDGAR website won't load, or the same error repeats across sessions

What's happening: Stored browser cache, cookies, or autofill data can interfere with EDGAR's login and filing pages. This is especially common on shared devices or when switching between multiple EDGAR accounts in the same browser session.

Fix: Clear your browser's cache, cookies, and stored history. Use the full standard EDGAR URL — do not rely on browser-autofilled addresses. Disable browser autocomplete for EDGAR form fields. If your organization's firewall settings are strict, add EDGAR's domains to your browser's trusted sites list. [5]

 

��  Problem: Form ID application is "suspended" by the SEC

What's happening: A "suspension" notice means your Form ID cannot be processed as submitted. Common causes include missing required fields, a PDF that doesn't meet naming or formatting rules, or missing notarization on the authenticating document.

Fix: Read the suspension notice carefully — it will specify the error. Correct the issue and resubmit. Each round of correction adds time, so getting the application right the first time matters. If you are unsure about the document requirements, contact your filing agent before submitting. [6]

 

Good to know: Late-day filing and the 5:30 p.m. ET window

For Forms 3, 4, and 5, EDGAR's rules are more accommodating than many filers realize. Ownership forms submitted after 5:30 p.m. ET but before 10:00 p.m. ET still receive that same day's filing date and are disseminated immediately.

This provides a meaningful operational window for global teams working across time zones where approvals may arrive late in the U.S. business day. That said, this is not a substitute for building a reliable internal process — Form 4's two-business-day deadline starts the moment a transaction is executed. [7]

6.  Building a Process That Works — and Your Action Checklist

For a foreign issuer managing Section 16 compliance across multiple countries and time zones, the biggest practical risk is not a legal misunderstanding — it's a workflow failure. Form 4's two-business-day deadline is unforgiving, and it starts the moment a transaction is executed.

A reliable process has three components:

A single notification channel

Every director and officer should know exactly how and to whom they report a transaction — and they should report it immediately. This is usually a designated compliance or legal contact (or your EDGAR filing agent), reached by a defined method. If the person who executed the transaction has to guess who to call, you have already lost time.

Aligned data across teams

For equity compensation-related transactions — grants, exercises, vesting, tax-withholding share sales — finance, HR, and equity administration teams need to be connected to the compliance and filing workflow. These events are common Form 4 triggers and are easy to miss without an automatic data handoff.

EDGAR access confirmed and tested

Before March 18, 2026, every covered director and officer should have a live EDGAR account, an active Login.gov credential linked to it, and a confirmed delegation arrangement with their filing agent. Your filing agent should be able to demonstrate that they can access and submit on each person's CIK without last-minute issues.

Summary Action Checklist

 

Action

Owner

Deadline

Identify all covered directors and officers

Legal / corporate secretary

Immediately

Submit Form ID for anyone without EDGAR access

Each individual + filing agent

Now — allow 2+ weeks for approval

Set up Login.gov account with MFA

Each individual

Before Form ID approval

Link Login.gov to EDGAR; confirm agent delegation

Individual + filing agent

Before March 18, 2026

File Form 3 for all currently serving directors and officers

Filing agent

March 18, 2026 (by 10:00 p.m. ET)

Set up company website posting process for Section 16 filings

IR / legal team

Before March 18, 2026

Establish transaction notification channel

Legal / compliance

Before March 18, 2026

File Form 4 for each covered transaction

Filing agent

Within 2 business days of each transaction

File Form 5 if required

Filing agent

Within 45 days of fiscal year end

 

Sources and References

[1] SEC Press Release No. 2026-23, "SEC Adopts Final Rules for the Holding Foreign Insiders Accountable Act" (Feb. 27, 2026). Available at: https://www.sec.gov/newsroom/press-releases/2026-23-sec-adopts-final-rules-holding-foreign-insiders-accountable-act. Statement of Chairman Paul S. Atkins available at: https://www.sec.gov/newsroom/speeches-statements/atkins-statement-final-rules-holding-foreign-insiders-accountable-act-022726. Final rule (Release No. 34-104903) available at: https://www.sec.gov/files/rules/final/2026/34-104903.pdf.

[2] SEC EDGAR Next program information. Available at: https://www.sec.gov/submit-filings/improving-edgar/edgar-next-improving-filer-access-account-management. Login.gov is operated by the U.S. General Services Administration.

[3] Login.gov authentication and account management guidance. Available at: https://www.login.gov/help/. SEC guidance on obtaining Login.gov individual account credentials available through EDGAR Filer Support resources.

[4] SEC EDGAR Next FAQ on Login.gov credential issues, shared accounts, and CIK re-association. Available through the EDGAR Filer Management portal help documentation.

[5] SEC EDGAR browser and technical access guidance. Available through EDGAR Filer Support resources at: https://www.sec.gov/submit-filings/filer-support-resources.

[6] SEC Form ID Guide and EDGAR Filer Manual. Available at: https://www.sec.gov/submit-filings/filer-support-resources.

[7] SEC EDGAR filing date rules for ownership forms. Confirmed in EDGAR Filer Manual, Vol. II, and EDGAR operating hours guidance.

More posts

blog image 1 Capital Markets How M&A Strategy Shapes the Path to IPO: Opportunities and Risks
As market conditions evolve and investor expectations rise, M&A has become a critical lever for companies seeking to enhance their IPO narrative and performance. This article explores how strategic acquisitions can shape valuation, improve investor perception, and prepare a company for public market success.
blog image 1 Capital Markets Navigating the Legal Minefield: The Indispensable Role of D&O Insurance in Today's Corporate World
As corporate governance undergoes unprecedented upheavals, directors and officers are increasingly under the spotlight. Legal challenges are becoming a frequent occupational hazard, making D&O insurance more popular in the market.
blog image 1 Capital Markets Best Practices for D&O Insurance Renewals
D&O insurance provides essential safeguards for a company's board members and executives by acting as a financial safety net for their indemnification rights and personal assets in cases where they face claims or investigations related to their service to the company.