Sub-certification process: who signs behind the CFO, and on what

A sub-certification process is the chain of internal sign-offs that sits under a regulatory signature. In a bank, the rules name only the people at the top: the chief financial officer signs a declaration on the Call Report, two or three directors attest to it, the holding company's CFO attests to the FR Y-9C, and the CEO and CFO sign the Part 363 management report. Everyone below them, the owners of the reconciliations, mapping rules, reviews and access controls the figures depend on, signs a sub-certification that their controls operated. The process is hard because it runs against a 30-day filing clock across 20 or 30 people, and run by email and a tracker it leaves the CFO signing on statements nobody tested. Botminds' Regulatory Reporting Controls exists to make each of those signatures rest on evidence that was captured and tested before the CFO signs.

What is sub-certification?

Sub-certification is a signed statement from a person below the certifying officer that the part of the process they own worked as designed for the period, with any exceptions named. It is a management practice, not a form: none of the texts that set these signatures, the Call Report General Instructions, 12 CFR Part 363 or section 302 of the Sarbanes-Oxley Act, uses the word. What the texts do require is a person at the top who signs for everything beneath.

Section 302 comes closest to describing why the chain exists. It makes the signing officers of a public company certify that they "have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared" (15 U.S.C. 7241(a)(4)(B)). "Made known to such officers by others" is the job a sub-certification does. A Call Report CFO has no section 302 duty for that report, but the logic is the same: one person attests to a report built by dozens.

Who signs the Call Report, and how many directors attest?

The CFO signs and the directors attest, and the number of directors depends on the charter. The General Instructions say the chief financial officer "(or the individual performing an equivalent function) shall sign a declaration on the cover (signature) page attesting to the correctness" of the report. National banks, state member banks and savings associations need at least three directors, state nonmember banks at least two, and none of them may be the officer who signed the CFO declaration (FFIEC 031/041 General Instructions, September 2026). The holding company report and the annual FDICIA report each have their own signers.

The FR Y-9C adds a sentence the Call Report cover does not carry. Above the CFO's signature it says: "Each holding company's board of directors and senior management are responsible for establishing and maintaining an effective system of internal control, including controls over the Consolidated Financial Statements for Holding Companies" (FR Y-9C, form dated 03/2026). Part 363 asks the same of an insured institution in statute: a report signed by the CEO and the chief accounting or financial officer stating management's responsibility for "establishing and maintaining an adequate internal control structure and procedures for financial reporting" (12 U.S.C. 1831m(b)). The signature is personal; the controls behind it are not.

The chain beneath the CFO's signature

A working chain has five links, and each signs for something different. The process owner signs that their controls ran. An independent reviewer signs each control instance they checked. The Controller reads every sub-certification, decides how to classify each deficiency and recommends. The CFO attests. The directors attest last, before the report is filed.

Examiners test the chain from the top. The OCC's internal control questionnaire for regulatory reporting asks, for banks that prepare reports without mapping software: "Is the person who attests to the accuracy of the information in the regulatory report different from the person who provides the report data and the person who is the report's reviewer?" (OCC Comptroller's Handbook, "Regulatory Reporting," internal control questionnaire). The same booklet's examination procedures tell examiners to review the reports "to determine whether the signature and attestation requirements were met." A sub-certification chain is the bank's answer to both questions, in writing, before the examiner asks.

What does a SOX 302 sub-certification add?

A SOX 302 sub-certification adds two disclosures a Call Report chain often leaves out: deficiencies and fraud. Section 302 makes the signing officers certify that they have disclosed to the auditors and the audit committee "all significant deficiencies in the design or operation of internal controls" and any material weaknesses, plus "any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal controls" (15 U.S.C. 7241(a)(5)). A sub-certification that only says "my controls operated" gives the officer nothing to disclose from.

The Call Report needs its own chain even where the holding company is public. The 10-Q and the Call Report are different reports with different instructions, prepared to different line definitions, and a 302 sub-certification scoped to the consolidated statements does not say anything about the mapping of a general ledger account to Schedule RC-C. Where one programme serves both, each sub-certification should name the reports it covers. Part 363 makes the link explicit at the annual level: at $5 billion and above, management's assessment of internal control must state that it "included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions" (12 CFR 363.2(b)(3)(ii)). Internal controls over financial reporting include your Call Report works through what that sentence requires.

Where the chain breaks: a signature on what nobody checked

The usual sub-certification is a statement of belief, not of evidence. An owner signs that their controls operated because nothing went wrong that they heard of. The Controller tracks who has signed, not what each signature rests on. By the time internal audit or the external auditor tests a control, the quarter has been filed and the signatures are weeks old.

Take a sample bank's third quarter as it runs through the solution. Tessaly Community Bank is fictional, as are its people and figures: a $3.4 billion bank filing the FFIEC 041 for September 30, 2026, due Friday, October 30. On day 22 of 30, 22 of its 23 process owners are ready to sign. The one who is not, Dana Ostrow, owns the monthly loan subledger to general ledger reconciliation. Her July instance was prepared and reviewed by the same person, Dana herself, 14 minutes apart on a Sunday while her reviewer was on leave. By hand, her sub-certification would have said her four controls operated, and it would have been signed.

The attestation as a tree of named people, with the one blocked branch

Each owner's chip shows the date they signed. Dana Ostrow's shows the reason she cannot yet: a separation-of-duties break on one of her four controls.

A sub-certification is worth what the owner could see when signing. If the owner could not see that their own July reconciliation was self-reviewed, neither could the CFO.

What should a sub-certification template include?

A sub-certification template should make the owner state facts they can check, not a belief. The eight items below come from what the rules ask the people at the top: the OCC's examination steps ask about changes in requirements, systems and personnel since the last exam, and its booklet treats unrecognised subsequent events as misstatements; section 302 asks about deficiencies, fraud and changes in controls. Each one moves a question an examiner would ask down to the person who can answer it.

Item three is the one most templates leave out, and it is the one that would have caught Dana's July instance. How to make it impossible rather than merely declared is the subject of separation of duties in accounting, enforced instead of trusted. What counts as evidence behind item eight is set out in control evidence that holds up for examiners and auditors.

Can the Call Report be signed electronically?

Yes, if the bank's process meets four principles in the General Instructions, and the same four make a good test of an internal sub-certification. The signer must intend to sign "as the attestation that it is prepared in accordance with the instructions and is true and correct"; the signature must be tied to a full version of the report and dated, so the bank can show it was given before the report was submitted; the signer must be identified and authenticated through a reliable log-in; and the signed report must be stored so that it can be retrieved and cannot be lost or changed (FFIEC General Instructions, Signatures).

The retention period follows the paper report. The General Instructions tell banks to keep the signed and attested Call Report, amendments, workpapers and supporting documentation for three years after the report date, unless state law requires longer, and an electronically signed report for the same time. Many banks keep sub-certifications and their evidence longer: the external accountant must keep Part 363 working papers for seven years from the report release date (12 CFR 363.3(e)), and the evidence an accountant relies on is often the bank's own.

A sub-certification calendar that ends before day 30

The calendar has to leave the CFO time to read, which means the owners' deadline sits well inside the filing window. The Call Report is due 30 calendar days after the report date, and the instructions allow no other extension. A sub-certification due on day 28 leaves the Controller no time to act on what it says. The sample bank's settings put the owners' deadline on day 20 and the CFO's attestation by day 29.

The directors are the hardest link to schedule. Where their attestation rides on a board or committee meeting, as it does in the sample bank, the meeting date, not the filing date, is the real deadline for everything beneath it. A calendar that is built backwards from that meeting tells each owner the day they must sign by, and shows the Controller on any given morning which branch of the tree is late and why.

How Regulatory Reporting Controls runs the sub-certification process

Regulatory Reporting Controls turns the chain into a tree the CFO can open, and it refuses a signature that has nothing tested behind it. A Certification coordinator agent sends the requests, reminders and escalations on the bank's calendar. An Evidence agent captures each control's evidence with its time and a hash as the control runs. A checking agent, the Skeptic, compares preparer and reviewer on every instance and flags late evidence; its flag holds the owner's sub-certification until a person decides. An owner can sign only when their controls have no open flags, and the Controller can revoke a signature, with a reason, when its evidence changes.

The CFO attests only when everything behind the declaration is listed and open

In the sample quarter Dana's July instance was re-reviewed by an independent reviewer, the Controller decided the deficiency, Dana signed, and the tree read 23 of 23. The solution's rules keep the links apart: the Controller who recommends can never attest, and the CFO cannot recommend. What it does not do is sign anything. Agents never sign a sub-certification, never close their own flags and never decide a deficiency, and the directors still attest at their own meeting. The design target is that no self-reviewed control instance reaches the CFO's attestation.

Questions people ask

Is a sub-certification required by law?

Not by that name. The Call Report instructions require the CFO's declaration and the directors' attestation, Part 363 requires the CEO and CFO to sign the management report, and section 302 requires public-company officers to certify. Sub-certification is how management supports those signatures, and examiners test whether the bank's process gives the signers a basis for them.

How many directors must attest the Call Report?

At least three for national banks, state member banks and savings associations, and at least two for state nonmember banks. In both cases the directors must be people other than the officer who signs the CFO declaration, under the FFIEC General Instructions in force for the September 30, 2026 report.

What does the CFO attest on the FR Y-9C?

That the report and its supporting schedules were prepared in conformance with the Federal Reserve System's instructions and are true and correct to the best of the CFO's knowledge and belief. The FR Y-9C is filed by holding companies with $3 billion or more in total consolidated assets, and its cover adds that the board and senior management are responsible for the controls over it.

Who signs the Part 363 management report?

The chief executive officer and the chief accounting officer or chief financial officer of the institution, or of the holding company where the requirement is met at that level. Where components are split between the two levels, both sets of officers sign and the report says which level satisfies each component.

How long must a signed Call Report be kept?

Three years after the report date, including amended reports, workpapers and supporting documentation, unless state law requires longer. An electronically signed report is kept for the same period as a paper one.

Can a sub-certification be withdrawn after it is signed?

It should be, when the evidence behind it changes: a reconciliation reopened, a review found to be a self-review, an error found after the report date. The withdrawal needs a reason and a date, and the owner signs again once the issue is resolved, so the trail shows both signatures rather than one edited one.