MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
To: Wilhelm Ostermann, General Counsel (Chefjustitiar), Halcyon Semiconductor Aktiengesellschaft Katarina Dalmqvist, Chief Financial Officer (Finanzvorstand), Halcyon Semiconductor Aktiengesellschaft
From: Vivienne St. Claire, Partner, Calderwood & Harkness LLP Claire Dempsey, Associate, Calderwood & Harkness LLP
Date: February 10, 2026
Re: Sarbanes-Oxley Act Compliance Roadmap — Halcyon Semiconductor AG (Foreign Private Issuer)
Matter No.: 1032-00003
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide Halcyon Semiconductor Aktiengesellschaft ("Halcyon," "HSAG," or the "Company") with a comprehensive, phased compliance roadmap for the Sarbanes-Oxley Act of 2002, as amended (the "Sarbanes-Oxley Act" or "SOX"), in connection with the prospective initial public offering in the United States of American Depositary Shares ("ADSs"), each representing one ordinary share (Aktie) of Halcyon, on the Nasdaq Global Select Market (proposed ticker symbol: HCYN) pursuant to a Level III American Depositary Receipt ("ADR") program.
Halcyon is a German stock corporation (Aktiengesellschaft) incorporated and registered in Munich, Bavaria, Federal Republic of Germany (Commercial Register No. HRB 217458, Local Court (Amtsgericht) Munich). Halcyon is currently listed on the Frankfurt Stock Exchange (Frankfurter Wertpapierbörse) under the ticker symbol FRA: HCY in the Prime Standard segment. Upon effectiveness of the Registration Statement on Form F-1 to be filed with the United States Securities and Exchange Commission (the "SEC") and the listing of the ADSs on the Nasdaq Global Select Market, Halcyon will become subject to the reporting obligations of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), including the requirements of the Sarbanes-Oxley Act. The Company will also become subject to the listing rules of the Nasdaq Stock Market LLC ("Nasdaq").
Halcyon intends to qualify and maintain its status as a "foreign private issuer" ("FPI") under Rule 3b-4 promulgated under the Exchange Act, which affords certain accommodations and extended phase-in periods for SOX compliance, as described in detail throughout this memorandum. As an FPI, Halcyon will file its registration statement on Form F-1, will file annual reports on Form 20-F (rather than Form 10-K applicable to domestic U.S. issuers), and will furnish current reports on Form 6-K (rather than file current reports on Form 8-K). Halcyon will not be subject to the quarterly reporting requirements applicable to domestic issuers on Form 10-Q.
The current target timeline for the offering is as follows:
• Target effectiveness date of Registration Statement on Form F-1: June 22, 2026
• Target pricing date: July 1, 2026
• Target closing and settlement date: July 6, 2026
This memorandum addresses the following key areas of SOX compliance applicable to Halcyon:
(a) SOX Section 302 — CEO and CFO periodic certifications;
(b) SOX Section 404 — Internal control over financial reporting ("ICFR"), including the critical Section 404(a) management assessment and Section 404(b) independent auditor attestation;
(c) SOX Section 906 — Criminal certifications accompanying periodic reports;
(d) Audit committee independence and financial expertise requirements under Exchange Act Rule 10A-3 and Nasdaq listing rules;
(e) Compensation recovery ("clawback") policy requirements under Exchange Act Rule 10D-1 and Nasdaq Listing Rule 5608;
(f) Whistleblower and complaint procedures under SOX Section 301;
(g) Code of ethics requirements under SOX Section 406;
(h) Real-time disclosure obligations and other applicable SOX provisions, including Sections 303, 304, 401, 402, 409, and 802; and
(i) A recommended phased implementation timeline and compliance calendar designed to ensure that Halcyon achieves full SOX compliance within the required timeframes.
This memorandum also addresses the coordination required with Halcyon's German legal counsel, Bähr Stein Rechtsanwälte, the Company's independent auditors, Blackmere & Whitfield LLP / Blackmere & Whitfield GmbH Wirtschaftsprüfungsgesellschaft, and the Company's insurance brokers regarding directors' and officers' liability insurance considerations arising from SOX compliance obligations.
We note at the outset that SOX compliance represents a substantial undertaking for any company, and particularly so for a European company transitioning to the U.S. public reporting regime. However, with appropriate planning, resourcing, and coordination among the various workstreams, Halcyon can achieve a smooth and orderly transition. The phased timeline set forth herein is designed to be realistic and achievable, while leaving adequate margin for the remediation of any control deficiencies identified during the ICFR assessment process.
II. Overview of SOX Applicability to Foreign Private Issuers
A. General Applicability
The Sarbanes-Oxley Act applies broadly to all "issuers" as defined in Section 2(a)(7) of the Act — that is, every issuer that has securities registered under Section 12 of the Exchange Act or that is required to file reports under Section 15(d) of the Exchange Act, and every issuer that files or has filed a registration statement that has not yet become effective under the Securities Act of 1933, as amended (the "Securities Act"), and that has not been withdrawn. This definition encompasses foreign private issuers that list their securities (or ADSs representing their securities) on a U.S. national securities exchange such as Nasdaq.
Accordingly, upon effectiveness of Halcyon's Registration Statement on Form F-1 and the listing of the ADSs on the Nasdaq Global Select Market, the Company will become an "issuer" subject to the provisions of the Sarbanes-Oxley Act. FPI status does not provide a blanket exemption from SOX. Although certain provisions of the Act are phased in over an extended period for FPIs, and although FPIs benefit from a number of accommodations in the manner in which SOX obligations are implemented, the core substantive requirements of SOX apply in full to foreign private issuers.
As noted above, Halcyon will file annual reports on Form 20-F (as opposed to Form 10-K for domestic issuers) and will furnish current reports on Form 6-K (as opposed to filing current reports on Form 8-K). The Form 20-F annual report filing triggers the obligation to include the certifications required by SOX Sections 302 and 906, as well as the management assessment and auditor attestation of ICFR required by Section 404 (subject to the phase-in periods described below). SOX compliance obligations generally commence upon the effectiveness of the registration statement and the listing of the securities on a U.S. national securities exchange.
B. Key FPI Accommodations
While FPIs are subject to the substantive requirements of SOX, the following accommodations are available to foreign private issuers and are relevant to Halcyon's compliance planning:
Extended Phase-In for Section 404. Newly listed issuers, including FPIs, benefit from an extended phase-in period for the Section 404(a) management assessment and the Section 404(b) auditor attestation of ICFR. Specifically, a newly listed issuer is not required to include a management assessment of ICFR in its first annual report filed after going public. As discussed in detail in Section IV below, this means that Halcyon's first Section 404(a) management assessment and Section 404(b) auditor attestation will be required for the fiscal year ending December 31, 2027, not for the fiscal year ending December 31, 2026.
Home-Country Governance Practices. Under Nasdaq Rule 5615(a)(3), an FPI may follow its home-country corporate governance practices in lieu of certain Nasdaq corporate governance listing requirements, provided that it discloses the significant differences between its home-country practices and Nasdaq's requirements. This accommodation is addressed in a separate companion memorandum regarding Nasdaq corporate governance compliance and the required exemption notice. We note, however, that the Nasdaq Rule 5615(a)(3) exemption does not extend to certain fundamental requirements, including the requirements of Exchange Act Rule 10A-3 relating to audit committee independence, which are SEC requirements rather than Nasdaq listing standards.
No Quarterly Reporting. FPIs are not required to file quarterly reports on Form 10-Q. As a result, SOX Section 302 and Section 906 certifications are required only on an annual basis in connection with the Form 20-F filing, rather than on a quarterly basis. This is a significant practical accommodation that reduces the frequency of the certification process and the related sub-certification and disclosure committee procedures.
No Proxy Statement Requirements. FPIs are exempt from the SEC's proxy solicitation rules under Section 14 of the Exchange Act and Regulation 14A. This exemption, while not directly a SOX accommodation, simplifies the governance disclosure regime applicable to Halcyon.
Notwithstanding these accommodations, we emphasize that FPIs are not exempt from Exchange Act Rule 10A-3 audit committee independence requirements, which are applicable to all listed issuers regardless of FPI status. FPIs do, however, benefit from a limited phase-in period for achieving full audit committee independence, as described in Section VI below.
C. Halcyon's Reporting Cycle
Halcyon's fiscal year ends on December 31 of each calendar year. The Company's reporting cycle as a U.S.-listed FPI will be as follows:
Annual Report on Form 20-F. Halcyon's first Form 20-F annual report will cover the fiscal year ending December 31, 2026. Under SEC rules, a foreign private issuer must file its Form 20-F within four months after the end of its fiscal year. Accordingly, Halcyon's first Form 20-F will be due on or before April 30, 2027. Subsequent annual reports will follow the same four-month deadline.
Current Reports on Form 6-K. As an FPI, Halcyon is not subject to the Form 8-K current reporting requirements applicable to domestic issuers. Instead, Halcyon will furnish current reports on Form 6-K as and when material information arises that it makes or is required to make public pursuant to the law of Germany, that it files or is required to file with the Frankfurt Stock Exchange or any other stock exchange, or that it distributes or is required to distribute to its security holders. Halcyon may also voluntarily furnish additional information on Form 6-K. Form 6-K reports are "furnished" rather than "filed" with the SEC, a distinction that has implications for liability under Section 18 of the Exchange Act. Halcyon should establish internal protocols to ensure the prompt furnishing of material information on Form 6-K.
No Quarterly Reporting. As noted above, Halcyon will not be required to file quarterly reports on Form 10-Q. However, to the extent that Halcyon publishes interim financial information in Germany or furnishes such information to the Frankfurt Stock Exchange (as is customary for companies listed in the Prime Standard segment), such interim information should be furnished to the SEC on Form 6-K. We recommend that Halcyon continue its practice of publishing half-year financial reports and quarterly management statements as currently required under the Prime Standard rules, and that these be furnished on Form 6-K.
Financial Statements — IFRS. Halcyon's financial statements are prepared in accordance with International Financial Reporting Standards ("IFRS") as issued by the International Accounting Standards Board ("IASB"). Under SEC rules, FPIs that prepare their financial statements in accordance with IFRS as issued by the IASB are not required to provide a reconciliation to U.S. Generally Accepted Accounting Principles ("U.S. GAAP"). This is a significant accommodation that eliminates the substantial cost and complexity that would otherwise be associated with maintaining parallel U.S. GAAP financial statements or a U.S. GAAP reconciliation.
D. PCAOB Oversight
The Sarbanes-Oxley Act established the Public Company Accounting Oversight Board ("PCAOB") to oversee the audits of public companies and SEC-registered broker-dealers. Under Section 102 of SOX, every public accounting firm that prepares or issues audit reports for issuers must register with the PCAOB.
Halcyon's independent auditors are Blackmere & Whitfield LLP (the U.S. member firm) and Blackmere & Whitfield GmbH Wirtschaftsprüfungsgesellschaft (the German member firm). Both firms must be registered with the PCAOB. The lead engagement partner based in Munich is Dieter Kaufmann (Wirtschaftsprüfer), and the PCAOB-registered firm contact for the U.S. engagement is Graham Templeton, Partner, based at the firm's New York office at 7 Times Square, New York, NY 10036.
PCAOB registration and inspection obligations apply from the date Halcyon becomes a reporting issuer under the Exchange Act. The PCAOB has the authority to inspect registered accounting firms and to enforce compliance with the PCAOB's auditing, quality control, ethics, and independence standards. PCAOB inspections of non-U.S. audit firms have historically been a sensitive issue, particularly in jurisdictions that restrict the ability of foreign regulators to access audit workpapers. We do not anticipate material issues in this regard with respect to the German member firm, given the cooperation frameworks in place between the PCAOB and the German Auditor Oversight Body (Abschlussprüferaufsichtsstelle, or "APAS"). However, PCAOB inspection access to audit workpapers prepared by any component auditor in the People's Republic of China (relevant to Halcyon Shanghai Semiconductor Co., Ltd.) should be discussed with Blackmere & Whitfield in light of the Statement of Protocol between the PCAOB and the China Securities Regulatory Commission ("CSRC") and the Ministry of Finance of the People's Republic of China, as amended.
We recommend that Halcyon confirm the current PCAOB registration status of both the U.S. and German Blackmere & Whitfield entities, as well as any component auditors in other jurisdictions, prior to the listing date.
III. Section 302 — CEO/CFO Certifications
A. Requirement
Section 302 of the Sarbanes-Oxley Act requires the principal executive officer ("PEO") and the principal financial officer ("PFO") of each issuer to execute certifications that are included in each annual report filed on Form 20-F (and, in the case of domestic issuers, each quarterly report on Form 10-Q, which is not applicable to FPIs). The certifications are required by Exchange Act Rules 13a-14(a) and 15d-14(a) and must be filed as exhibits to the Form 20-F.
The Section 302 certifications require each certifying officer to state, among other things, that:
(i) the signing officer has reviewed the report;
(ii) based on the signing officer's knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by the report;
(iii) based on the signing officer's knowledge, the financial statements and other financial information included in the report fairly present in all material respects the financial condition, results of operations, and cash flows of the issuer as of, and for, the periods presented in the report;
(iv) the signing officer and the other certifying officer are responsible for establishing and maintaining disclosure controls and procedures ("DC&P") (as defined in Exchange Act Rule 13a-15(e)) and internal control over financial reporting ("ICFR") (as defined in Exchange Act Rule 13a-15(f)) for the issuer, and have designed such DC&P and ICFR, or caused such DC&P and ICFR to be designed under their supervision, to ensure that material information is made known to them;
(v) the signing officer has disclosed to the issuer's auditors and audit committee any change in the issuer's ICFR that occurred during the period covered by the report that has materially affected, or is reasonably likely to materially affect, the issuer's ICFR; and
(vi) the signing officer has disclosed to the issuer's auditors and audit committee, based on their most recent evaluation of ICFR, any significant deficiencies and material weaknesses in the design or operation of ICFR, and any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's ICFR.
For Halcyon, the certifying officers will be:
• Principal Executive Officer: Dr. Friedrich Wendt, Chairman of the Management Board (Vorstandsvorsitzender) and Chief Executive Officer
• Principal Financial Officer: Katarina Dalmqvist, Member of the Management Board (Finanzvorstand) and Chief Financial Officer
B. Timing
Section 302 certifications are required beginning with the first annual report filed on Form 20-F after the Company's listing on Nasdaq. For Halcyon, assuming a listing effectiveness date of June 22, 2026, the first Form 20-F will be the annual report for the fiscal year ending December 31, 2026, which is due on or before April 30, 2027. Accordingly, the first Section 302 certifications will be due in connection with that filing.
Because Halcyon, as an FPI, is not required to file quarterly reports on Form 10-Q, Section 302 certifications are required only on an annual basis. This stands in contrast to domestic U.S. issuers, which must provide Section 302 certifications with each quarterly report. This is an important practical distinction, as it means that Halcyon's certifying officers will be required to execute these certifications once per year, rather than four times per year.
C. Practical Steps
To support the CEO and CFO certifications, Halcyon should implement a robust sub-certification and disclosure committee process. We recommend the following steps:
1. Sub-Certification Process. Halcyon should establish a formal sub-certification process pursuant to which officers of each material subsidiary provide written representations to the certifying officers (Dr. Wendt and Ms. Dalmqvist) confirming the accuracy and completeness of financial and operational information relevant to the consolidated financial statements and SEC filings. Sub-certifications should flow from the following subsidiaries:
• Halcyon Semiconductor USA Inc. (incorporated in Delaware; principal offices in Santa Clara, California)
• Halcyon Power Solutions GmbH (Dresden, Saxony, Germany)
• Halcyon Asia Pacific Pte. Ltd. (Singapore)
• Halcyon Shanghai Semiconductor Co., Ltd. (Shanghai, People's Republic of China)
• Halcyon Automotive Components s.r.o. (Brno, Czech Republic)
The sub-certification process should be designed to capture information regarding material transactions, contingent liabilities, off-balance sheet arrangements, related party transactions, subsequent events, and any other matters that could affect the accuracy of the Company's consolidated financial statements or other disclosures in the Form 20-F.
2. Disclosure Committee. We recommend that Halcyon establish an internal disclosure committee, chaired by Wilhelm Ostermann (General Counsel), with representatives from the finance, legal, operations, and compliance functions. The disclosure committee should be responsible for evaluating the materiality of information and events, reviewing draft SEC filings, coordinating the sub-certification process, and advising the certifying officers on disclosure matters. A formal disclosure committee charter should be adopted setting forth the committee's mandate, membership, and procedures.
3. Disclosure Controls and Procedures (DC&P). Halcyon must design and implement DC&P that are effective across all material subsidiaries and jurisdictions. DC&P are defined under Exchange Act Rule 13a-15(e) as controls and other procedures designed to ensure that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC's rules and forms, and that such information is accumulated and communicated to the issuer's management, including the certifying officers, to allow timely decisions regarding required disclosure.
The DC&P framework should encompass:
• Processes for the identification and escalation of material information from subsidiary operations to the parent company's management
• Procedures for the preparation, review, and approval of SEC filings
• Policies governing disclosure of material developments via Form 6-K
• Protocols for the evaluation of materiality of information and events
• Information technology systems and controls supporting the accumulation and communication of disclosure-relevant information
4. DC&P Evaluation. The certifying officers are required to evaluate the effectiveness of the issuer's DC&P as of the end of each fiscal year covered by an annual report on Form 20-F. The first such evaluation must be completed in time for the FY2026 Form 20-F. We recommend that the disclosure committee coordinate this evaluation and that the results be documented in a memorandum to the certifying officers.
5. Template Certifications. Calderwood & Harkness will prepare template Section 302 certifications in the form required by Exchange Act Rules 13a-14(a) and 15d-14(a) for attachment as exhibits to the Form 20-F. These templates will be provided to Halcyon in advance of the first annual report filing.
IV. Section 404 — Internal Control Over Financial Reporting (ICFR)
Section 404 of the Sarbanes-Oxley Act is widely regarded as the most significant and resource-intensive compliance obligation imposed by the Act. It requires both a management assessment of the effectiveness of the issuer's ICFR and an independent auditor attestation on that assessment. This section discusses each component in detail, together with the applicable phase-in periods and our recommended implementation timeline.
A. Section 404(a) — Management Assessment
1. Requirement. Section 404(a) of the Sarbanes-Oxley Act requires the management of each issuer to include in the annual report (Form 20-F for FPIs) the following:
(a) A statement of management's responsibility for establishing and maintaining adequate ICFR for the issuer; and
(b) An assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the issuer's ICFR.
ICFR is defined in Exchange Act Rule 13a-15(f) as a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. For Halcyon, the applicable financial reporting framework is IFRS as issued by the IASB, which is treated as the equivalent of GAAP for purposes of the ICFR definition in the context of FPI reporting.
2. Phase-In for FPIs / Newly Public Companies
Under the SEC's rules, a company that becomes a reporting issuer as a result of an initial public offering is not required to include a management assessment of ICFR in its first annual report filed after going public. This phase-in applies regardless of whether the issuer is a domestic company or an FPI.
For Halcyon, assuming a listing effectiveness date of June 22, 2026, the first annual report will be the Form 20-F for the fiscal year ending December 31, 2026 (due by April 30, 2027). Management's ICFR assessment is NOT required for this first annual report. The Section 404(a) management assessment is first required for the Form 20-F for the fiscal year ending December 31, 2027 (due by April 30, 2028).
This phase-in period is critical to Halcyon's compliance planning because it provides the Company with an additional full fiscal year (from the listing date in mid-2026 through the end of fiscal year 2027) to design, implement, and test its ICFR before management is required to report on its effectiveness.
3. Framework. The SEC has stated that management must base its assessment of ICFR on a suitable, recognized control framework established by a body or group that has followed due-process procedures. The most widely used framework is the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") 2013 Internal Control — Integrated Framework. We strongly recommend that Halcyon adopt the COSO 2013 Framework as the basis for its ICFR assessment. This framework is recognized by the SEC, the PCAOB, and the vast majority of public company issuers and their auditors.
The COSO 2013 Framework consists of five integrated components of internal control:
1. Control Environment — The set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.
2. Risk Assessment — The process for identifying, analyzing, and managing risks to the achievement of the organization's objectives.
3. Control Activities — The actions established through policies and procedures that help ensure management directives to mitigate risks are carried out.
4. Information and Communication — The information necessary for the entity to carry out its internal control responsibilities, and the communication of that information to relevant stakeholders.
5. Monitoring Activities — The evaluations, whether ongoing or separate, used to ascertain whether each of the five components of internal control is present and functioning.
Within these five components, the COSO 2013 Framework identifies 17 principles that represent the fundamental concepts associated with each component. Management's assessment must evaluate whether each of these 17 principles is present and functioning and whether the five components are operating together in an integrated manner.
We recommend that Halcyon engage an internal ICFR project team and potentially retain an external consultant with Section 404 implementation experience to assist with the following activities:
• Scoping: Identifying material subsidiaries, significant accounts, and relevant financial statement assertions that will be within the scope of the ICFR assessment
• Process Mapping: Documenting key business processes that affect financial reporting, including the flow of transactions from initiation through recording in the general ledger
• Control Identification: Identifying the key controls within each business process that address the risks of material misstatement in the financial statements
• Testing: Designing and executing tests of the design and operating effectiveness of key controls
• Remediation: Identifying control deficiencies and implementing corrective actions to achieve effective ICFR
Given Halcyon's specific business as a semiconductor manufacturer with significant operations across multiple jurisdictions, the following areas are likely to present particular complexity for the ICFR assessment and should receive early attention in the scoping and risk assessment process:
• Revenue Recognition: Halcyon's revenue streams include long-term supply agreements with automotive OEM customers, volume purchase agreements with industrial and consumer electronics manufacturers, and technology licensing arrangements. The application of IFRS 15 (Revenue from Contracts with Customers) to these arrangements, including the identification of performance obligations, determination of transaction prices (including variable consideration), and the allocation of consideration to performance obligations, requires significant judgment and presents inherent ICFR risk.
• Inventory Valuation: As a semiconductor manufacturer, Halcyon maintains substantial inventories of raw materials, work-in-process ("WIP"), and finished goods across fabrication facilities in Munich (Fab 1 and Fab 2), Dresden (Fab 3, currently under construction), and the assembly and test operations in Brno and Shanghai. Inventory valuation under IFRS (IAS 2) involves assumptions regarding standard costs, yield rates, inventory obsolescence, and net realizable value that require management judgment and are subject to ICFR risk.
• Capital Expenditure: The construction of Fab 3 in Dresden, to which approximately $280,000,000 of IPO proceeds is expected to be allocated, will involve significant capitalization decisions, including the capitalization of borrowing costs under IAS 23, the identification of separately depreciable components under IAS 16, and the assessment of impairment indicators. Controls over capital expenditure authorization, project accounting, and asset commissioning will be important.
• Intercompany Transactions and Transfer Pricing: Halcyon's multinational operational structure involves significant intercompany transactions between the parent company in Germany and its subsidiaries in the United States, Singapore, China, and the Czech Republic. Transfer pricing policies and the related intercompany accounting must be accurately reflected in the consolidated financial statements, and the elimination of intercompany balances and transactions in consolidation is a key ICFR consideration.
• Foreign Currency, Hedging, and Financial Instruments: Halcyon transacts in multiple currencies (EUR, USD, SGD, CNY, CZK) and employs hedging strategies to manage foreign currency and interest rate exposure. The accounting for hedging relationships under IFRS 9, including the designation and documentation of hedging relationships, effectiveness testing, and the reclassification of hedging gains and losses, requires specialized controls.
B. Section 404(b) — Auditor Attestation
1. Requirement. Section 404(b) of the Sarbanes-Oxley Act requires the independent registered public accounting firm that audits the issuer's financial statements to attest to, and report on, management's assessment of the effectiveness of the issuer's ICFR. The auditor's attestation report must be included in the annual report (Form 20-F). The auditor's attestation is performed in accordance with PCAOB Auditing Standard No. 2201 (An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements).
The Section 404(b) auditor attestation is widely recognized as the most resource-intensive and costly component of SOX compliance. It requires the independent auditor to plan and perform an audit of the issuer's ICFR that is integrated with the audit of the financial statements. The auditor must obtain sufficient evidence to express an opinion on the effectiveness of ICFR and must evaluate the severity of any identified control deficiencies. If the auditor identifies a material weakness in ICFRR, the auditor must issue an adverse opinion on ICFRR, which is a significant and highly visible event for any public company.
2. Phase-In for FPIs
The phase-in for the Section 404(b) auditor attestation aligns with the phase-in for the Section 404(a) management assessment. Because newly listed issuers are not required to include a management assessment of ICFRR in their first annual report, the auditor attestation is similarly not required for the first annual report.
Critical point: For Halcyon, the Section 404(b) auditor attestation is first required for the fiscal year ending December 31, 2027. Blackmere & Whitfield must perform an integrated audit — encompassing both the financial statement audit and the ICFRR audit — for the fiscal year ending December 31, 2027, and the auditor's attestation report on ICFRR must be included in the Form 20-F for FY2027 (due by April 30, 2028).
This means that Halcyon effectively has approximately 18 months from the target listing date (July 2026) to prepare for the Section 404(b) attestation engagement covering fiscal year 2027. While this may appear to be a generous timeline, our experience advises that Section 404 implementation for a company of Halcyon's size and complexity requires the full 18-month period, and in many cases companies begin preparation even earlier.
Note Regarding Emerging Growth Company Status: Under the Jumpstart Our Business Startups Act of 2012 (the "JOBS Act"), an issuer that qualifies as an "emerging growth company" ("EGC") is exempt from the Section 404(b) auditor attestation requirement for so long as it retains EGC status (up to five fiscal years after the IPO). An issuer qualifies as an EGC if it had total annual gross revenues of less than $1.235 billion (as adjusted for inflation) during its most recently completed fiscal year and meets certain other conditions.
Based on Halcyon's annual revenue for the fiscal year ending December 31, 2025 (estimated at €3,820 million, or approximately $4,118 million USD at a €1 = $1.078 exchange rate), Halcyon's revenue substantially exceeds the $1.235 billion EGC revenue threshold. Additionally, Halcyon's estimated market capitalization of approximately €8.6 billion further suggests that Halcyon would not qualify as an EGC. Accordingly, we have presumptively concluded that EGC status is not available to Halcyon, and the Section 404(b) auditor attestation will be required beginning with the FY2027 annual report. We will confirm this analysis as the IPO financial information is finalized.
3. Practical Steps and Recommended Timeline
We recommend that Halcyon organize its Section 404 ICFRR compliance project into four phases, as described below:
Phase 1 (Q3 2026 — Q4 2026): Planning and Scoping
• Appoint Section 404 Project Lead. Halcyon should designate a senior individual to serve as the Section 404 project lead with overall responsibility for managing the ICFRR compliance effort. This individual should report directly to CFO Katarina Dalmqvist and should have sufficient authority and resources to drive the project across all subsidiaries and business functions. We recommend that this appointment be made no later than August 2026, promptly following the closing of the IPO.
• Engage External ICFRR Advisory Consultant. Depending on the availability and depth of internal resources, Halcyon may wish to engage an external consulting firm with specific expertise in Section 404 implementation to assist with scoping, process documentation, gap analysis, and control testing. The selection of an external consultant should be coordinated with Blackmere & Whitfield to avoid any independence concerns (the external consultant cannot also be engaged as the auditor for purposes of the ICFRR attestation).
• Define Scope. The Section 404 project team should identify the material subsidiaries, significant accounts, and relevant financial statement assertions that will be within the scope of the ICFRR assessment. Scoping involves an assessment of the quantitative and qualitative significance of each subsidiary and each account balance and class of transactions, taking into account both the likelihood and magnitude of potential misstatement.
• Conduct Risk Assessment. The project team should conduct a comprehensive risk assessment to identify the significant processes and the specific risks of material misstatement within each process. This risk assessment will drive the identification of key controls to be documented and tested.
• Coordinate with Blackmere & Whitfield. Early and ongoing coordination with the independent auditors is essential. Halcyon should schedule an initial meeting with Dieter Kaufmann (Munich) and Graham Templeton (New York) to discuss the scope, timing, and approach for the Section 404(b) attestation engagement. Establishing a shared understanding of the scoping methodology, the definition of key controls, the documentation standards, and the testing approach will facilitate a more efficient and effective integrated audit.
• Begin Gap Analysis. Using the COSO 2013 Framework as the baseline, the project team should conduct a preliminary gap analysis to identify areas where Halcyon's existing internal controls may not satisfy the requirements for an effective ICFRR environment. This gap analysis will inform the prioritization of remediation efforts in subsequent phases.
Phase 2 (Q1 2027 — Q2 2027): Documentation and Walkthroughs
• Document Key Business Processes and Controls. For each significant process identified during the scoping and risk assessment phase, the project team should prepare comprehensive process documentation, including narrative descriptions, process flowcharts, and risk and control matrices ("RCMs"). The RCMs should map each significant risk to the specific control(s) that address that risk, and should identify the control owner, the control frequency (e.g., daily, weekly, monthly, quarterly, annually), the nature of the control (preventive or detective; manual or automated), and the relevant financial statement assertion(s) (existence, completeness, accuracy, valuation, rights and obligations, presentation and disclosure).
• Map Entity-Level Controls, IT General Controls, and Process-Level Controls. The ICFRR assessment must encompass three tiers of controls: (a) entity-level controls that operate at the organizational level and have a pervasive effect on the achievement of the Company's financial reporting objectives; (b) IT general controls ("ITGCs") that support the reliable operation of the Company's information technology systems relevant to financial reporting (including access controls, change management, computer operations, and program development); and (c) process-level controls that operate within specific business processes (e.g., order-to-cash, procure-to-pay, inventory management, financial close and reporting).
• Perform Walkthroughs. The project team should perform walkthroughs of each significant process to validate the accuracy and completeness of the process documentation and to confirm the design effectiveness of the identified key controls. Walkthroughs involve tracing a transaction from initiation through processing to recording in the financial statements, with inquiry of the individuals who perform the control activities, observation of the control activities being performed, and inspection of the documentation evidencing the performance of the control activities.
• Identify Control Gaps and Remediation Requirements. Based on the documentation and walkthrough results, the project team should identify any control gaps — instances where a significant risk is not adequately addressed by an existing control, where a control is not designed effectively, or where a control is not operating as designed. For each identified gap, the project team should develop a remediation plan with specific action items, responsible parties, and target completion dates. Remediation of control gaps should be completed as early as possible so that the remediated controls can be tested for operating effectiveness during Phase 3.
• IT Systems and Cybersecurity Controls. The project team should coordinate closely with Halcyon's IT organization regarding the ITGCs related to the Company's enterprise resource planning ("ERP") system(s), financial reporting applications, data warehouses, and any other IT systems that are relevant to financial reporting. ITGCs relating to user access management (including privileged access), segregation of duties within IT systems, change management for application configurations and code, and cybersecurity controls protecting the integrity and availability of financial data should be within scope.
Phase 3 (Q3 2027 — Q4 2027): Testing and Remediation
• Management's Operating Effectiveness Testing. The project team should design and execute tests of the operating effectiveness of key controls. Testing procedures may include inquiry, observation, inspection of documentation, and re-performance of control activities. The nature, timing, and extent of testing should be commensurate with the risk associated with each control. Higher-risk controls and controls that operate on a quarterly or annual basis will generally require more extensive testing.
• Remediation of Identified Deficiencies. To the extent that operating effectiveness testing identifies control deficiencies, the project team must assess the severity of each deficiency and determine whether it constitutes a control deficiency, a significant deficiency, or a material weakness, based on the guidance in PCAOB AS 2201 and SEC Staff interpretive guidance. Material weaknesses must be remediated and the remediated controls must be tested before management can conclude that ICFRR is effective as of year-end. Significant deficiencies, while not requiring an adverse conclusion on ICFRR effectiveness, should also be remediated to the extent practicable and must be communicated to the audit committee.
• Blackmere & Whitfield Independent Testing. During this phase, Blackmere & Whitfield will perform its own independent testing of key controls for purposes of the Section 404(b) attestation. The auditor's testing approach will be informed by its assessment of management's testing program but will also include independent procedures. Close coordination between the Halcyon project team and the audit team is essential to avoid duplication of effort, to ensure that information and access are provided to the auditors on a timely basis, and to facilitate the prompt resolution of any identified issues.
• Management Assessment. At the conclusion of the testing phase, management must prepare its assessment of the effectiveness of ICFRR as of December 31, 2027. This assessment must consider all evidence obtained during the scoping, documentation, walkthrough, and testing phases, as well as any deficiencies identified and the status of remediation efforts. If a material weakness exists as of December 31, 2027, management must conclude that ICFRR is not effective as of that date.
Phase 4 (Q1 2028): Reporting
• Management's Report on ICFRR. Management's report on ICFRR must be prepared and included in the Form 20-F for FY2027. The report must include a statement of management's responsibility for establishing and maintaining adequate ICFRR, an identification of the control framework used (COSO 2013), and management's assessment of the effectiveness of ICFRR as of December 31, 2027.
• Auditor Attestation Report. Blackmere & Whitfield must issue its attestation report on ICFRR, expressing an opinion on the effectiveness of the Company's ICFRR as of December 31, 2027. This report will be included in the Form 20-F alongside management's report.
• Filing. The Form 20-F for FY2027, including both the Section 404(a) management assessment and the Section 404(b) auditor attestation report, must be filed with the SEC by April 30, 2028.
C. Cost and Resource Estimates
First-year Section 404 compliance represents a significant financial and operational investment. Based on industry experience and benchmarking data for companies of comparable size and complexity to Halcyon (approximately 8,400 employees; five material subsidiaries across five jurisdictions — Germany, United States, Singapore, China, and the Czech Republic; annual revenue of approximately €3.82 billion), we estimate that first-year Section 404 compliance costs could range from $3,000,000 to $6,000,000. This estimate is inclusive of:
• Internal personnel costs (dedicated project team, incremental effort by finance, IT, and operational staff)
• External ICFRR advisory consultant fees
• Incremental audit fees for the Section 404(b) integrated audit by Blackmere & Whitfield
• Technology investments (e.g., governance, risk, and compliance ("GRC") software for control documentation and testing management)
• Training and change management costs
The upper end of this range would be more likely if the gap analysis reveals significant deficiencies in existing controls requiring substantial remediation, or if the scoping process identifies a larger number of material subsidiaries or significant processes than currently anticipated.
We strongly recommend that Halcyon discuss the incremental fees for the Section 404(b) integrated audit with Dieter Kaufmann and Graham Templeton early in the scoping phase (Phase 1). Establishing a clear understanding of the auditor's fee expectations and the factors that influence audit effort (such as the quality and completeness of management's documentation and testing, the number and severity of control deficiencies, and the extent to which the auditor can rely on management's testing) will facilitate budget planning and avoid surprises later in the process.
V. Section 906 — Criminal Certifications
A. Requirement
Section 906 of the Sarbanes-Oxley Act (codified at 18 U.S.C. § 1350) requires the chief executive officer and the chief financial officer of each issuer to certify, in connection with each periodic report containing financial statements filed with the SEC under Section 13(a) or 15(d) of the Exchange Act, that:
(i) the periodic report fully complies with the requirements of Section 13(a) or 15(d) of the Exchange Act; and
(ii) the information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.
Critically, unlike the Section 302 certifications, Section 906 certifications carry criminal penalties. Any person who certifies any statement set forth in the certification knowing that the periodic report does not comport with all the requirements of the certification is subject to a fine of not more than $1,000,000 or imprisonment of not more than 10 years, or both. Any person who willfully certifies any statement set forth in the certification knowing that the periodic report does not comport with all the requirements of the certification is subject to a fine of not more than $5,000,000 or imprisonment of not more than 20 years, or both.
B. Timing
Section 906 certifications are required beginning with the first Form 20-F filed after listing — that is, the Form 20-F for the fiscal year ending December 31, 2026 (due by April 30, 2027). The Section 906 certifications are furnished (not filed) with the Form 20-F as an exhibit (typically Exhibit 13.1 and 13.2). The distinction between "furnishing" and "filing" has implications for potential liability under Section 18 of the Exchange Act (which applies to "filed" documents) but does not affect the criminal liability provisions of Section 906 itself.
C. Practical Steps
Given the serious criminal penalties associated with Section 906 certifications, the following steps should be taken:
1. Briefing of Certifying Officers. Dr. Friedrich Wendt and Katarina Dalmqvist must be thoroughly briefed on the personal criminal liability associated with Section 906 certifications. This briefing should cover the scope of the certification, the distinction between "knowing" and "willful" violations, the applicable penalties, and the practical steps that the certifying officers should take to satisfy themselves of the accuracy of the certification before signing. We recommend that Vivienne St. Claire of Calderwood & Harkness conduct this briefing in person (or by videoconference) well in advance of the first Form 20-F filing.
2. Coordination with German Counsel. Because Dr. Wendt and Ms. Dalmqvist are residents of Germany and execute their duties primarily from Halcyon's headquarters in Munich, there are cross-border legal considerations associated with German-resident officers executing certifications that carry criminal penalties under U.S. law. Calderwood & Harkness and Bähr Stein Rechtsanwälte (Dr. Christoph Maurelban) should coordinate to advise Halcyon management on the implications under both U.S. and German law, including any potential dual-jurisdiction liability issues, extradition considerations (which, while unlikely to arise in practice, should be understood by the certifying officers), and the interaction with German corporate liability principles.
3. Template Certifications. Calderwood & Harkness will prepare template Section 906 certifications in the form required by 18 U.S.C. § 1350 for attachment as exhibits to the Form 20-F. As noted, these certifications are furnished rather than filed.
4. Coordination with Sub-Certification Process. The sub-certification and disclosure committee processes described in Section III.C above will also support the certifying officers' ability to execute the Section 906 certifications with confidence. The sub-certification process provides the certifying officers with a documented chain of representations from subsidiary officers confirming the accuracy and completeness of the financial and operational information underlying the Form 20-F.
VI. Audit Committee Requirements
A. Exchange Act Rule 10A-3 — Independence Requirements
Exchange Act Rule 10A-3 requires each listed issuer, including FPIs, to have an audit committee composed entirely of independent members of the issuer's board of directors (or, in the case of an FPI with a two-tier board structure such as Halcyon's, the supervisory board or equivalent body). This requirement is an SEC rule, not a Nasdaq listing standard, and accordingly it is not subject to the FPI exemption from Nasdaq corporate governance rules under Nasdaq Rule 5615(a)(3).
Under Rule 10A-3, a member of the audit committee is considered "independent" if the member, other than in his or her capacity as a member of the audit committee, the board of directors, or any other board committee:
(i) does not accept directly or indirectly any consulting, advisory, or other compensatory fee from the issuer or any subsidiary thereof, other than fixed amounts of compensation under a regular compensation arrangement for service as a director; and
(ii) is not an "affiliated person" of the issuer or any subsidiary thereof.
The term "affiliated person" is defined by reference to Exchange Act Rule 10A-3(e)(1) and generally includes controlling shareholders and executive officers. However, Rule 10A-3 provides a specific exemption for FPIs under Rule 10A-3(c)(3), which permits certain modifications to the independence requirements to accommodate home-country governance structures, provided that the modifications do not materially adversely affect the ability of the audit committee to act independently and to satisfy the other requirements of Rule 10A-3.
B. FPI Phase-In
FPIs listing on a U.S. national securities exchange for the first time receive a phase-in period for achieving full audit committee independence under Rule 10A-3:
• At the time of listing: At least one member of the audit committee must be independent.
• Within 90 days of listing effectiveness: A majority of the members of the audit committee must be independent.
• Within one year of listing effectiveness: All members of the audit committee must be independent (i.e., full compliance).
For Halcyon, applying this phase-in to the target listing effectiveness date of June 22, 2026:
• By June 22, 2026: At least one independent audit committee member
• By approximately September 20, 2026: Majority of audit committee members must be independent
• By approximately July 2027: All audit committee members must be independent
C. Halcyon Considerations
Halcyon operates under the German two-tier board structure (zweistufiges Verwaltungssystem), consisting of a Management Board (Vorstand) and a Supervisory Board (Aufsichtsrat). The Supervisory Board is chaired by Prof. Dr. Anneliese Voss, who has served as an independent director since 2018. Under the German Stock Corporation Act (Aktiengesetz or "AktG"), the Supervisory Board is responsible for, among other things, the appointment and oversight of the Management Board, the approval of the annual financial statements, and the selection of the independent auditor.
We recommend the following approach to satisfy Rule 10A-3:
Establishment of an Audit Committee. Halcyon should establish an audit committee (Prüfungsausschuss) as a committee of the Supervisory Board. Under Section 107(3) of the AktG, the Supervisory Board may delegate certain of its responsibilities to committees, and the establishment of an audit committee is common practice for German public companies. The audit committee should consist of at least three members of the Supervisory Board.
Independence Assessment. Halcyon should promptly conduct an assessment of each current Supervisory Board member's independence under the Rule 10A-3 criteria. We recommend identifying at least three members who satisfy the Rule 10A-3 independence criteria by the listing date. To the extent that fewer than three current Supervisory Board members satisfy the independence criteria, Halcyon should consider appointing additional independent members to the Supervisory Board in advance of the listing.
Audit Committee Financial Expert. At least one member of the audit committee must qualify as an "audit committee financial expert" within the meaning of Item 16A of Form 20-F. An audit committee financial expert is defined as a person who has the following attributes: (a) an understanding of generally accepted accounting principles and financial statements; (b) the ability to assess the general application of such principles in connection with the accounting for estimates, accruals, and reserves; (c) experience preparing, auditing, analyzing, or evaluating financial statements that present a breadth and level of complexity of accounting issues that are generally comparable to those raised by the issuer's financial statements, or experience actively supervising one or more persons engaged in such activities; (d) an understanding of internal controls and procedures for financial reporting; and (e) an understanding of audit committee functions. The Form 20-F must disclose the identity of the audit committee financial expert or, if no such expert has been identified, the reasons why not.
Nasdaq Requirements. Nasdaq Rule 5605(c) imposes additional audit committee requirements, including the requirement that the audit committee have at least three members, each of whom must meet certain financial literacy standards, and at least one of whom must have financial sophistication. These Nasdaq-specific requirements are subject to the FPI exemption under Nasdaq Rule 5615(a)(3) with respect to certain aspects, but not with respect to the SEC requirements under Rule 10A-3. As noted, the Rule 10A-3 independence requirements are SEC requirements and are not subject to the FPI governance exemption. The interplay between Nasdaq audit committee requirements, the FPI governance exemption, and SEC Rule 10A-3 is complex and will be addressed more fully in the companion memorandum on Nasdaq corporate governance compliance.
Audit Committee Charter. A separate US-compliant Audit Committee Charter is currently being prepared by Calderwood & Harkness for review and adoption by the Supervisory Board prior to the listing date. The charter will set forth the committee's composition, responsibilities, authority, and procedures in accordance with Rule 10A-3 and Nasdaq Rule 5605(c).
D. Audit Committee Responsibilities Under SOX
Under the Sarbanes-Oxley Act and Exchange Act Rule 10A-3, the audit committee has the following key responsibilities:
• Auditor Oversight: The audit committee is directly responsible for the appointment, compensation, retention, and oversight of the work of the independent auditor (Blackmere & Whitfield). The auditor reports directly to the audit committee.