I agree with the others:

Revocation or denial - any time. Arguably the 6-month "stale complaint" deadline comes into play (FAA needs to start a certificate action within 6 months of a violation) but that only starts when the FAA finds out about the violation.

Criminal prosecution - It comes under the general "false statements to the government" statute - 18 U.S.C. §1001. It's not used that often - usually reserved for things the FAA thinks a serious enough to send it to the US Attorney rather than keep in-house.

Coming clean - talk to a lawyer before you talk to the government, but generally, the FAA learning about it from the airman (or the airman's legal representative) is better than the FAA learning about it from somewhere else.