GAO flags disclosure gaps exposed by 2023 bank failures

• Key insight: The Government Accountability Office found that gaps in the oversight of bank disclosures may have left investors with an incomplete picture of risks at First Republic and Signature Bank before their 2023 failures.
• What's at stake: The watchdog said Congress should reconsider which agencies review disclosures from publicly traded banks without holding companies, while urging the Securities and Exchange Commission to provide additional guidance on risk-limit breaches.
• Forward look: The SEC disagreed with the GAO's recommendations. 

WASHINGTON — Two of the three banks that failed in the spring of 2023 were subject to a weaker system of investor-disclosure oversight than most publicly traded companies, a new government report found. 

The Government Accountability Office found that banks without a holding company, including First Republic Bank and Signature Bank, are subject to different disclosure requirements than public companies reviewed by the Securities and Exchange Commission, and investors in those banks might have less information available for assessing risk. In the case of First Republic Bank and Signature Bank, their failure cost investors $29 billion between the end of 2022 and May 2023. 

The SEC reviews public companies' disclosures about a variety of risks that might affect how investors view a company and make decisions about it. There are, however, 11 public banks, including two with more than $80 billion in assets, that aren't subject to these kinds of investor-focused qualitative assessments because they operate without a bank holding company. 

Congress has given this responsibility, instead of to the SEC, to bank regulators, but the GAO found that bank regulators don't evaluate these disclosures for investors' benefit. 

"Reassessing disclosure review authority could help Congress determine whether changes are needed to strengthen investor protection," the GAO said in the report. 

In the case of Signature and First Republic, the GAO found that the banks did not disclose when thresholds for interest rate or liquidity risk were breached, nor how they addressed the breaches. 

"SEC also identified other banks whose disclosures on these risk topics could be improved," the GAO said. "However, SEC staff have not provided public guidance on how companies could assess whether breaches of interest rate or liquidity risk tolerances are material to investors. Such guidance could help companies assess the materiality of these details and may provide investors with the information they need to make informed decisions." 

The GAO said that the SEC should provide informal staff guidance on how companies should assess whether interest rate risk and liquidity risk tolerance levels are material information for investors, particularly when interest rates are rising. 

The SEC disagreed with the recommendation in a letter to the GAO, arguing that internal risk-tolerance metrics can vary widely across institutions. The GAO said that the office didn't ask for uniformity in the guidance for companies. 

"We agree that bank holding companies' internal risk-tolerance metrics are management tools that can vary across institutions," the GAO said. "Our recommendation, however, does not intend for SEC to create a uniform disclosure standard. In our report, we provide examples of SEC staff's feedback to certain bank holding companies about potential disclosure improvements related to managing interest rate and liquidity risks."