On September 3, GAO released a report finding that 11 publicly traded banks — including two with more than $80 billion in assets — are not subject to the SEC’s disclosure review process because they operate without a bank holding company. The SEC is required to review public companies’ annual disclosures, but the FDIC, the Fed and the OCC have certain of the SEC’s functions and duties for banks without holding companies. GAO found that banking regulators’ reviews do not require staff to qualitatively assess whether disclosures contain sufficient information for investors, unlike the SEC’s process. The report noted that two of the three banks that failed in spring 2023 operated without holding companies, losing shareholders more than $29 billion. GAO referenced previous recommendations that Congress consider whether changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap, and recommended that Congress reassess the authority for reviewing annual financial disclosures of public banks without holding companies for investor protection purposes.

GAO also found that the three banks that failed in spring 2023 each exceeded internal interest rate or liquidity risk tolerances but did not disclose those breaches or management’s response in their annual filings. While GAO recommended that the SEC provide informal staff guidance on how companies should assess materiality of breaches of interest rate and liquidity risk tolerance levels, the SEC disagreed, stating that internal risk-tolerance metrics are management tools that vary significantly across institutions and are not appropriate bases for uniform disclosure standards.