The Disclosure Gap That Outlived Two Bank Failures

Three years after two U.S. banks collapsed within days of each other in spring 2023, the regulatory gap that let both operate outside the Securities and Exchange Commission’s disclosure review is still open. A Government Accountability Office report published September 3 finds eleven public banks, including two with more than $80 billion in assets, remain outside SEC review for one structural reason: none of them has a bank holding company sitting above it.

A Gap in the Wiring, Not a Single Bank’s Mistake

Most public banks in the United States disclose to investors through a parent holding company, and that parent falls squarely under SEC review. A smaller group of banks skips that layer entirely and is instead publicly traded at the bank level itself. For those banks, Congress handed the disclosure-oversight job to banking regulators such as the Federal Reserve, the FDIC, and the Office of the Comptroller of the Currency, not to the SEC.

That handoff might be a footnote if it were purely organizational. GAO’s report treats it as a live investor-protection question because banking regulators, unlike the SEC, do not review disclosures with investors’ interests as the stated goal. Their exams are built around safety and soundness of the institution, not around whether a shareholder has enough information to price the stock.

Why This Surfaced Through the Audit, Not the Failure Itself

GAO did not set out to relitigate the 2023 failures. The report’s actual assignment was broader: examine the auditing standards that apply to bank audits, how audit quality gets overseen, and how SEC and banking regulators each review the annual disclosures public companies file. That mandate exists because three of the thirty largest U.S. banks failed in spring 2023 shortly after their financial statement audits were completed, which raised an obvious question: did the auditors miss something, or did the banks simply not disclose it.

To answer that, GAO reviewed the Public Company Accounting Oversight Board’s auditing standards, walked through SEC and banking regulators’ disclosure review processes, read the SEC’s own public comment letters to bank holding companies, and interviewed staff at the SEC, the banking regulators, PCAOB, and accounting firms. PCAOB, created by Congress in 2002 specifically to police audit quality, told GAO that certain auditor responsibilities are particularly hard to execute in a bank audit: judging the reasonableness of a bank’s accounting estimates and assessing whether a bank can continue as a going concern are both harder calls to make for a balance sheet built on interest rate and liquidity exposures that can move fast. That difficulty is the backdrop against which the disclosure gap matters most, because if the audit itself struggles to catch a fast-moving risk, the disclosure investors read becomes the primary place that risk would show up.

What the Failed Banks Actually Told Investors

Signature Bank and First Republic Bank, two of the three large banks that failed in spring 2023, both operated without a holding company. Shareholders in the two banks lost more than $29 billion combined between the end of 2022 and May 2023. GAO went back and reviewed what the banks had told investors in their 2021 and 2022 disclosures about interest rate and liquidity risk, the two exposures regulators later said drove the failures.

The finding is specific: each bank described setting thresholds for interest rate or liquidity risk, but none disclosed when those thresholds were breached or how the bank responded once they were. A threshold that is never shown to have been crossed reads, to an investor, like a risk that never materialized. GAO’s review suggests the opposite was true inside at least some of these institutions before they failed.

The SEC Found the Same Pattern Elsewhere, and Still Won’t Say What to Do About It

GAO’s report notes that SEC staff have separately identified other banks, beyond the three that failed, whose disclosures on interest rate and liquidity risk could be clearer. Yet the SEC has not issued public guidance on how a company should decide whether a breached risk threshold counts as material information investors need to see, particularly in a period of rising rates like the one that preceded the 2023 failures.

GAO recommended the SEC provide informal staff guidance on exactly that materiality question, specifically on how a company should judge whether a breach of its own interest rate or liquidity risk tolerance is the kind of detail investors need to see, especially while rates are rising. The SEC disagreed with issuing that guidance. GAO’s other recommendation goes over the SEC’s head entirely: it asks Congress to reassess who should have disclosure review authority over public banks that operate without a holding company, since the current split leaves eleven banks reviewed by regulators who were never charged with an investor-protection mandate in the first place.

Neither recommendation forces anything to change on its own. A GAO report is an assessment, not a rule, and Congress has no deadline to act on a reassessment request. That leaves the gap exactly where it was before the report published: eleven banks, two of them with more than $80 billion in assets, disclosing to investors through a review process that was never built to ask whether investors have enough information.

What It Means for the Finance Leader

The immediate exposure sits with the eleven banks named in the report and their shareholders, but the pattern is bigger than eleven balance sheets. Bank charters have become a more contested asset this year, from fintechs racing regulators for national bank status to the FDIC quietly widening how much business cash a bank can insure. Each of those moves changes who sits inside the regulatory perimeter and under whose disclosure rules. A bank’s holding-company structure is rarely a headline item in a due-diligence memo, but GAO’s report is a reminder that it determines which regulator is actually reading the risk disclosures a counterparty, depositor, or investor is relying on.

For treasury and risk teams evaluating a banking relationship or a charter structure, the practical takeaway is to ask the structural question directly rather than assume SEC-grade disclosure review applies uniformly across every publicly traded bank. As this GAO report shows, for eleven of them right now, it does not.

Source: Government Accountability Office