Summary

  • As of December 2025, eleven publicly held US banks without holding companies had their annual disclosures reviewed by banking regulators, outside the SEC's ordinary review authority. GAO found those regulators' procedures do not require a qualitative reading for investors.
  • FDIC review files sampled by GAO recorded whether Form 10-K sections existed. They generally did not evaluate the financial statements or management's account of results. First Republic Bank and Signature Bank were among the sampled failures.
  • GAO separately found that three banks that failed in 2023 had exceeded at least one internal interest-rate or liquidity risk tolerance in 2021 or 2022 without disclosing the breach and management response in the relevant annual reports. Congress now has an authority question; SEC has a guidance question.

A complete form can carry an incomplete warning

Imagine reading a bank's annual report after its board's own risk alarm sounded. The report describes a system of limits and committees. It does not tell you that a limit was crossed or what directors did about it. The pages are present. The warning is absent. The Government Accountability Office's September 2026 report found that pattern in filings preceding the failures of First Republic Bank, Signature Bank and Silicon Valley Bank's holding company.

The larger finding concerns the official reader of those pages. Most publicly held companies enter the Securities and Exchange Commission's disclosure-review process. The SEC asks whether required statements, in context, could materially mislead investors and whether the filing tells them enough about the business. Eleven publicly held banks lacked holding companies as of 31 December 2025. For those banks, banking regulators sit in the SEC's statutory review position. GAO found that none of their review procedures required the same qualitative investor-protection reading.

Nine of the eleven were supervised by the Federal Deposit Insurance Corporation; the Office of the Comptroller of the Currency supervised two. The OCC pair each held roughly $87 billion to $89 billion in assets. This is a jurisdictional design, not a small-bank exemption. A bank's corporate wrapper determines who reads its public filing and what that reader must check.

The spreadsheet that counted sections

GAO examined FDIC documentation for three currently supervised public banks and for First Republic and Signature, which failed in 2023. The review sheets listed designated Form 10-K sections and marked whether they appeared. Generally they contained no evaluation of the financial statements or management discussion. One OCC review file for a fiscal 2024 annual report likewise documented required information without a qualitative assessment. Federal Reserve procedures revised in February 2025 concentrated on submission and missing items, rather than whether investors received sufficient information.

Checking that a disclosure exists has a real administrative use. It is also a remarkably literal interpretation of a review duty when the product being reviewed is a public account of risk. A bank can supply a heading called liquidity, satisfy a presence check and leave the economically important comparison between its stated risk limit and its actual position to an investor who cannot see the internal file.

The SEC's own process offers a sharper standard without promising omniscience. Its Corporation Finance staff review required elements and consider materiality in the company's circumstances. Management remains responsible for the truth and completeness of its filing. SEC review cannot certify either. But an instruction to ask whether investors could be misled is a different task from a spreadsheet cell confirming that a section is attached. GAO's finding is about that missing instruction.

The bank's alarm and the investor's silence

GAO read the 2021 and 2022 annual reports of First Republic, Signature and SVB Financial Group alongside examination records. Each described risk-management processes and each exceeded an internal interest-rate or liquidity tolerance in at least one area during those years. None disclosed the breach or the management response in the relevant annual reports.

At First Republic, internal economic-value-of-equity projections breached risk limits under several rising-rate scenarios in the second quarter of 2022. A board committee and the full board discussed the breaches; the board agreed to take no action. Its annual reports presented net-interest-income simulations but omitted those equity-value model results and the breach. At Signature, liquid-asset tolerances were breached from late 2020 into the third quarter of 2021. Management raised the thresholds that December; examiners found its rationale unclear. The March 2022 annual filing recycled language about liquidity policies from the prior year.

Silicon Valley Bank's examiners found equity-value tolerance breaches in 2020, 2021 and 2022; the holding company's annual disclosures did not describe them.

An internal threshold is a management tool, not an automatic legal trigger for public disclosure. Its significance depends on the bank's business, the size and persistence of the breach, available remedies and market conditions. The governance problem is that the public report could describe the alarm system while hiding the moment it rang. Investors then have to infer board conduct from a page that has removed the decision itself.

Two questions, two owners

GAO asked Congress to reconsider who should review annual disclosures of public banks without holding companies for investor protection. Congress assigned that authority; Congress can change its distribution or demand an investor-focused procedure from the current holders. GAO also asked SEC staff for public, informal guidance on how companies should assess whether breaches of interest-rate and liquidity tolerances are material, especially when rates rise.

SEC opposed the guidance recommendation. It argued that internal metrics differ among banks and do not suit a uniform disclosure standard. GAO's request was narrower: guidance for a case-specific decision, rather than a rule that every breach is material. SEC has already asked some bank holding companies after 2023 to say more about board-approved limits, model outcomes and departures from risk tolerances. Those comment letters show the question can be asked. They also arrive after investors have read the first filing, and SEC does not review every company every year.

First Republic and Signature's shareholders lost more than $29 billion in investment value between the end of 2022 and May 2023, GAO reported. The disclosure-review arrangement alone does not explain the bank failures. The documented defect stands on its own: eleven public banks had a regulator assigned to look at annual filings, but no procedure requiring that regulator to ask the investor's question. The word review did more work in the public imagination than the review file did on paper.

Sources