Three of the 30 largest U.S. banks failed in spring 2023. The GAO reviewed 2021 and 2022 disclosures for the three banks that failed in spring 2023. The agency analyzed the information the three failed banks provided about interest rate and liquidity risks. The GAO and banking regulators previously found that weak management of interest rate and liquidity risks contributed to the banks' failures.

Each of the three failed banks described setting thresholds for interest rate or liquidity risk. The three failed banks did not disclose how they addressed breaches of interest rate or liquidity risk thresholds. The three bank failures in spring 2023 occurred shortly after their financial statement audits were completed.

Eleven public banks are not subject to SEC review because they operate without a bank holding company. Two of the 11 public banks not subject to SEC review hold more than $80 billion in assets. Congress charged banking regulators with certain functions and duties of the SEC for banks that operate without a holding company. The GAO found that banking regulators' review processes do not assess disclosures for investors' benefit. Instead, the primary focus of banking regulators' disclosure reviews is on safety and soundness, not investor protection. This contrasts with the SEC's approach, which is explicitly designed to protect investors by ensuring that disclosures are clear, complete, and useful for investment decision-making.

The GAO found that the SEC's review processes assess disclosures for investors' benefit. The Securities and Exchange Commission is required by law to review public companies' disclosures. The SEC identified other banks whose disclosures on interest rate and liquidity risk topics could be improved. Congress and the SEC require public companies to disclose information that investors would find important when making investment decisions. The GAO noted that while the SEC has issued comment letters to bank holding companies to improve risk disclosures, no such mechanism exists for banks regulated solely by banking agencies.

The Securities Exchange Act of 1934 and federal regulations require public companies to provide investors with periodic disclosures about business risks and financial results. Required public company disclosures include an annual audited financial statement and a description of risk factors and financial performance. Accounting firms that audit public companies must register with the Public Company Accounting Oversight Board. Congress created the Public Company Accounting Oversight Board in 2002 to focus on audit quality. The PCAOB sets auditing standards and conducts inspections to ensure compliance, particularly for firms auditing public companies.

The GAO was asked to review oversight of bank financial disclosures and external audits. The agency reviewed PCAOB auditing standards. The GAO reviewed SEC and banking regulators' disclosure review processes. It also examined how banking regulators coordinate with the SEC and PCAOB in overseeing audit quality and financial reporting for banks that are not part of a holding company structure.

The GAO reviewed SEC public comments to bank holding companies. The GAO interviewed staff from the SEC, banking regulators, PCAOB, and accounting firms. These interviews revealed that while banking regulators engage in some review of financial disclosures, their processes lack standardized criteria for evaluating the usefulness of risk disclosures to investors. The GAO concluded that this creates a gap in investor protection for shareholders of banks outside the SEC’s jurisdiction.

Timeline

The Securities and Exchange Commission published proposed rule titled "Regulation Crypto Assets" on August 21, 2026. The Government Accountability Office issued the report "Bank Financial Disclosures: Actions Needed to Improve Oversight of Information Provided to Investors" on September 3, 2026.

Why It Matters

The $29 billion in shareholder losses linked to two failed banks reflects the financial stakes associated with disclosure oversight. The GAO's findings that failed banks did not disclose breaches of risk thresholds or how they addressed them point to specific informational deficits for investors. By identifying these gaps, the report provides a basis for Congress and regulators to consider changes to how financial information is monitored for banks outside the standard holding-company structure.