People stand outside a Silicon Valley Bank branch in Santa Clara, Calif., March 10. The Federal Reserve released a highly-anticipated review of its supervision of Silicon Valley Bank, the go-to bank for venture capital firms and technology start-ups that failed spectacularly in March. AP Photo/Jeff Chiu, File

Normally, the words exchanged between bank and regulator don’t leave the room.

Bank examiners are bound by strict confidentiality requirements that can land them with fines or even jail time if they are breached. Nor can banks themselves reveal confidential supervisory information, because even though they are party to it, the material is deemed the property of the Federal Reserve. And good luck trying to lodge a Freedom of Information request. Exemption 8 of the Freedom of Information Act explicitly exempts from public disclosure any information “contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions.”

When a bank fails, though, none of these protections apply and it all comes tumbling out. Last week, the Fed published a 118-page post-mortem of its relationship with Silicon Valley Bank and uploaded to its public website 25 previously confidential letters and reports its supervisors had sent to the bank. The Federal Deposit Insurance Corp. published a more slimmed-down version of its dealings with Signature Bank.

One thing they reveal is how haphazardly these institutions were run compared with the super-professional show they put on for investors.

Take technology. You’d have thought Silicon Valley Bank — a tech bank focused principally on the tech sector — would have had good tech. Not so. In a May 2021 letter to the board, the Federal Reserve Bank of San Francisco jointly with the California Department of Financial Protection and Innovation observed that “SVB’s overall IT function is less-than-satisfactory.” The letter lists multiple areas where the group’s information technology is lacking. “The IT function continues to deteriorate and is now a supervisory concern,” it concludes.

Or take risk management — a core competence for any bank.

“When you think about the growth I talked about a few minutes ago,” Silicon Valley Bank Chief Executive Officer Greg Becker told shareholders at a presentation in 2018, “growing 400%, 500% in seven years, you have to make sure that your risk management systems and structures are as robust as possible.”

Yet, according to the Fed, they weren’t. Three years after that statement, Fed supervisors found that SVB parent Silicon Valley Bank Financial Group’s “risk-management practices had not kept pace with its growth.” We know now that the chief risk officer left the bank in April 2022. What the supervisory communications reveal is that she was fired in February 2022 because “she did not have the experience necessary for a large financial institution.”

Neither of these issues was enough to shut the bank down or issue urgent corrective action, but they would have been enough to give shareholders a fright. Management was informed of “foundational shortcomings” in risk management the day before the stock hit its all-time high.

In some cases, shareholders were purposefully kept in the dark. In November, the board discussed a couple of strategies to reorient the bank’s securities portfolio away from the long-duration assets that were instrumental in its downfall, a plan it dubbed “Project Phoenix.” One of the strategies was to sell up to $20 billion of securities at a loss of $2 billion. But the actions were shelved in part because “investor reaction is expected to be very negative.” The stock was off its high by then, but buying it at a premium to tangible book value, investors remained blissfully unaware of the problems racking the bank’s executives.

Evidence also emerges about how flaky management was when it came to modeling its business. The Fed now discloses that “SVBFG had breached its long-term interest rate risk limits on and off since 2017.” In response, “in April 2022, SVBFG made counterintuitive modeling assumptions about the duration of deposits to address the limit breach rather than managing the actual risk.”

“Changing model assumptions, rather than improving the actual liquidity position, is not an appropriate way to restore compliance with limits,” the authors of the SVB postmortem usefully remind us.

The thing is, Silicon Valley Bank may not be alone here — in the way it recalibrates models, suppresses problems, exaggerates its competences. No doubt similar tales of woe will emerge from First Republic Bank when its supervisory materials are declassified, as they have when inquiries have been published after wounding — albeit non-mortal — issues at Wells Fargo, Credit Suisse, JPMorgan Chase and more.

But these are the banks that got caught. What the investigations reveal is that there are many more problems bubbling beneath the surface of a bank than meets the eye. “While SVBFG failed because of a particular constellation of factors, that is only one realization of many potential outcomes across supervised firms and over time,” said the Fed. Most of the time, banks fend off outright failure, but that doesn’t mean they’re not subject to problems that would shock shareholders if they knew.

Bank investors would do well to read postmortem reports. They won’t reveal the next lender to fail, but they provide useful insights into the goings-on inside a bank. As an antidote to the glitzy investor relations materials companies provide, they are an important reminder of what you don’t know.

Marc Rubinstein is a former hedge fund manager. He is author of the weekly finance newsletter Net Interest.