SEC to Focus on Commercial Real Estate Exposure and Artificial Intelligence for Banks

On June 24, 2024, Eric Gerding, Director of the Division of Corporation Finance (the Division) of the U.S. Securities and Exchange Commission (SEC), published a statement regarding certain areas of focus within the Division’s Disclosure Review Program. While Director Gerding discussed areas applicable to all industries, his statement put banking registrants on alert regarding disclosures of risks related to their commercial real estate (CRE) exposure and the use of artificial intelligence (AI). This Advisory reviews Director Gerding’s statements regarding such disclosures by banking registrants and offers key takeaways for banking registrants to consider in response.

Banks’ CRE and AI Disclosures

Disclosures for CRE Exposure

Director Gerding set the table — banks with significant CRE exposure are subject to several risks, and as a result, the Division has been considering how banks are disclosing their loan portfolio characteristics and the disaggregation thereof, risk concentrations, loan-to-value ratios, loan modifications, nonaccrual loan policies, policies around timing, frequency and sources of appraisals, and risk management.

To this end, the Office of the Comptroller of the Currency (OCC) also observed in its Spring 2024 Semiannual Risk Perspective that some sectors of CRE continue to experience stress due to increased expenses and a limited ability to increase rents to offset rising costs. The OCC added that elevated interest rates could adversely affect borrower cash flow, and that while inflationary pressures are subsiding, many economists predict that interest rates will remain elevated over the next two years. While CRE loan growth slowed, the OCC noted that concentrations in CRE exposure continue to present heightened risk.¹

The Federal Deposit Insurance Corporation (FDIC) also observed in its updated advisory Managing Commercial Real Estate Concentrations in a Challenging Economic Environment (published in December 2023) that the CRE market and lending conditions have been significantly influenced by governmental and societal responses to the COVID-19 pandemic, interest rates, and the prolonged inverted yield curve — including that investment property capitalization rates have not kept pace with the increases in long-term interest rates. The FDIC also noted higher CRE vacancy rates across both office and multi-family sectors and acknowledged the challenges of refinancing office and multi-family loans in an environment of pressured rent growth, higher interest rates, and lower property values.² Further, the Board of Governors of the Federal Reserve System also took note of the increased risks to CRE exposure, issuing a Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts to update and supersede supervisory guidance to assist financial institutions’ efforts to modify CRE loans.³

Investors and analysts have honed in on CRE risks in the first half of 2024, during which time higher interest rates and hybrid working trends, in part, negatively affected many banks’ first quarter earnings results. In addition to disproportionate increases in nonperforming loans, charge-offs, and provisions for credit losses in connection with CRE loans, some banks are also decreasing their CRE exposure altogether.⁴ Further, according to Fitch Ratings, smaller banks (i.e., less than US$100 billion in assets) are more likely to be negatively affected by CRE exposure because CRE loans are more likely to be a concentration of risk compared to larger banks.⁵

Accordingly, Director Gerding stated that banks should consider areas of disclosure where they can provide more granular information to improve investors’ understanding of the material risks inherent in their CRE or other loan portfolios and any mitigating steps taken to address such risks.

Disclosure of AI

Director Gerding observed that as companies incorporate AI into their business operations, their exposure to operational and regulatory risks increases, which may require disclosure under the SEC’s existing disclosure rules as to how they use AI and the risks related to such use.

While Director Gerding did not specifically mention banks when discussing AI, U.S. banks are increasingly turning to AI to increase operational efficiency, enhance products and services, and improve overall customer experience. As the OCC observed in its Fall 2023 Semiannual Risk Perspective, examples of how banks use AI include customer chatbots, fraud detection, and credit scoring. However, there is currently no AI-specific legislation for banks that expressly protects consumers from AI risks or automated decision-making (ADM) systems, adding complexity to the regulatory environment for banks which multiple agencies already govern. Supervisory agencies and banks are still working through potential issues and risks related to AI and ADM, but issues to date have included potential discrimination in automated underwriting processes, reduced availability and accuracy of information for consumers, and inadequately managing risk for AI tools developed or implemented by third parties.⁶ The OCC has specifically identified the lack of explainability, reliance on large volumes of data, potential bias, privacy concerns, third-party risk, cybersecurity risk, consumer protection concerns, and inaccurate responses from the use of generative AI as relevant AI risks for banks.⁷ In addition, the SEC will scrutinize statements made by banks in how they are deploying AI and the associated risks, especially banks with a broker-dealer or investment adviser arm. Any potential materially misleading statements or omissions may come under scrutiny by the SEC’s Division of Enforcement, as discussed in our March 2024 Advisory.

Director Gerding stated that the Division will consider how companies describe the opportunities and risks associated with AI; tailor disclosures about material AI risks and their impact on business and financial results; focus on the specific current or proposed uses of AI; and determine whether there is a reasonable basis for disclosures made.

Key Takeaways

Director Gerding’s recent statement regarding areas of focus for the Division put banking registrants on notice as to which disclosures the Division expects in the near-term, particularly with respect to CRE exposure and the use of AI. Accordingly, banking entities should consider the following measures as early as the current quarterly reporting cycle:

• Examine the completeness of disclosures made of risks related to CRE exposure.
• Assess whether the current level of disclosure related to CRE exposure is sufficient for investors’ understanding of the material risks.
• Compare the role of AI in business operations to prior disclosures (if any), and determine whether such disclosures are appropriately tailored, including as to the bank’s performance.
• Evaluate legal and corporate governance risks of AI used considering the current regulatory environment and consider whether such risks are appropriately described.
• Consider where AI use should be described (e.g., board oversight, risk factors, management’s discussion and analysis, and accompanying financial statements) and confirm that such description is tailored to the bank and accurate.
• Ensure disclosure controls take into account AI discussions, whether in an annual report or other public documents, on a website, on earnings calls, or in statements or speeches by bank executives. The SEC has brought standalone cases based solely on the lack of disclosure controls.
• Begin internal discussions about changes to disclosures for the upcoming annual reporting season and in accordance with relevant disclosure controls and procedures.

Members of Arnold & Porter’s Financial Services and Capital Markets Transactions teams continue to monitor the latest developments and best practices. For more information, please contact any author of this Advisory or your regular Arnold & Porter contact.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.