(a) An FDIC-supervised institution described in § 324.61 must provide timely public disclosures each calendar quarter of the information in the applicable tables in § 324.63. If a significant change occurs, such that the most recent reported amounts are no longer reflective of the FDIC-supervised institution's capital adequacy and risk profile, then a brief discussion of this change and its likely impact must be disclosed as soon as practicable thereafter. Qualitative disclosures that typically do not change each quarter (for example, a general summary of the FDIC-supervised institution's risk management objectives and policies, reporting system, and definitions) may be disclosed annually after the end of the fourth calendar quarter, provided that any significant changes are disclosed in the interim. The FDIC-supervised institution's management may provide all of the disclosures required by §§ 324.61 through 324.63 in one place on the FDIC-supervised institution's public Web site or may provide the disclosures in more than one public financial report or other regulatory reports, provided that the FDIC-supervised institution publicly provides a summary table specifically indicating the location(s) of all such disclosures.

(b) An FDIC-supervised institution described in § 324.61 must have a formal disclosure policy approved by the board of directors that addresses its approach for determining the disclosures it makes. The policy must address the associated internal controls and disclosure controls and procedures. The board of directors and senior management are responsible for establishing and maintaining an effective internal control structure over financial reporting, including the disclosures required by this subpart, and must ensure that appropriate review of the disclosures takes place. One or more senior officers of the FDIC-supervised institution must attest that the disclosures meet the requirements of this subpart.

(c) If an FDIC-supervised institution described in § 324.61 concludes that specific commercial or financial information that it would otherwise be required to disclose under this section would be exempt from disclosure by the FDIC under the Freedom of Information Act (5 U.S.C. 552), then the FDIC-supervised institution is not required to disclose that specific information pursuant to this section, but must disclose more general information about the subject matter of the requirement, together with the fact that, and the reason why, the specific items of information have not been disclosed.