(a) A Board-regulated institution described in §217.61 must provide timely public disclosures each calendar quarter of the information in the applicable tables in §217.63. If a significant change occurs, such that the most recent reported amounts are no longer reflective of the Board-regulated institution's capital adequacy and risk profile, then a brief discussion of this change and its likely impact must be disclosed as soon as practicable thereafter. Qualitative disclosures that typically do not change each quarter (for example, a general summary of the Board-regulated institution's risk management objectives and policies, reporting system, and definitions) may be disclosed annually after the end of the fourth calendar quarter, provided that any significant changes are disclosed in the interim. The Board-regulated institution's management may provide all of the disclosures required by §§217.61 through 217.63 in one place on the Board-regulated institution's public Web site or may provide the disclosures in more than one public financial report or other regulatory reports, provided that the Board-regulated institution publicly provides a summary table specifically indicating the location(s) of all such disclosures.

(b) A Board-regulated institution described in §217.61 must have a formal disclosure policy approved by the board of directors that addresses its approach for determining the disclosures it makes. The policy must address the associated internal controls and disclosure controls and procedures. The board of directors and senior management are responsible for establishing and maintaining an effective internal control structure over financial reporting, including the disclosures required by this subpart, and must ensure that appropriate review of the disclosures takes place. One or more senior officers of the Board-regulated institution must attest that the disclosures meet the requirements of this subpart.

(c) If a Board-regulated institution described in §217.61 concludes that specific commercial or financial information that it would otherwise be required to disclose under this section would be exempt from disclosure by the Board under the Freedom of Information Act (5 U.S.C. 552), then the Board-regulated institution is not required to disclose that specific information pursuant to this section, but must disclose more general information about the subject matter of the requirement, together with the fact that, and the reason why, the specific items of information have not been disclosed.