I study the design of regulation using banks’ internal risk models. Specifically, I explore the optimal combination of capital requirements and penalties to ensure truthful reporting. I first characterize optimal regulatory capital and penalties when banks have private information about their risk. I find that penalties in practice could be rationalized provided sufficient variation in banks' risk preferences. I then use hand-collected data on risk model revisions to show that actual penalties provide only weak incentives for model improvements and fail to deter misreporting. In addition, my model suggests that recent changes in regulation may further impair truthful disclosure.