Notice2026-17995
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 3, 2026
Effective
October 5, 2026
Issuing agencies
Small Business Administration
Abstract
In accordance with the Privacy Act of 1974, as amended, the U.S. Small Business Administration (SBA, "the Agency") is modifying the system of records for the Disaster Loans Case Files, SBA 20 to add a new routine use that allows information in each system to be disclosed to the Department of the Treasury for purposes of identifying, preventing, or recouping improper payments through Treasury's Do Not Pay Working System. Additional changes are proposed to reflect technical updates to the system. This system of records is used to maintain information on applicants, borrowers, principals, guarantors, and recipients of disaster home and business loans, advances, and grants.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 170 (Thursday, September 3, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 170 (Thursday, September 3, 2026)]
[Notices]
[Pages 56700-56703]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-17995]
=======================================================================
-----------------------------------------------------------------------
SMALL BUSINESS ADMINISTRATION
Privacy Act of 1974; System of Records
AGENCY: U.S. Small Business Administration.
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, as amended, the
U.S. Small Business Administration (SBA, ``the Agency'') is modifying
the system of records for the Disaster Loans Case Files, SBA 20 to add
a new routine use that allows information in each system to be
disclosed to the Department of the Treasury for purposes of
identifying, preventing, or recouping improper payments through
Treasury's Do Not Pay Working System. Additional changes are proposed
to reflect technical updates to the system. This system of records is
used to maintain information on applicants, borrowers, principals,
guarantors, and recipients of disaster home and business loans,
advances, and grants.
DATES: This modified system will be effective upon publication. New or
modified routine uses will be effective October 5, 2026. Submit written
comments on or before October 5, 2026.
ADDRESSES: You may submit comment on this notice, identified by [DOCKET
NUMBER PUBLICATION BY THE FEDERAL REGISTER], by any of the following
methods.
Federal e-Rulemaking Portal: <a href="http://www.regulations.gov">http://www.regulations.gov</a>: Follow the
instructions for submitting comments.
Mail/Hand Delivery/Courier: Submit written comments to:
Arlene Embrey, Trial Attorney, Office of General Counsel, U.S.
Small Business Administration, 409 3rd Street SW, Washington, DC 20416.
FOR FURTHER INFORMATION CONTACT: Michael Post, Acting Chief Privacy
Officer, Office of the Chief Information Officer, U.S. Small Business
Administration, 409 3rd Street SW, Suite 4000, Washington, DC 20416, or
via email to <a href="/cdn-cgi/l/email-protection#b5e5c7dcc3d4d6ccfad3d3dcd6d0c7f5c6d7d49bd2dac3"><span class="__cf_email__" data-cfemail="95c5e7fce3f4f6ecdaf3f3fcf6f0e7d5e6f7f4bbf2fae3">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: On March 25, 2025, the President signed
Executive Order (E.O.) 14249, Protecting America's Bank Account Against
Fraud, Waste, and Abuse, which requires Executive Branch agencies to
``review and modify, as applicable, their relevant system of records
notices under the Privacy Act of 1974 to include a `routine use' that
allows for the disclosure of records to the Department of the Treasury
for the purposes of identifying, preventing, or recouping fraud and
[[Page 56701]]
improper payments, to the extent permissible by law.'' On August 20,
2025, OMB issued Memorandum M-25-32, Preventing Improper Payments and
Protecting Privacy Through Do Not Pay, which provides guidance to
agencies for implementing the new routine use requirement under E.O.
14249. The memorandum requires agencies to identify systems of records
that maintain information ``whose disclosure to Treasury would be
relevant and necessary for identifying, preventing, or recouping
improper payments by reviewing payment and award eligibility through
the Do Not Pay Working System'' and add a new routine use to each
identified system to allow such disclosure. See OMB M-25-32, Appendix
1. Accordingly, this notice hereby modifies SBA 20 system of records to
include the following new routine use prescribed by OMB:
``AA. To the U.S. Department of the Treasury when disclosure of the
information is relevant to review payment and award eligibility through
the Do Not Pay Working System for the purposes of identifying,
preventing, or recouping improper payments to an applicant for, or
recipient of, federal funds, including funds disbursed by a state
(meaning a state of the United States, the District of Columbia, a
territory or possession of the United States, or a federally recognized
Indian tribe) in a state-administered, federally funded program.''
In addition, SBA has removed routine use (T):
``To another agency or agent of a Government jurisdiction within or
under the control of the U.S., lawfully engaged in national security or
homeland defense when disclosure is undertaken for intelligence,
counterintelligence activities (as defined by 50 U.S.C. 3003(3)),
counterterrorism, homeland security, or related law enforcement
purposes, as authorized by U.S. law or Executive Order.''
Routine use (U) has been renumbered and now replaces routine use
(T).
SBA has made technical corrections to the following sections: ''
System Location'', ``System Manager'', ``Authority for Maintenance of
the System'', ``Purpose(s) of the System'', Categories of Individuals
Covered by the System'', Categories of Records in the System'',
``Record Source Categories'', ``Routine Uses of Records Maintained in
the System'', ``Policies and Practices for Storage of Records'',
``Policies and Practices for Retrieval of Records'', ``Policies and
Practices for Retention and Disposal of Records'', ``Administrative,
Technical and Physical Safeguards'', and ``History''.
SYSTEM NAME AND NUMBER:
Disaster Loans Case Files (SBA20).
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Headquarters. U.S. Small Business Administration, 409 3rd Street
SW, Washington, DC 20416.
SYSTEM MANAGER(S):
Associate Administrator, Office of Disaster, Recovery, and
Resilience. U.S. Small Business Administration, 409 3rd Street SW,
Washington, DC 20416, (800) 827-5722.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Small Business Act, Small Business Act Public Law, 85-536; Small
Business Advocate Act of 2012, H.R. 3851 (2011-2012); American Rescue
Plan, Public Law 117-12, March 11, 2021, 135 Stat. 4.
PURPOSE(S) OF THE SYSTEM:
SBA 20 collects information on individuals including pre-
application registrants, disaster home and business loan applicants,
loan advance applicants, grant applicants, recipients of loan advances,
grants, disaster home and business loans, and applicants' principals
and guarantors to determine eligibility for disaster loan funding.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Loan applicants and borrowers, principals and guarantors of
business applicants or borrowers, sole proprietors, grant applicants
and recipients, advance applicants and recipients, homeowners, and
renters.
CATEGORIES OF RECORDS IN THE SYSTEM:
Information relating to pre-application registrants, disaster home
and business loan applicants, loan advance applicants, grant
applicants, and recipients of loan advances, grants, disaster home and
business loans including: name; address; date of birth; Social Security
or tax identification number; telephone number; personal history
including education and employment history for individual borrowers,
sole proprietors, guarantors, or owners with a greater than 20%
interest; personal or business financial statements for individual
borrowers, sole proprietors, guarantors, or owners with a greater than
20% interest; bank information; credit information; insurance
information; FEMA registration number; application number; grant
number; correspondence to and from applicants; recommendations
regarding applicant eligibility; authorizations of disaster loan
advances, grants, disaster home and business loans; loan term and rate;
payment history; loan accounting information; collateral; Uniform
Commercial Code (UCC) filings and re-filings; field visit reports;
investigative reports; appraisers' reports; waivers of costs,
obligations, or requirements; and settlements and compromises.
RECORD SOURCE CATEGORIES:
Loan, advance, and grant individual applicants and/or principals or
guarantors of loan, advance, grant applicants; SBA employees; SBA
contractors; financial institutions; credit reporting agencies;
Treasury Department; Federal Emergency Management Agency (FEMA); and
local, state, federal, or Tribal law enforcement agencies.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, all or a portion of the information
contained in this system may be disclosed to authorized entities, as is
determined to be relevant and necessary, outside SBA as a routine use
pursuant to 5 U.S.C. 552a(b)(3) as follows:
<bullet> AA. To the U.S. Department of the Treasury when disclosure
of the information is relevant to review payment and award eligibility
through the Do Not Pay Working System for the purposes of identifying,
preventing, or recouping improper payments to an applicant for, or
recipient of, Federal funds, including funds disbursed by a state
(meaning a state of the United States, the District of Columbia, a
territory or possession of the United States, or a federally recognized
Indian tribe) in a state-administered, federally funded program.
<bullet> A. To the public on approved loans in order to inform the
public on how taxpayer dollars have been utilized when there is a
legitimate public interest in the disclosure of the information and the
disclosure would not constitute an unwarranted invasion of personal
privacy. This information includes recipient name and address, term and
rate of the loan, and the amount paid in full or charged off.
<bullet> B. To the public on approved loan advances and grants to
inform the public on how taxpayer dollars have been utilized when there
is a legitimate public interest in the disclosure of the information
and the disclosure would not constitute an unwarranted invasion of
personal privacy. This information
[[Page 56702]]
includes recipient name, address, period of performance and amount of
the loan advance or grant.
<bullet> C. To provide information to potential investors who are
interested in bidding on loans made available by the Agency in the sale
of assets. Investors will be required to execute a confidentiality
agreement prior to reviewing any record or information.
<bullet> D. To a federal, state, local, territorial, tribal, or
foreign law enforcement authority or other appropriate entity charged
with the responsibility for investigating or prosecuting such violation
or charged with enforcing or implementing a law where a record, either
alone or in conjunction with other information, indicates a violation
or potential violation of such law, whether criminal, civil, or
regulatory in nature.
<bullet> E. To request information from a Federal, State, or local
government agency or a private credit agency maintaining civil,
criminal, or other information relevant to determining an applicant's
suitability for a loan, loan advance, or grant.
<bullet> F. In response to a request from a State or Federal agency
in connection with the issuance of a grant, loan or other benefit by
that agency which is relevant to their decision on the matter.
<bullet> G. To the Department of Housing and Urban Development or
other Federal agency that participates in the Credit Alert Verification
Reporting System (CAIVRS) for publication by CAIVRS participants of
delinquent debt information of persons (including the names of
businesses and individuals) delinquent in paying a debt owed to or
guaranteed by the SBA (which includes persons who have caused a prior
loss under 13 CFR 120.110(q)) on a system to allow searches by
participating Government agencies and approved private lenders,
consistent with applicable law.
<bullet> H. To a consumer reporting agency in the event an
applicant or borrower has been the victim of identity theft in order to
assist such applicant or borrower in amending or correcting records
kept by SBA. This may include information gathered from Federal Trade
Commission's ID Theft Form 3515.
<bullet> I. To provide the Internal Revenue Service (IRS) with
access to an individual's records for an official audit to the extent
the information is relevant to the IRS's function.
<bullet> J. To a court, magistrate, grand jury, administrative
tribunal, or to opposing counsel during such administrative
proceedings, or in settlement negotiations concerning a claim or
dispute, when SBA determines that the disclosure is relevant and
necessary to the proceeding, claim, or dispute, and it involves: (1)
SBA or any component thereof; (2) any officer or employee of SBA acting
in his or her official capacity; or (3) the United States, when SBA
determines that the proceeding, claim, or dispute is likely to affect
SBA or any of its components.
<bullet> K. To a Congressional office from an individual's record
when that office is inquiring on the individual's behalf and at the
request of the individual.
<bullet> L. In a proceeding before a court, or adjudicative body,
or a dispute resolution body before which SBA is authorized to appear
or when any of the following is a party to litigation or has an
interest in such litigation, provided, however, that SBA determines
that the use of such records is relevant and necessary to the
litigation, and that, in each case, SBA determines that disclosure of
the records to a court, adjudicative body or a dispute resolution body
is a use of the information contained in the records that is a
compatible purpose for which the records were collected: SBA, or any
SBA component; any SBA employee in his or her official capacity; any
SBA employee in his or her individual capacity where DOJ has agreed to
represent the employee; or The United States Government, where SBA
determines that litigation is likely to affect SBA or any of its
components.
<bullet> M. To the U.S. Department of the Treasury to effect
issuance of loan, loan advance, or grants to borrowers or recipients of
SBA disaster funding.
<bullet> N. To the Federal Emergency Management Agency (FEMA) to
coordinate the issuance of federal disaster assistance to disaster
victims and monitor for duplication.
<bullet> O. To the Department of Justice (DOJ), including offices
of the U.S Attorneys, or other Federal agency conducting litigation or
in proceedings before any court, adjudicative, or administrative body,
when it is deemed by the SBA to be relevant or necessary to the
litigation or the SBA has an interest in such litigation when any of
the following are a party to the litigation or have an interest in the
litigation: (1) Any employee or former employee of the SBA in his or
her official capacity; (2) Any employee or former employee of the SBA
in his or her individual capacity when DOJ or SBA has agreed to
represent the employee or a party to the litigation or have an interest
in the litigation; or (3) The United States or any agency thereof.
<bullet> P. To the National Archives and Records Administration
(NARA) pursuant to records management inspections conducted under the
authority of 44 U.S.C. 2904 and 2906.
<bullet> Q. To independent auditors engaged by SBA for the purpose
of performing audit functions as authorized by law, but only such
information as is necessary and relevant to such audit function.
<bullet> R. To appropriate agencies, entities, and persons when (1)
SBA suspects or has confirmed that there has been a breach of the
system of records, (2) SBA has determined that as a result of the
suspected or confirmed breach there is a risk of harm to individuals,
SBA (including its information systems, programs, and operations), the
Federal Government, or national security; and (3) the disclosure made
to such agencies, entities, and persons is reasonably necessary to
assist in connection with SBA's efforts to respond to the suspected or
confirmed breach or to prevent, minimize, or remedy such harm.
<bullet> S. To another Federal agency or Federal entity, when SBA
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the Federal Government, or national security, resulting from a
suspected or confirmed breach.
<bullet> T. To SBA contractors, regulators, experts, grantees,
volunteers, and interns who have been engaged by SBA to assist in the
performance and performance improvement of a service related to this
system of records and who need access to the records to perform this
activity which may also include for regulatory purposes.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Electronic Records are in a secured server, and paper records are
in locked files.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by the name of individual, business name,
application number, grant number, Data Universal Numbering System,
cross-referenced loan number or borrower's Social Security number or
Employer Identification Number, or FEMA registration number.
[[Page 56703]]
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are maintained in accordance with latest edition of SBA
Standard Operating Procedure (SOP) series 00 41, Records and
Information Management Program. Records are disposed of in accordance
with record retention schedules set by the National Archives and
Records Administration (NARA).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Electronic Records: Access and use of electronic records are
limited to individuals authorized by SBA who are acting in their
official capacities on a need-to-know basis. Those authorized
individuals are granted access to electronic records by SBA through the
issuance of User ID and/or passcode, which may be used to amend or
review the records. Paper Records: Access and use of paper records are
limited to individuals authorized by the Agency who are acting in their
official capacities on a need-to-know basis. Those authorized
individuals are granted access to paper records by SBA through the
issuance of keys to locked physical files and/or transmission of copies
of the files through secure electronic means using an SBA-issued User
ID and/or passcode.
RECORD ACCESS PROCEDURES:
Individuals wishing to request access to records about them should
submit a Privacy Act request to the SBA Chief, Freedom of Information
and Privacy Act Office, U.S. Small Business Administration, 409 Third
St. SW, Eighth Floor, Washington, DC 20416 or <a href="/cdn-cgi/l/email-protection#6f2920262e2f1c0d0e41080019"><span class="__cf_email__" data-cfemail="aee8e1e7efeeddcccf80c9c1d8">[email protected]</span></a>. Individuals
must provide their full name, mailing address, personal email address,
telephone number, and a detailed description of the records requested.
Individuals requesting access must also follow SBA's Privacy Act
regulations regarding verification of identity and access to records
(13 CFR part 102 subpart B).
CONTESTING RECORD PROCEDURES:
Individuals wishing to contest information contained in records
about them should submit a Privacy Act request to the SBA Chief,
Freedom of Information and Privacy Act Office, U.S. Small Business
Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or
<a href="/cdn-cgi/l/email-protection#f1b7beb8b0b1829390df969e87"><span class="__cf_email__" data-cfemail="094f464048497a6b68276e667f">[email protected]</span></a>. Individuals must provide their full name, mailing
address, personal email address, telephone number, and a detailed
description of the records requested. Requesting individuals must
follow SBA's Privacy Act regulations regarding verification of identity
and access to records (13 CFR part 102 subpart B).
NOTIFICATION PROCEDURES:
Individuals may make record inquiries in person at the address
listed below or in writing to the Systems Manager through the SBA
Chief, Freedom of Information and Privacy Act Office, U.S. Small
Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC
20416 or <a href="/cdn-cgi/l/email-protection#12545d5b53526170733c757d64"><span class="__cf_email__" data-cfemail="7630393f373605141758111900">[email protected]</span></a>.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
86 FR 64979 (November 19, 2021); and 74 FR 14889 (April 1, 2009).
Douglas Robertson,
Deputy Chief Information Officer (Alternate Authorizing Official),
Office of the Chief Information Officer, U.S. Small Business
Administration.
[FR Doc. 2026-17995 Filed 9-2-26; 8:45 am]
BILLING CODE 8026-09-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 3, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.