Notice2026-18009
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 3, 2026
Effective
October 5, 2026
Issuing agencies
Small Business Administration
Abstract
In accordance with the Privacy Act of 1974, as amended, the U.S. Small Business Administration (SBA, "the Agency") proposes modifying the existing system of records identified as Loan System, SBA 21 to allow information in the system to be disclosed to the Department of the Treasury for purposes of identifying, preventing, or recouping improper payments through Treasury's Do Not Pay Working System. Additional changes are proposed to comply with Office of Management and Budget (OMB) Circular A-108 and reflect technical updates to the system. This system of records is used to determine eligibility and conduct financial transactions and reporting related to business loans, grants, and surety bonds.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 170 (Thursday, September 3, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 170 (Thursday, September 3, 2026)]
[Notices]
[Pages 56703-56706]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-18009]
-----------------------------------------------------------------------
SMALL BUSINESS ADMINISTRATION
Privacy Act of 1974; System of Records
AGENCY: U.S. Small Business Administration.
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, as amended, the
U.S. Small Business Administration (SBA, ``the Agency'') proposes
modifying the existing system of records identified as Loan System, SBA
21 to allow information in the system to be disclosed to the Department
of the Treasury for purposes of identifying, preventing, or recouping
improper payments through Treasury's Do Not Pay Working System.
Additional changes are proposed to comply with Office of Management and
Budget (OMB) Circular A-108 and reflect technical updates to the
system. This system of records is used to determine eligibility and
conduct financial transactions and reporting related to business loans,
grants, and surety bonds.
DATES: This modified system will be effective upon publication. New or
modified routine uses will be effective October 5, 2026. Submit written
comments on or before October 5, 2026.
ADDRESSES: You may submit comment on this notice, identified by [DOCKET
NUMBER PUBLICATION BY THE FEDERAL REGISTER], by any of the following
methods.
Federal e-Rulemaking Portal: <a href="http://www.regulations.gov">http://www.regulations.gov</a>: Follow the
instructions for submitting comments.
Mail/Hand Delivery/Courier: Submit written comments to: Arlene
Embrey, Trial Attorney, Office of General Counsel, U.S. Small Business
Administration, 409 3rd Street SW, Washington, DC 20416.
FOR FURTHER INFORMATION CONTACT: Michael Post, Acting Chief Privacy
Officer, Office of the Chief Information Officer, U.S. Small Business
Administration, 409 3rd Street SW, Suite 4000, Washington, DC 20416, or
via email to <a href="/cdn-cgi/l/email-protection#4e1e3c27382f2d37012828272d2b3c0e3d2c2f60292138"><span class="__cf_email__" data-cfemail="5f0f2d36293e3c26103939363c3a2d1f2c3d3e71383029">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: On March 25, 2025, the President signed
Executive Order (E.O.) 14249, Protecting America's Bank Account Against
Fraud, Waste, and Abuse, which requires Executive Branch agencies to
``review and modify, as applicable, their relevant system of records
notices under the Privacy Act of 1974 to include a `routine use' that
allows for the disclosure of records to the Department of the Treasury
for the purposes of identifying, preventing, or recouping fraud and
improper payments, to the extent permissible by law.'' On August 20,
2025, OMB issued Memorandum M-25-32, Preventing Improper Payments and
Protecting Privacy Through Do Not Pay, which provides guidance to
agencies for implementing the new routine use requirement under E.O.
14249. The memorandum requires agencies to identify systems of records
that maintain information ``whose disclosure to Treasury would be
relevant and necessary for identifying, preventing, or recouping
improper payments by reviewing payment and award eligibility through
the Do Not Pay Working System'' and add a new routine use to each
identified system to allow such disclosure. See OMB M-25-32, Appendix
1. Accordingly, this notice hereby modifies SBA 21 system of records to
replace routine use p. with the following routine use prescribed by
OMB:
``AA. To the U.S. Department of the Treasury when disclosure of the
information is relevant to review payment and award eligibility through
the Do Not Pay Working System for the purposes of identifying,
preventing, or recouping improper payments to an applicant for, or
recipient of, Federal funds, including funds disbursed by a state
(meaning a state of the United States, the District of Columbia, a
territory or possession of the United States, or a federally recognized
Indian
[[Page 56704]]
tribe) in a state-administered, federally funded program.''
SBA has also modified SBA 21 system of records to replace routine
use (g). with the following routine use:
``g. To the public on approved loans in order to inform the public
on how taxpayer dollars have been utilized when there is a legitimate
public interest in the disclosure of the information and the disclosure
would not constitute an unwarranted invasion of personal privacy. This
information includes recipient name and address, term and rate of the
loan and the amount paid in full or charged off.''
SBA has added a ``Purpose(s) of the System'', ``Security
Classification'', and ``History'' to comply with A-108.
SBA has made technical corrections to the following sections:
``System Location'', ``System Manager'', ``Authority for Maintenance of
the System'', ``Categories of Individuals Covered By the System'',
``Categories of Records in the System'', ``Routine Uses of Records
Maintained in the System'', ``Policies and Practices for Storage of
Records'', ``Policies and Practices for Retrieval of Records'',
``Policies and Practices for Retention and Disposal of Records'', and
``Administrative, Technical and Physical Safeguards'', ``Record Access
Procedures'', ``Contesting Record Procedures'', ``Notification
Procedures''.
SYSTEM NAME AND NUMBER:
Loan System (SBA21).
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Headquarters. U.S. Small Business Administration, 409 3rd Street
SW, Washington, DC 20416.
SYSTEM MANAGER(S):
Associate Administrator for Capital Access; Director, Office of
Financial Programs. U.S. Small Business Administration, 409 3rd Street
SW, Washington, DC, 20416, 800-827-5722.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
15 U.S.C. 631 et seq. (Small Business Act, all provisions relating
to loan programs); Coronavirus Aid, Relief, and Economic Security Act,
15 U.S.C. 15 U.S.C. 636(a)(36); American Rescue Plan, Pub. L. 117-12,
March 11, 2021, 135 Stat. 4.
PURPOSE(S) OF THE SYSTEM:
To collect financial information used to determine applicants'
eligibility and borrower and individual guarantor eligibility for
business loans (non-disaster) that are made by third-party lenders and
guaranteed by SBA, Restaurant Revitalization Fund awards, Microloan
grants, and surety bonds. Additionally, the system is used to collect
information to direct small businesses potentially interested in
onshoring to the SBA's lending programs, including Lender Match.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals (i.e., borrowers, guarantors, principals of businesses
named in loan records, awardees, loan agents), throughout the life of
SBA's interest in the loan or award. For purposes of this Systems of
Records Notice, ``loan agents'' means all ``Agents'' as defined in 13
CFR 103.1(a) that are involved in the business loan process (e.g., loan
packagers, brokers, and referral agents).
CATEGORIES OF RECORDS IN THE SYSTEM:
Personal and commercial information including credit history,
financial information, identifying number or other personal identifier
such as name, Social Security number, date of birth, address, telephone
number, SBA identifier, loan number, Participating Lender identifier,
Participating Lender name, loan information, fees paid to third party
agents as set forth in SBA Form 159, compliance and enforcement
information on individuals named in business loan and/or awardee files,
including but not limited to Loan Agents, throughout the entirety of
SBA's interest in the loan.
RECORD SOURCE CATEGORIES:
Subject individuals and businesses, financial institutions, credit
reporting agencies, law enforcement agencies and SBA resource partners,
including lender or other Federal agencies with whom SBA has a data
sharing or similar agreement.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5
U.S.C.552a(b) of the Privacy Act, all or a portion of the information
contained in this system may be disclosed to authorized entities, as is
determined to be relevant and necessary, outside SBA as a routine use
pursuant to 5 U.S.C. 552a(b)(3) as follows:
<bullet> AA. To the U.S. Department of the Treasury when disclosure
of the information is relevant to review payment and award eligibility
through the Do Not Pay Working System for the purposes of identifying,
preventing, or recouping improper payments to an applicant for, or
recipient of, Federal funds, including funds disbursed by a state
(meaning a state of the United States, the District of Columbia, a
territory or possession of the United States, or a federally recognized
Indian tribe) in a state-administered, federally funded program.
<bullet> a. To SBA Resource Partner, its successors or assigns,
(i.e., participating lender, certified development company, micro
lender) who initially collected the individual's information for the
purpose of making and servicing loans.
<bullet> b. To a Congressional office from an individual's record,
when that office is inquiring on the individual's behalf and at the
request of the individual.
<bullet> c. To SBA contractors, grantees, experts, volunteers and
interns who have been engaged by SBA to assist in the performance of a
service related to this system of records and who need access to the
records in order to perform this activity.
<bullet> d. To a federal, state, local, territorial, tribal, or
foreign law or regulatory enforcement authority or other appropriate
entity charged with the responsibility for investigating or prosecuting
such violation or charged with enforcing or implementing a law where a
record, either alone or in conjunction with other information,
indicates a violation or potential violation of such law, whether
criminal, civil, or regulatory in nature.
<bullet> e. To qualified investors who have signed a
confidentiality agreement related to review of files for the purpose of
evaluating, negotiating and implementing the purchase of loans from SBA
as a part of SBA's Asset Sales program.
<bullet> f. To request information from a Federal, State, local
government agency or a private credit agency maintaining civil,
criminal or other information relevant to determining an applicant's
suitability for a business loan. This applies to individuals involved
in business loans.
<bullet> g. To the public on approved loans in order to inform the
public on how taxpayer dollars have been utilized when there is a
legitimate public interest in the disclosure of the information and the
disclosure would not constitute an unwarranted invasion of personal
privacy. This information includes recipient name and address, term and
rate of the loan and the amount paid in full or charged off.
<bullet> h. To 7(a) and 504 lenders and/or participating
contractors for purposes of the Loan and Lender Monitoring System.
<bullet> i. To the Department of Justice (DOJ) wh any of the
following is a party to litigation or has an interest in such
[[Page 56705]]
litigation, and the use of such records by DOJ is deemed by SBA to be
relevant and necessary to the litigation, provided, however, that in
each case, SBA determines the disclosure of the records to DOJ is a use
of the information contained in the records that is compatible with the
purpose for which the records were collected: SBA, or any component
thereof; any SBA employee in his or her official capacity; any SBA
employee in his or her individual capacity where DOJ has agreed to
represent the employee; or The United States Government, where SBA
determines that litigation is likely to affect SBA or any of its
components.
<bullet> j. In a proceeding before a court, or adjudicative body,
or a dispute resolution body before which SBA is authorized to appear
or when any of the following is a party to litigation or has an
interest in such litigation, provided, however, that SBA determines
that the use of such records is relevant and necessary to the
litigation, and that, in each case, SBA determines that disclosure of
the records to a court, adjudicative body or a dispute resolution body
is a use of the information contained in the records that is a
compatible purpose for which the records were collected: SBA, or any
SBA component; any SBA employee in his or her official capacity; any
SBA employee in his or her individual capacity where DOJ has agreed to
represent the employee; or The United States Government, where SBA
determines that litigation is likely to affect SBA or any of its
components.
<bullet> k. To appropriate agencies, entities, and persons when:
SBA suspects or has confirmed that the security or confidentiality of
information in the system records has been compromised; SBA has
determined that as a result of the suspected or confirmed compromise
there is a risk of harm to economic or property interests, identity
theft or fraud, or harm to the security and integrity of this system or
other systems or programs (whether maintained by the Agency or entity)
that rely upon the compromised information; and the disclosure made to
such agencies, entities and persons is reasonably necessary to assist
in connection with SBA's efforts to respond to the suspected or
confirmed compromise and prevent, minimize, or remedy such harm.
<bullet> l. To state or Federal regulators or legal authorities for
the review of Loan Agent fees and activities and for the review of
loans generated by Loan Agents (e.g., for performance and other
trends).
<bullet> m. To GSA and the public for publication of Loan Agent
suspensions, revocations and exclusions under 13 CFR part 103 in the
Excluded Parties List System (or successor system).
<bullet> n. To state or Federal regulators for compliance purposes,
including the use of loan level data in regulatory safety and soundness
reviews and related risk management functions pertaining to SBA-
guaranteed loans.
<bullet> o. To the Department of Housing and Urban Development or
other Federal agency that participates in the Credit Alert Verification
Reporting System (CAIVRS) for publication by CAIVRS participants of
delinquent debt information of persons (including the names of
businesses and individuals) delinquent in paying a debt owed to or
guaranteed by the SBA (which includes persons who have caused a prior
loss under 13 CFR 120.110(q)) on a system to allow searches by
participating Government agencies and approved private lenders,
consistent with applicable law.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Electronic records are in a secured server, and paper records are
in locked files.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Electronic records are retrieved by individual name, personal
identifier such as Social Security numbers, loan number, SBA
Identifier, Participating Lender identifier, Participating Lender Name,
business name, and business identifier. Paper records are retrieved by
individual name and SBA Identifier.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
In accordance with SBA Standard Operating Procedure 00 41 2, Item
Nos. 50:04, 50:08, 50:09, 50:10, 50:11, 50:12, 50:13, 50:19, 50:22,
55:02. Records are retained for the life of SBA's interest in the
business loan and/or award and are disposed of according to the
reference in the SOP that pertains to a particular type of record and
in accordance with record retention schedules set by the National
Archives and Records Administration (NARA).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Electronic Records: Access and use of electronic records are
limited to individuals authorized by SBA who are acting in their
official capacities on a need-to-know basis. Those authorized
individuals are granted access to electronic records by SBA through the
issuance of User ID and/or passcode, which may be used to amend or
review the records. Paper Records: Access and use of paper records are
limited to individuals authorized by the Agency who are acting in their
official capacities on a need-to-know basis. Those authorized
individuals are granted access to paper records by SBA through the
issuance of keys to locked physical files and/or transmission of copies
of the files through secure electronic means using an SBA-issued User
ID and/or passcode.
RECORD ACCESS PROCEDURES:
Individuals wishing to request access to records about them should
submit a Privacy Act request to the SBA Chief, Freedom of Information
and Privacy Act Office, U.S. Small Business Administration, 409 Third
St. SW, Eighth Floor, Washington, DC 20416 or <a href="/cdn-cgi/l/email-protection#bff9f0f6feffccddde91d8d0c9"><span class="__cf_email__" data-cfemail="92d4dddbd3d2e1f0f3bcf5fde4">[email protected]</span></a>. Individuals
must provide their full name, mailing address, personal email address,
telephone number, and a detailed description of the records requested.
Individuals requesting access must also follow SBA's Privacy Act
regulations regarding verification of identity and access to records
(13 CFR part 102 subpart B).
CONTESTING RECORD PROCEDURES:
Individuals wishing to contest information contained in records
about them should submit a Privacy Act request to the SBA Chief,
Freedom of Information and Privacy Act Office, U.S. Small Business
Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or
<a href="/cdn-cgi/l/email-protection#084e474149487b6a69266f677e"><span class="__cf_email__" data-cfemail="5a1c15131b1a29383b743d352c">[email protected]</span></a>. Individuals must provide their full name, mailing
address, personal email address, telephone number, and a detailed
description of the records requested. Requesting individuals must
follow SBA's Privacy Act regulations regarding verification of identity
and access to records (13 CFR part 102 subpart B).
NOTIFICATION PROCEDURES:
Individuals may make record inquiries in person at the address
listed below or in writing to the Systems Manager through the SBA
Chief, Freedom of Information and Privacy Act Office, U.S. Small
Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC
20416 or <a href="/cdn-cgi/l/email-protection#5711181e161724353679303821"><span class="__cf_email__" data-cfemail="d690999f9796a5b4b7f8b1b9a0">[email protected]</span></a>.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
Modification published at 86 FR 23026 (April 30, 2021);
Modification published at 77 FR 61467 (October 9, 2012);
[[Page 56706]]
Modification published at 77 FR 15835 (March 16, 2012); 74 FR 14890
(April 01, 2009).
Douglas Robertson,
Deputy Chief Information Officer (Alternate Authorizing Official),
Office of the Chief Information Officer, U.S. Small Business
Administration.
[FR Doc. 2026-18009 Filed 9-2-26; 8:45 am]
BILLING CODE 8026-09-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 3, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.