SUPPLEMENTARY INFORMATION:

On March 25, 2025, the President signed Executive Order (E.O.) 14249, Protecting America's Bank Account Against Fraud, Waste, and Abuse, which requires Executive Branch agencies to “review and modify, as applicable, their relevant system of records notices under the Privacy Act of 1974 to include a `routine use' that allows for the disclosure of records to the Department of the Treasury for the purposes of identifying, preventing, or recouping fraud and ( printed page 56701) improper payments, to the extent permissible by law.” On August 20, 2025, OMB issued Memorandum M-25-32, Preventing Improper Payments and Protecting Privacy Through Do Not Pay, which provides guidance to agencies for implementing the new routine use requirement under E.O. 14249. The memorandum requires agencies to identify systems of records that maintain information “whose disclosure to Treasury would be relevant and necessary for identifying, preventing, or recouping improper payments by reviewing payment and award eligibility through the Do Not Pay Working System” and add a new routine use to each identified system to allow such disclosure. See OMB M-25-32, Appendix 1. Accordingly, this notice hereby modifies SBA 20 system of records to include the following new routine use prescribed by OMB:

“AA. To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program.”

In addition, SBA has removed routine use (T):

“To another agency or agent of a Government jurisdiction within or under the control of the U.S., lawfully engaged in national security or homeland defense when disclosure is undertaken for intelligence, counterintelligence activities (as defined by 50 U.S.C. 3003(3)), counterterrorism, homeland security, or related law enforcement purposes, as authorized by U.S. law or Executive Order.”

Routine use (U) has been renumbered and now replaces routine use (T).

SBA has made technical corrections to the following sections: ” System Location”, “System Manager”, “Authority for Maintenance of the System”, “Purpose(s) of the System”, Categories of Individuals Covered by the System”, Categories of Records in the System”, “Record Source Categories”, “Routine Uses of Records Maintained in the System”, “Policies and Practices for Storage of Records”, “Policies and Practices for Retrieval of Records”, “Policies and Practices for Retention and Disposal of Records”, “Administrative, Technical and Physical Safeguards”, and “History”.

SYSTEM NAME AND NUMBER:

Disaster Loans Case Files (SBA20).

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Headquarters. U.S. Small Business Administration, 409 3rd Street SW, Washington, DC 20416.

SYSTEM MANAGER(S):

Associate Administrator, Office of Disaster, Recovery, and Resilience. U.S. Small Business Administration, 409 3rd Street SW, Washington, DC 20416, (800) 827-5722.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Small Business Act, Small Business Act Public Law, 85-536; Small Business Advocate Act of 2012, H.R. 3851 (2011-2012); American Rescue Plan, Public Law 117-12, March 11, 2021, 135 Stat. 4.

PURPOSE(S) OF THE SYSTEM:

SBA 20 collects information on individuals including pre-application registrants, disaster home and business loan applicants, loan advance applicants, grant applicants, recipients of loan advances, grants, disaster home and business loans, and applicants' principals and guarantors to determine eligibility for disaster loan funding.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Loan applicants and borrowers, principals and guarantors of business applicants or borrowers, sole proprietors, grant applicants and recipients, advance applicants and recipients, homeowners, and renters.

CATEGORIES OF RECORDS IN THE SYSTEM:

Information relating to pre-application registrants, disaster home and business loan applicants, loan advance applicants, grant applicants, and recipients of loan advances, grants, disaster home and business loans including: name; address; date of birth; Social Security or tax identification number; telephone number; personal history including education and employment history for individual borrowers, sole proprietors, guarantors, or owners with a greater than 20% interest; personal or business financial statements for individual borrowers, sole proprietors, guarantors, or owners with a greater than 20% interest; bank information; credit information; insurance information; FEMA registration number; application number; grant number; correspondence to and from applicants; recommendations regarding applicant eligibility; authorizations of disaster loan advances, grants, disaster home and business loans; loan term and rate; payment history; loan accounting information; collateral; Uniform Commercial Code (UCC) filings and re-filings; field visit reports; investigative reports; appraisers' reports; waivers of costs, obligations, or requirements; and settlements and compromises.

RECORD SOURCE CATEGORIES:

Loan, advance, and grant individual applicants and/or principals or guarantors of loan, advance, grant applicants; SBA employees; SBA contractors; financial institutions; credit reporting agencies; Treasury Department; Federal Emergency Management Agency (FEMA); and local, state, federal, or Tribal law enforcement agencies.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the information contained in this system may be disclosed to authorized entities, as is determined to be relevant and necessary, outside SBA as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

• AA. To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program.
• A. To the public on approved loans in order to inform the public on how taxpayer dollars have been utilized when there is a legitimate public interest in the disclosure of the information and the disclosure would not constitute an unwarranted invasion of personal privacy. This information includes recipient name and address, term and rate of the loan, and the amount paid in full or charged off.
• B. To the public on approved loan advances and grants to inform the public on how taxpayer dollars have been utilized when there is a legitimate public interest in the disclosure of the information and the disclosure would not constitute an unwarranted invasion of personal privacy. This information ( printed page 56702) includes recipient name, address, period of performance and amount of the loan advance or grant.
• C. To provide information to potential investors who are interested in bidding on loans made available by the Agency in the sale of assets. Investors will be required to execute a confidentiality agreement prior to reviewing any record or information.
• D. To a federal, state, local, territorial, tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility for investigating or prosecuting such violation or charged with enforcing or implementing a law where a record, either alone or in conjunction with other information, indicates a violation or potential violation of such law, whether criminal, civil, or regulatory in nature.
• E. To request information from a Federal, State, or local government agency or a private credit agency maintaining civil, criminal, or other information relevant to determining an applicant's suitability for a loan, loan advance, or grant.
• F. In response to a request from a State or Federal agency in connection with the issuance of a grant, loan or other benefit by that agency which is relevant to their decision on the matter.
• G. To the Department of Housing and Urban Development or other Federal agency that participates in the Credit Alert Verification Reporting System (CAIVRS) for publication by CAIVRS participants of delinquent debt information of persons (including the names of businesses and individuals) delinquent in paying a debt owed to or guaranteed by the SBA (which includes persons who have caused a prior loss under13 CFR 120.110(q)) on a system to allow searches by participating Government agencies and approved private lenders, consistent with applicable law.
• H. To a consumer reporting agency in the event an applicant or borrower has been the victim of identity theft in order to assist such applicant or borrower in amending or correcting records kept by SBA. This may include information gathered from Federal Trade Commission's ID Theft Form 3515.
• I. To provide the Internal Revenue Service (IRS) with access to an individual's records for an official audit to the extent the information is relevant to the IRS's function.
• J. To a court, magistrate, grand jury, administrative tribunal, or to opposing counsel during such administrative proceedings, or in settlement negotiations concerning a claim or dispute, when SBA determines that the disclosure is relevant and necessary to the proceeding, claim, or dispute, and it involves: (1) SBA or any component thereof; (2) any officer or employee of SBA acting in his or her official capacity; or (3) the United States, when SBA determines that the proceeding, claim, or dispute is likely to affect SBA or any of its components.
• K. To a Congressional office from an individual's record when that office is inquiring on the individual's behalf and at the request of the individual.
• L. In a proceeding before a court, or adjudicative body, or a dispute resolution body before which SBA is authorized to appear or when any of the following is a party to litigation or has an interest in such litigation, provided, however, that SBA determines that the use of such records is relevant and necessary to the litigation, and that, in each case, SBA determines that disclosure of the records to a court, adjudicative body or a dispute resolution body is a use of the information contained in the records that is a compatible purpose for which the records were collected: SBA, or any SBA component; any SBA employee in his or her official capacity; any SBA employee in his or her individual capacity where DOJ has agreed to represent the employee; or The United States Government, where SBA determines that litigation is likely to affect SBA or any of its components.
• M. To the U.S. Department of the Treasury to effect issuance of loan, loan advance, or grants to borrowers or recipients of SBA disaster funding.
• N. To the Federal Emergency Management Agency (FEMA) to coordinate the issuance of federal disaster assistance to disaster victims and monitor for duplication.
• O. To the Department of Justice (DOJ), including offices of the U.S Attorneys, or other Federal agency conducting litigation or in proceedings before any court, adjudicative, or administrative body, when it is deemed by the SBA to be relevant or necessary to the litigation or the SBA has an interest in such litigation when any of the following are a party to the litigation or have an interest in the litigation: (1) Any employee or former employee of the SBA in his or her official capacity; (2) Any employee or former employee of the SBA in his or her individual capacity when DOJ or SBA has agreed to represent the employee or a party to the litigation or have an interest in the litigation; or (3) The United States or any agency thereof.
• P. To the National Archives and Records Administration (NARA) pursuant to records management inspections conducted under the authority of44 U.S.C. 2904 and 2906.
• Q. To independent auditors engaged by SBA for the purpose of performing audit functions as authorized by law, but only such information as is necessary and relevant to such audit function.
• R. To appropriate agencies, entities, and persons when (1) SBA suspects or has confirmed that there has been a breach of the system of records, (2) SBA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, SBA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with SBA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.
• S. To another Federal agency or Federal entity, when SBA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.
• T. To SBA contractors, regulators, experts, grantees, volunteers, and interns who have been engaged by SBA to assist in the performance and performance improvement of a service related to this system of records and who need access to the records to perform this activity which may also include for regulatory purposes.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Electronic Records are in a secured server, and paper records are in locked files.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by the name of individual, business name, application number, grant number, Data Universal Numbering System, cross-referenced loan number or borrower's Social Security number or Employer Identification Number, or FEMA registration number. ( printed page 56703)

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records are maintained in accordance with latest edition of SBA Standard Operating Procedure (SOP) series 00 41, Records and Information Management Program. Records are disposed of in accordance with record retention schedules set by the National Archives and Records Administration (NARA).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Electronic Records: Access and use of electronic records are limited to individuals authorized by SBA who are acting in their official capacities on a need-to-know basis. Those authorized individuals are granted access to electronic records by SBA through the issuance of User ID and/or passcode, which may be used to amend or review the records. Paper Records: Access and use of paper records are limited to individuals authorized by the Agency who are acting in their official capacities on a need-to-know basis. Those authorized individuals are granted access to paper records by SBA through the issuance of keys to locked physical files and/or transmission of copies of the files through secure electronic means using an SBA-issued User ID and/or passcode.

RECORD ACCESS PROCEDURES:

Individuals wishing to request access to records about them should submit a Privacy Act request to the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov. Individuals must provide their full name, mailing address, personal email address, telephone number, and a detailed description of the records requested. Individuals requesting access must also follow SBA's Privacy Act regulations regarding verification of identity and access to records (13 CFR part 102 subpart B).

CONTESTING RECORD PROCEDURES:

Individuals wishing to contest information contained in records about them should submit a Privacy Act request to the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov. Individuals must provide their full name, mailing address, personal email address, telephone number, and a detailed description of the records requested. Requesting individuals must follow SBA's Privacy Act regulations regarding verification of identity and access to records (13 CFR part 102 subpart B).

NOTIFICATION PROCEDURES:

Individuals may make record inquiries in person at the address listed below or in writing to the Systems Manager through the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

86 FR 64979 (November 19, 2021); and 74 FR 14889 (April 1, 2009).

91 FR 56700