SBA OIG reports on eligibility: replay your 2023–2025 files now

SBA OIG reports are the audits and evaluations of the Small Business Administration's Office of Inspector General, and on 7(a) eligibility the one that matters now is Report 26-07, published March 11, 2026. It found that SBA's own eligibility screen, used from August 2023, never tested size or for-profit status and checked only five of the 19 ineligible business types, and SBA agreed to flag all 73,302 loans it approved that way, about $32 billion, for an eligibility review when lenders ask SBA to buy the guaranty. Every lender with 2023–24 SBA loans now holds files that will be read again, on tests the lender may never have documented. Botminds' SBA Eligibility Screening replays those files the way it screens new ones: it reads the package, rebuilds ownership and affiliation from the documents, and shows the officer which tests the file can and cannot support.

Worked examples come from a fictional sample bank and applicant in the solution; every finding about SBA comes from the OIG reports linked in place.

What did SBA OIG Report 26-07 find?

Report 26-07 found that SBA's Risk Mitigation Framework "was not sufficient to determine borrowers' eligibility" because "it did not screen or fully screen for three of the six eligibility requirements" (SBA OIG Report 26-07). The framework did not test whether a business was organized for profit or met its size standard, and of the 19 ineligible business types it screened five: marijuana businesses, loan packagers, businesses with associates with a criminal history, entities with a prior loss to the government, and certain SBIC-financed entities.

The second finding is the one practitioners should study. Of 9,650 loans that had a compliance error code resolved, OIG reviewed 188 and found 71, 38%, where SBA "did not maintain sufficient documentation to support the reviewer's decision to clear the error codes." The reason was structural: SBA guidance "did not require the reviewer to obtain the underlying supporting documentation," and reviewers "relied solely on the lender credit memorandum." OIG's verdict on that practice applies to any eligibility file: the credit memo "on its own it is not sufficient to validate an applicant's information because it does not include underlying source documentation."

Which loans did SBA flag for eligibility review?

All 73,302 7(a) loans SBA approved and disbursed from August 1, 2023 to December 31, 2024 using its framework. OIG recommended that SBA "Flag the 73,302 7(a) loans for review at guaranty purchase to assess whether borrowers met all eligibility requirements and seek remedy for all loans deemed ineligible." SBA agreed, saying it will flag the loans in its loan system "and seek recovery where appropriate and legally justified," and told OIG it planned to finish the flagging by February 17, 2027.

Two details shape a lender's exposure. First, under the SOP then in force, "if SBA verified an applicant's eligibility using the framework and later discovered the applicant to be ineligible, it could not use that discovery to deny or repair the guaranty purchase requested by the lender." Second, in discussions with OIG, SBA officials said they would "seek remedy on all defaulted loans deemed ineligible, in which the lender knew of the ineligibility." Read together, the review will turn on what the lender's own file shows it knew, or should have known, when it submitted the application. That is the question a replay answers.

The flagged population is narrower than the period SBA ran the screen. The framework applied until eligibility went back to lenders on June 1, 2025, but OIG's scope, and so the flag, covers approvals through December 31, 2024. Loans approved from January to May 2025 went through the same screen and are not flagged; a lender replaying its files should treat them the same way, because the screen had the same gaps.

What SBA's screen tested, and what it left to the file

The framework checked identity and records well and structure poorly. It used "a network of third-party databases and solutions" and returned error codes for issues "such as bankruptcy, affiliation, deceased applicants, inactive businesses, and citizenship status." What it could not see was what lives only in documents: what an owner owns, what an affiliate earns, what a business actually does.

The ownership row needs care. LPR owners were eligible for loans approved before March 1, 2026, and SBA's guaranty purchase rules say it "will apply the requirements of SOP 50 10 in effect when the Loan was approved for loan making, loan closing, and loan modifications" (SOP 50 57 4, Ch. 24). A replay that tests a 2024 loan against the 2026 citizenship rule will produce false alarms; one that tests it against the 2023 SOP will find the real gaps.

What is error code 803?

Error code 803, "Additional Business Affiliation," was the framework's signal that an applicant's owners appeared to hold other businesses that might count toward its size. It was the most common code in OIG's scope and 62 of the 77 unsupported clearances. To clear it, SBA's instructions asked the lender for "a copy of their credit memorandum or other documentation demonstrating their affiliate analysis of the applicant and impact on loan eligibility." The 62 files OIG read had the memo and not the evidence:

• 22 files with ownership-percentage questions lacked documents that "validated the percentage";
• 16 lacked support for the size calculation, for example no tax returns behind receipts in the lender's analysis;
• 13 lacked documents on sold or inactive businesses, such as the sales contract for a divested affiliate;
• 11 lacked support on other matters, such as the business's industry and name.

Each of those four gaps is a document request, not a judgement. A file that holds the operating agreements, the affiliates' returns and the sale contract answers an 803 question in minutes. The affiliation decision tree sets out the ownership rules those documents have to satisfy, and the ownership percentage arithmetic shows where indirect stakes usually go missing.

Although the credit memorandum is listed as acceptable support, on its own it is not sufficient to validate an applicant's information.

SBA OIG Report 26-07

The other SBA OIG reports that bear on eligibility

Report 26-07 is the latest in a line of reports that reach the same conclusion from different directions: eligibility failures surface at purchase, and they surface as missing documents. Read together they tell a lender where the purchase reviewer will look.

What happens if a loan is found ineligible at purchase?

SBA can deny liability on the whole guaranty. SBA's servicing SOP lists the case first among its examples: "A full Denial of Liability is justified if a delegated Lender made an ineligible 7(a) Loan in accordance with the Loan Program Requirements in effect when the Loan was approved. A partial Denial of Liability is justified if a portion of the Loan proceeds were used for an ineligible purpose" (SOP 50 57 4, Ch. 25). A full denial is also justified when the lender's actions "resulted in SBA guaranteeing an ineligible Loan."

For the flagged 2023–24 loans the picture is less settled, because SBA, not the lender, made the eligibility determination and its own SOP limited its ability to deny on that basis. What SBA has said it will pursue are ineligible defaulted loans where the lender knew. A lender cannot change what it knew in 2024; it can establish now, while borrowers are reachable and documents retrievable, what the file shows and what it does not. That is cheaper than doing it under a purchase deadline, and it tells the credit officer which loans carry an eligibility risk the reserve does not yet reflect.

How do you replay closed SBA loans?

Replaying a closed loan means re-performing the eligibility tests on the file as it stood at approval, under the rules in force then, and recording which tests the file supports. It is not a re-underwriting and it does not change the loan. The order below puts the loans most likely to be read first at the front.

The heaviest steps are the fourth and fifth, and they are where a replay stalls. Rebuilding ownership means reading the operating agreement and every amendment, then the owner entities' agreements; rebuilding size means finding the affiliates in the owners' own filings. Both are the work SBA Eligibility Screening's agents do on a new application, and they do it the same way on a closed one.

Replaying a file with SBA Eligibility Screening

A replay in the solution starts from the package as it was approved and produces the same artefacts as a live screen: an ownership tree traced to 100%, each related business tested for affiliation, the size test with its sources, and a checklist with every line cited. The difference is the rule set, which is pinned to the approval date, and the output, which is a replay note rather than a request to the borrower.

The size test a replay needs: every related business, the rule applied and the figures behind it

On the sample file the agents found the affiliate on a holding company's 2025 partnership return, the document a replay most often lacks. The group was over its industry standard and small under the alternative standard of $20 million in tangible net worth and $6.5 million in average net income, and the file now says so with the figures and their sources.

The return behind the affiliate, opened at the line that matters

The officer still decides what each replay note means. The agents can show that a 2024 file lacks the affiliate's return; only the lender can decide whether to request it, how to weigh it and whether the loan's reserve should change. To see a replay on your own closed files, start from SBA Eligibility Screening.

Questions people ask

Where are SBA OIG reports published?

SBA's Office of Inspector General posts its audits, evaluations and semiannual reports on SBA's site and on oversight.gov, the shared site of federal inspectors general. Report 26-07, on SBA's screening of 7(a) applications, was published March 11, 2026.

Will SBA review eligibility at guaranty purchase?

Yes. For delegated loans SBA always reviews the lender's analysis at purchase, and SBA agreed to flag the 73,302 loans approved under its own framework so that eligibility is assessed when a purchase is requested. SBA told OIG it planned to complete the flagging by February 17, 2027.

What is SBA's Risk Mitigation Framework?

The system SBA used from August 1, 2023 to determine 7(a) eligibility itself, validating applicant data in real time against third-party sources and returning compliance error codes for lenders to clear. It ended on June 1, 2025, when eligibility went back to lenders under SOP 50 10 8.

Does a 2024 loan have to meet the 2026 citizenship rules?

No. At purchase SBA applies the SOP 50 10 in effect when the loan was approved, so a loan approved with a lawful permanent resident owner under the rules of the time is tested against those rules. New owners or guarantors added in servicing must meet the rules in force when the change is approved.

Does SBA OIG audit individual lenders?

Its reports usually examine SBA's programs and controls, though they often sample individual loans and, as in Report 26-14, can focus on a type of lender. Routine lender oversight belongs to SBA's Office of Credit Risk Management, which supervises over 3,100 lenders and development companies.