On August 5, 2021, the Office of the Comptroller of the Currency (OCC) released the “Small Business Administration Lending: Risk Management Principles” bulletin (OCC 2021-34). This guidance informs bankers and examiners of the critical components for ensuring a sound risk management system related to U.S. Small Business Administration (SBA) lending. In this blog post, we explore the risks and rewards of the SBA lending program and pose some questions to consider as organizations evaluate their alignment to the risk management principles outlined in the OCC guidance.
Since 1954 when it was first established, the SBA has offered guaranteed loans to small businesses that need capital to start or expand their operations. Participation in SBA lending programs can bring a financial institution both risks and rewards. Without the SBA guarantee, most banks would consider these loans too risky to fund. However, there are a number of benefits to the program:
- Helping improve local economies by fostering small business growth resulting in job creation.
- Expanding a bank’s customer base and attracting borrowers who are unable to quality for similar loans absent the guarantee.
- Increased profit and source of liquidity through selling government-backed loans in the secondary market.
- Regulatory relief, such as excluding individual or affiliated borrower exposure from the legal lending limit calculation, and either 0% or 20% risk weight under the risk-based capital rule.
Appropriate risk management oversight of an institution’s SBA lending program is crucial to avoid potential losses. Lacking an understanding of the program requirements and not having a sound risk management framework could result in the SBA declining or decreasing the guarantee on loans, enforcement actions (though rarely used), or removal from the program altogether.
The OCC bulletin is intended to help organizations evaluate their existing SBA lending risks and risk management framework. Credit risk, operational and compliance risks, liquidity and price risks, and strategic risk are the primary risks associated with SBA lending. These risks can be mitigated through a clearly defined and operationalized risk management framework that aligns to the OCC defined risk management principles. Consider the following critical questions:
Strategic planning
- Has your organization developed a clearly articulated SBA lending strategic plan that is periodically reviewed and approved by the board?
- What is your strategy related to selling and purchasing SBA guaranteed loans in the secondary market?
- Are there projected acquisition activities involving SBA loans and how will that impact your strategy?
Policies and procedures
- Are there clearly established SBA lending program policies and procedures, and are policies reviewed and approved by the board, or a committee of it, annually?
- How are changes to the SBA standard operating procedure requirements tracked and incorporated into the bank’s processes?
- Are roles and responsibilities clearly defined to ensure appropriate segregation of duties?
Personnel
- Is your staff knowledgeable and appropriately trained to understand the credit, operational and compliance risks related to SBA lending?
- How will resources be impacted by growth/expansion into this area?
Control systems
- Is the bank’s SBA portfolio evaluated as part of internal audit’s and credit review’s risk assessment and examination processes? Do these functions credibly challenge the organization’s SBA processes and controls?
- Do you have a well-established quality control function that provides quality assurance of SBA-originated credits?
- Are the level and frequency of reporting to senior management and the board appropriate?
Risk-rating SBA loans/credit loss allowance
- Does the bank’s risk-rating methodology have appropriate parameters for SBA-guaranteed loans? Are these documented in policy?
- Are the ratings consistently applied?
- Is your internal rating system capable of split ratings between SBA-guaranteed and unguaranteed portions to establish an appropriate allowance?
- Are you applying a pass rating for the unconditional guaranteed portion of the SBA loan?
- Are you tracking and reporting the number of “repairs” or “denials” and the “24-month repair/denial rate” for SBA 7a loans, which also need to be factored into the credit loss methodology?
Concentration risk management/stress testing
- Do you have established concentration limits for the unguaranteed portions of your organization’s SBA portfolio?
- Are you stressing your concentration limits and reassessing based on risk factors?
- Do concentration limits align to the organization’s risk appetite, and are levels and stress testing results reported to senior management and the board?
Regulatory reporting
- Does your loan system have the ability to split SBA guaranteed and unguaranteed commitments and balances?
- Does your organization have the appropriate tools to identify, track and measure the guaranteed and unguaranteed amounts for regulatory reporting purposes (Schedule RC-C)?
- Are there appropriate controls in place to ensure accuracy of call reporting related to the SBA portfolio?
Capital considerations
- Is your organization appropriately assigning risk weights to the guaranteed and unguaranteed portions of the portfolio?
- Do the risk weights align with the capital rules (12 CFR 3, “Capital Adequacy Standards”)
Accounting for SBA loan sales and assets
- Are there well-established controls over SBA loan sales, including appropriate policies, approvals and supporting servicing and accounting processes?
- When selling an SBA loan, is your process aligned to the ASC Topic 860, “Transfers and Servicing?”
An effective risk management framework related to SBA lending is crucial to maximize profitability of this offering. Organizations should evaluate their existing SBA lending framework, and utilize the OCC Bulletin as a guide, to ensure there are appropriate control systems in place to identify, measure and monitor associated risks. Should there be any questions regarding particular areas of this bulletin, in general or in relation to your institution, we welcome the opportunity to discuss and share additional insights.
