DISASTER ASSISTANCE

SBA Should Take Steps to Make Data Sharing with IRS More Efficient

Report to Congressional Committees

March 2026

GAO-26-107682

United States Government Accountability Office

A report to congressional committees.

For more information, contact: Courtney LaFountain at LaFountainC@gao.gov.

What GAO Found

During the first year of the COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL) program, the Small Business Administration (SBA) was statutorily prohibited from requiring taxpayer information to verify applicant eligibility and application details. In April 2021, after receiving authorization, SBA began requesting tax data from the Internal Revenue Service (IRS).

SBA and IRS established a legal framework and enhanced processes for sharing tax data. The agencies approved an administrative agreement for the COVID-19 EIDL program that identified the tax information IRS would provide to SBA. To process the large volume of requests, both agencies upgraded IT system components and implemented process changes, including for obtaining applicants’ consent to access their tax information. However, IRS backlogs led SBA to request taxpayer information from some applicants directly.

GAO analyzed SBA COVID-19 EIDL data on almost 3.7 million approved loans totaling about $360 billion. About half of the loans had tax-related documents in their application records and these loans accounted for about 73 percent of COVID-19 EIDL funding (about $261 billion). But some tax-related documents may not have contained actual tax data (i.e., they contained IRS messages that tax records were not available).

SBA and IRS actions to share data for COVID-19 EIDL and the ongoing Disaster Loan Program (which uses tax data for similar purposes) generally reflected relevant leading practices for data sharing and interagency collaboration. For example, the agencies conducted periodic data quality control reviews and documented roles and responsibilities.

SBA does not have the statutory authority to receive tax information from IRS without the loan applicant first providing consent through tax request forms. Both agencies manually verify these forms, a process that requires time and staff resources and carries the risk of backlogs or delays. The challenges could be mitigated if SBA were authorized to receive taxpayer information directly from IRS through an amendment to section 6103(l) of the Internal Revenue Code. SBA and IRS have begun to explore opportunities for technological improvements that could introduce efficiencies. By taking steps to improve the efficiency of tax data sharing for the Disaster Loan Program, SBA would be better positioned to leverage existing federal data to serve applicants during future disasters and emergencies and to prevent fraud, waste, and abuse.

Why GAO Did This Study

From March 2020 through May 2022, the temporary COVID-19 EIDL program assisted small businesses and nonprofits affected by the pandemic. SBA’s ongoing Disaster Loan program, which offers similar loans, continues to assist businesses and nonprofits affected by disasters. Since March 2021, COVID-19 EIDL has been on GAO’s High Risk List due to control deficiencies that make it susceptable to improper payments and fraud.

The explanatory statement accompanying the Further Consolidated Appropriations Act, 2024, includes a provision for GAO to examine SBA and IRS data sharing for COVID-19 EIDL. This report examines (1) SBA and IRS processes for sharing tax information, (2) available data on the extent to which SBA obtained this information, and (3) the extent to which the agencies’ data sharing reflected relevant leading practices.

GAO reviewed laws, regulations, and agency agreements for sharing tax data and analyzed application-level COVID-19 EIDL data covering the full application period (March 2020–May 2022). GAO also assessed the agencies’ data-sharing process against leading practices and interviewed SBA and IRS officials.

What GAO Recommends

GAO recommends that SBA take steps to improve the efficiency of data sharing with IRS for the Disaster Loan Program, such as by seeking statutory authority for direct access to tax data or by implementing new data-sharing technologies. SBA neither agreed nor disagreed with the recommendation but identified plans to address it.

 

 

 

COVID-19 EIDL	COVID-19 Economic Injury Disaster Loan
IRS	Internal Revenue Service
MOU	memorandum of understanding
OIG	Office of the Inspector General
PDF	portable document format
SBA	Small Business Administration

March 3, 2026

The Honorable Bill Hagerty
Chair
The Honorable Jack Reed
Ranking Member
Subcommittee on Financial Services and General Government Committee on Appropriations
United States Senate

The Honorable Dave Joyce
Chairman
The Honorable Steny Hoyer
Ranking Member
Subcommittee on Financial Services and General Government Committee on Appropriations
House of Representatives

Federal agencies sometimes use taxpayer information to verify applicant identities, incomes, and business earnings for programs. The CARES Act provided funding to the COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL) program in March 2020 to aid small businesses affected by the pandemic.[1] However, the act prohibited Small Business Administration (SBA) from requiring applicants to submit tax returns (referred to hereafter as taxpayer information), which limited SBA from using this information to verify applicant eligibility and application accuracy.[2]

SBA subsequently was authorized to use taxpayer information by the Consolidated Appropriations Act, 2021, and began doing so in April 2021.[3] However, the act did not provide the Internal Revenue Service (IRS) authority to share taxpayer information directly with SBA, so SBA had to obtain loan applicants’ consent for IRS to release their tax information. SBA uses a similar process to obtain taxpayer information for its ongoing Disaster Loan Program.

The explanatory statement accompanying the Further Consolidated Appropriations Act, 2024, includes a provision for GAO to examine the tax data-sharing process between SBA and IRS for the COVID-19 EIDL program.[4] This report examines (1) the processes and agreements SBA and IRS established to share taxpayer information, (2) available data on the extent to which SBA obtained taxpayer information for applicants, and (3) the extent to which SBA and IRS data-sharing efforts reflected relevant leading practices in data sharing and interagency collaboration.

For the first objective, we reviewed legal requirements governing SBA and IRS sharing of taxpayer information, as well as memorandums of understanding (MOU) and other agency documentation pertaining to the data-sharing process for COVID-19 EIDL and the Disaster Loan Program. We also interviewed SBA and IRS officials about the data-sharing process and changes made to accommodate pandemic relief program needs.

For the second objective, we sought to determine the extent to which SBA obtained taxpayer information for applicants by analyzing available data. SBA provided two datasets. One dataset described more than 8 million documents SBA received from IRS or from applicants in response to its requests for tax information.[5] The second dataset covered more than 15 million COVID-19 EIDL applications submitted from March 2020 through May 2022 (as of June 2024).[6] We merged these datasets by application number and calculated the number and value of applications for which SBA received responses to its tax information requests.[7] We also analyzed the processing times for applications that SBA funded after approval.

For the third objective, we compared SBA and IRS practices to share taxpayer information against selected leading practices for data sharing and interagency collaboration.[8] We also interviewed SBA and IRS officials about potential alternatives to the current data-sharing process. See appendix I for additional information about our scope and methodology.

We conducted this performance audit from July 2024 to March 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

SBA’s Disaster Loan Program

SBA primarily supports small businesses through programs offering training, contracting help, and grants and loans. SBA’s Disaster Loan Program, created in 1953, offers low-interest loans to businesses, nonprofits, homeowners, and renters to help repair and rebuild damaged property and recover economic losses after a declared disaster. Most loans are made to individuals, households, or businesses to help repair and replace physical property.[9] The program also offers Economic Injury Disaster Loans to eligible small businesses and nonprofit organizations located in a disaster area to help meet financial obligations or cover regular and necessary operating expenses, such as payroll or rent.

Among other application requirements, Disaster Loan Program applicants must authorize IRS to release their tax information to SBA. SBA uses this information to assess applicants’ eligibility and repayment ability, verify applicants’ personal information, and estimate the extent of their economic loss.

COVID-19 EIDL Program

The COVID-19 EIDL program provided funds to small businesses from March 2020 through May 2022 to help them recover from the economic effects of the pandemic (see table 1). The CARES Act provided funds for SBA to establish this program, building on the existing Economic Injury Disaster Loan offered under the Disaster Loan Program.[10] According to the SBA Office of Inspector General (OIG), SBA approved over $377 billion in COVID-19 EIDL funding from March 2020 through May 2022, which was more than all disaster loan funding since SBA’s creation in 1953.[11]

Eligible businesses	·          Businesses with not more than 500 employees or meeting SBA size standards ·          Small agricultural cooperatives, Employee Stock Ownership Plans, tribal concerns, sole proprietorships, independent contractors, agricultural enterprises, and most private nonprofit organizations ·          Businesses established on or before January 31, 2020
Eligible expenses	Payroll, business rent, and certain mortgage and fixed debt payments
Repayment period	Up to 30 years
Interest rate	3.75 percent for businesses; 2.75 percent for nonprofits

Source: GAO analysis of Small Business Administration (SBA) information. | GAO‑26‑107682

Note: In March 2022, SBA deferred the first payment for loans to up to 30 months.

The COVID-19 EIDL program contained some programmatic elements that differed from the Disaster Loan Program’s Economic Injury Disaster Loans. For example, it included a grant component known as an advance, and eligibility was expanded to include more types of small businesses.[12] In addition, Congress initially allowed SBA to approve original loan applications based solely on applicants’ credit scores.

Congress also initially restricted SBA from requiring applicants to submit tax returns or tax transcripts for original (initial) loan applications, effectively prohibiting the agency from using taxpayer information to verify eligibility. According to the SBA OIG, this restriction reduced the accuracy of eligibility determinations.[13] Congress removed this restriction in late December 2020 and allowed SBA to use taxpayer information, and SBA began doing so in April 2021.[14] According to SBA officials, taxpayer information was key to verifying a business’s existence and revenues and for detecting fraud and mitigating improper payments.

SBA’s application process for COVID-19 EIDL had other controls and verification features. The agency introduced a new platform to process applications after determining that the existing system used for the Disaster Loan Program did not have the capacity to accommodate the volume of COVID-19 EIDL applications. We previously reported that this new platform automatically screened whether applicants met minimum credit score requirements, had open bankruptcies, and were delinquent on child support obligations, among other minimum eligibility requirements.[15] We also reported that the platform automatically declined applicants who did not meet minimum credit score requirements. Declined loan applicants could request that SBA reconsider their applications.

Applicants who passed the automatic screening were able to create an account and request a loan amount, up to their estimated economic injury or the program’s maximum loan limit. The initial $2 million maximum loan limit changed over the course of the program—first being lowered, then gradually raised—before returning to $2 million in October 2021.[16] Borrowers who initially received less than the maximum could request additional funding.

There were three types of COVID-19 EIDL applications:

·         Original (initial) loan applications. As noted above, the CARES Act initially prohibited SBA from obtaining taxpayer information from original loan applicants, but the Consolidated Appropriations Act, 2021, later removed the prohibition.

·         Reconsiderations and appeals. Loan applicants whose original applications were declined could ask SBA to reconsider their application. If a reconsideration was declined, the applicant could then pursue an appeal. SBA required applicants to provide their tax information for reconsiderations and appeals from the beginning of the program.[17]

·         Modifications. Approved borrowers could request additional funding or revised loan terms. SBA required tax information for modifications for additional funding from the beginning of the program.

GAO’s High Risk List

Since March 2021, we have included SBA’s emergency loan programs—including COVID-19 EIDL—on our High Risk List, due to a combination of limited program controls and the massive volume of loans and expenditures in a short period.[18] The High Risk List highlights federal programs vulnerable to waste, fraud, abuse, and mismanagement. SBA has made some progress in addressing continuing risks related to the program’s loans.[19] However, it has yet to address all material weaknesses in internal controls identified by its financial statement auditor. In addition, in February 2025, we added the federal government’s need to improve the delivery of federal disaster assistance to our High Risk List, in part due to the numerous challenges survivors faced receiving needed aid, including lengthy application review processes.

Legal Framework for Sharing Taxpayer Information

Federal taxpayer information consists of federal tax returns and return information that IRS possesses or controls.[20] This encompasses information received directly by IRS or obtained through an authorized secondary source, such as the Social Security Administration or another entity acting on IRS’s behalf.

Taxpayer information is confidential and protected under section 6103 of the Internal Revenue Code.[21] IRS may disclose such information only under certain circumstances, including to a taxpayer’s designee (such as accountant or lawyer) or to federal, state, or local agencies and nongovernmental entities.[22] In these instances, the shared information is still considered taxpayer information and must be protected from further disclosure.

Taxpayer information can be disclosed in different forms. For taxpayers and most third parties, IRS shares tax return transcripts that describe select line items from a tax return, along with any forms and schedules. For certain federal agencies, IRS has provided only the specific tax data variables needed to verify applicant information. For example, for federal student aid applications, IRS shares with the Department of Education only the tax data needed to verify the applicant’s identity and income.

Section 6103 enables IRS to disclose tax data in specific circumstances. These include:

·         Disclosure through taxpayer consent. Section 6103(c) permits IRS to disclose tax returns and tax information with taxpayers’ consent to do so.[23] Taxpayers can provide this consent by completing and signing a tax information request form (Form 4506-T or 4506-C).

·         Disclose for purposes other than tax administration. Section 6103(l) permits IRS to disclose tax information to specific agencies or programs for purposes other than tax administration.[24] This section lists the programs to which, and purposes for which, IRS is permitted to disclose specified taxpayer information directly.

SBA and IRS Established a Legal Framework and Processes for Sharing Taxpayer Information

SBA and IRS Obtained Treasury Approval and Entered Interagency Agreements to Share Taxpayer Information

Although COVID-19 EIDL began in March 2020, SBA was not authorized to require a loan applicant to submit tax returns until late December 2020, as previously mentioned. Receiving this authorization was important because taxpayer information was SBA’s primary tool for verifying applicant identity and preventing fraud in its other programs, according to SBA officials.[25] SBA officials also said that the initial prohibition on obtaining tax records resulted in greater fraud risks in the COVID-19 EIDL program. Aside from loan applicants, IRS is the only source from which SBA can obtain taxpayer information.

Between late December 2020, when SBA was authorized to use taxpayer information, and April 2021, when SBA implemented the use of taxpayer information for original loans, the agencies executed legal and administrative agreements, met administrative requirements, and overcame IT and other challenges to processing data requests.

IRS Obtained Treasury Approval to Share Taxpayer Information with SBA

SBA lacked legal authority to obtain taxpayer information directly from IRS without taxpayer consent.[26] To share taxpayer information with SBA, IRS obtained approval from the Department of the Treasury’s Office of Tax Policy to share taxpayer information with SBA with loan applicants’ consent, according to IRS officials. This authority was predicated on SBA obtaining completed and signed IRS Form 4506-T or 4506-C (tax information request forms) from applicants, which constituted consent to IRS releasing their information to SBA.[27]

SBA and IRS Formalized Data Sharing

SBA and IRS also implemented a data-sharing MOU (and subsequent addendums) for COVID-19 EIDL. According to IRS officials, they used a standard template, based on interagency agreements with other agencies, which enabled them to finalize the initial MOU within a few days. SBA and IRS signed the initial MOU on March 1, 2021. They then signed addendums revising the MOU on October 4, 2021; October 6, 2021; December 14, 2022; and June 13, 2023.

The MOU outlined the legal authority for taxpayer information sharing, its purpose, agency duties and responsibilities, information safeguards, and the specific tax data shared.

·         Statutory authority. The MOU cited the provision under section 6103(c) that allows IRS to share taxpayer information with SBA upon receiving taxpayers’ signed consent.[28]

·         Purpose. SBA could use the taxpayer information to verify applicant eligibility and the accuracy of application information. According to IRS officials, this section prevented SBA from using the information for other purposes beyond loan processing, such as conducting program-wide analyses to identify potential indicators of fraud or improper payments.

·         Duties and responsibilities. The MOU detailed data-sharing procedures. Generally, SBA electronically faxed data requests and signed taxpayer consent forms to IRS. IRS then sent requested taxpayer information to an electronic mailbox that SBA accessed to retrieve the data. In addition, the MOU stipulated, and SBA officials confirmed, that IRS generally would provide the requested taxpayer information within 5 business days.

·         Information safeguards. The MOU required SBA to establish protections to prevent unauthorized access or disclosure, including secure storage, access restrictions (authorized agency staff and contractors), and training on confidentiality rules.[29]

·         Tax data variables. SBA and IRS agreed to share only the specific taxpayer information SBA needed to verify COVID-19 EIDL eligibility and application information. An appendix listed the specific tax data variables for tax years 2018 and 2019 that IRS agreed to share, including year of filings, types of tax forms, and income and expense amounts.[30]

SBA Reimbursed IRS for Data-Sharing Costs

In 2021, SBA began reimbursing IRS for the costs related to obtaining taxpayer information for COVID-19 EIDL and two other pandemic assistance programs (Restaurant Revitalization Fund and Shuttered Venue Operators Grant) (see table 2).[31] Under the 2021 MOU, SBA agreed to cover the cost of IRS services, and IRS would provide SBA with its annual cost estimates. These included estimates for cost of personnel administering the data-sharing program, processing tax information requests, and maintaining data security. SBA officials said they needed to seek budget approval to pay IRS. Although COVID-19 EIDL ended in May 2022, SBA continued to obtain taxpayer information to verify borrower eligibility prior to processing loan disbursements or servicing actions.

	Fiscal year				Totals
	2021	2022	2023	2024
Reimbursements for COVID-19 Economic Injury Disaster Loan (EIDL) and two other SBA pandemic relief programsa	$1,048,155	$626,629	—-	—-	$1,674,784
Reimbursements for COVID-19 EIDLb	—-	—-	$99,573	$39,238	$138,811
All reimbursements					$1,813,595

Source: Small Business Administration (SBA). | GAO‑26‑107682

^aFor fiscal years 2021 and 2022, SBA also made reimbursements to the Internal Revenue Service for two other pandemic relief programs—the Restaurant Revitalization Fund and the Shuttered Venue Operators Grant. SBA was unable to provide separate reimbursement data for each program.

^bFor fiscal years 2023 and 2024, SBA continued to obtain taxpayer information to verify borrower eligibility prior to disbursing previously approved loans or processing requests for loan deferments or modifications.

SBA and IRS Made Process Enhancements to Share Taxpayer Information but Still Performed Manual Reviews

SBA and IRS Refined Their Processes and IT

In response to the demand for COVID-19 EIDL, SBA and IRS streamlined their process for sharing taxpayer information and IRS enhanced IT components. For instance, in March 2021, SBA and IRS formally agreed to share taxpayer information via specific tax data variables instead of entire tax transcripts.[32] The SBA OIG also reported that SBA took steps to fully implement the use of tax information for COVID-19 EIDL, as outlined below.[33]

·         January 7, 2021: SBA’s contractors modified the loan application system to upload taxpayer information received from IRS to applicants’ loan files.

·         February 19, 2021: Contractors added functionality for the system to automatically generate an IRS form for applicants to consent to IRS disclosing their taxpayer information to SBA.

·         April 21, 2021: SBA obtained approval from the Office of Management and Budget to revise the COVID-19 EIDL application to include applicant consent for IRS to share taxpayer information.

·         April 28, 2021: SBA fully implemented the requirement to obtain taxpayer information.

IRS officials said that once the MOU was signed, it created a new interface in its data system to automate retrieval of specific tax data variables. According to IRS officials, automated retrieval reduced IRS processing times and improved response times to SBA.

SBA and IRS Manually Verified Taxpayer Information

Although the data-sharing processes for COVID-19 EIDL incorporated some automation, both agencies still performed manual reviews. The MOU required these reviews to ensure taxpayers had given permission to IRS to disclose their taxpayer information to SBA (see fig. 1). Before faxing requests to IRS, SBA was to manually verify that applicants had completed and signed the IRS tax information request forms. According to IRS officials, SBA could fax requests for up to 35 applicants at a time.[34] The MOU also required IRS to manually verify the tax request information. If IRS was unable to validate the information or did not have such records, it would reject the request and provide SBA with a reason for the rejection.[35]

Reviews to ensure that the tax information matched the loan applicant were important because, as previously mentioned, taxpayer information is considered confidential and SBA used applicants’ tax information to verify eligibility and accuracy of loan applications. These verification checks served as one control to help SBA detect potential fraud and mitigate improper payments. IRS officials also recognized that taxpayer information could help SBA identify fraudulent loan applications and mitigate improper payments.

IRS and SBA Initially Experienced Backlogs in Sharing Taxpayer Information

After SBA began requiring taxpayer information for original COVID-19 EIDL loan applications in April 2021, IRS backlogs created challenges in obtaining this information. Using SBA-provided data, we found that average processing times for approved original loan applications increased after March 2021.[36] According to our analysis of SBA’s data, SBA processed applications received from January through March 2021 on average within 5 weeks and processed applications received from April through August 2021 on average within 9–12 weeks.[37] In addition to IRS-related delays, other factors that could have contributed to increased processing times include an increased volume of modification applications and SBA launching other pandemic relief programs.

IRS Backlogs in Processing Taxpayer Information

IRS experienced delays in processing taxpayer information during the period COVID-19 EIDL operated. According to the Treasury Inspector General for Tax Administration, during 2020–2023, IRS had significant backlogs in processing 2019 tax returns and taxpayer information requests from multiple agencies and programs, including COVID-19 EIDL.[38] For example, the backlog of unprocessed annual tax returns at year-end grew from 183,000 in 2019 to over 3.5 million in 2020 and over 4.6 million as of October 2021.

IRS officials said the cause of the backlog was pandemic-related evacuations and social-distancing requirements at processing centers. They also said that in preparation for closing one center in September 2021, IRS had reassigned work to another center starting in July 2020. However, the Inspector General reported that IRS had not effectively reassigned workload across the processing centers to address backlogs in processing taxpayer information requests.[39]

According to the Inspector General, IRS began addressing these backlogs in 2020 by expanding telework and providing incentive pay.[40] IRS officials also said they developed a system interface to automate tax information retrieval, which improved timeliness in processing information requests. In 2022, IRS took further action to address these backlogs by shifting workloads across processing centers, transitioning from paper to electronic processing of requests, and creating an inventory system to estimate workloads and shift staffing.[41]

According to agency officials, IRS did not track processing times for SBA’s COVID-19 EIDL taxpayer information requests until October 2021. By that time, according to IRS officials, IRS fulfilled SBA’s requests within 7 business days. By mid-December 2021, according to IRS officials, they met the 5-business-day processing target stipulated in the MOU and had cleared the SBA-related COVID-19 EIDL backlog.

SBA Issues with Obtaining Taxpayer Information

Due to IRS backlogs, SBA modified how it obtained taxpayer information for COVID-19 EIDL applications. In April 2021, when SBA began requiring taxpayer information for original loan applications, IRS often was unable to provide the data, according to the SBA OIG.[42] To address this problem, in May 2021, SBA instructed its loan officers to ask for copies of applicants’ 2019 income tax returns. In August 2021, SBA required applicants to include copies of their 2019 income tax returns as part of their applications, according to SBA officials. However, the SBA OIG reported in September 2022 that SBA did not always obtain tax returns from applicants and that some loans were approved without taxpayer information or for ineligible applicants.[43] In response to the SBA OIG report, SBA agreed to corrective actions to review and address the loans identified by the SBA OIG in its audit.[44]

We previously reported that SBA approved a COVID-19 EIDL application flagged for lack of taxpayer information and other reasons in December 2021, after discussions with the applicant and the receipt of additional documentation.[45] This applicant later pleaded guilty to fraud, was sentenced to prison, and ordered to repay the loan.

In addition, we previously reported that SBA had to modify application verification and documentation requirements for the Restaurant Revitalization Fund and select Shuttered Venue Operators Grants due to IRS taxpayer information processing delays.[46] These programs operated roughly between April and August 2021, the same period in which SBA started using tax data for COVID-19 EIDL.

SBA and IRS Adapted COVID-19 EIDL Processes to the Disaster Loan Program

For the Disaster Loan Program, SBA directly administers the application process including the process for obtaining applicant’s taxpayer information.[47] As SBA also does not have the authority to obtain taxpayer information directly from IRS for the Disaster Loan Program without taxpayer consent, it uses a process similar to COVID-19 EIDL to obtain this information from IRS. Applicants must complete and sign IRS Form 4506-C (tax information request) to consent to IRS disclosing their information to SBA and then SBA and IRS must manually process these forms.[48]

In recent years, SBA and IRS have taken steps to enhance data sharing for the Disaster Loan Program. For example, like COVID-19 EIDL, SBA and IRS agreed to share specific tax data variables (instead of tax transcripts) and for SBA to reimburse IRS for the cost of providing taxpayer information. Additionally, in the most recent MOU for the Disaster Loan Program, SBA and IRS agreed to improve data and privacy safeguards by allowing IRS to periodically review SBA’s safeguards for taxpayer information.[49] SBA also launched a new application platform that leverages the data sharing process used for the COVID-19 EIDL program.

Tax data variables. Before the pandemic, IRS provided SBA with taxpayer information in the form of tax transcripts to verify Disaster Loan Program applicant data, according to IRS officials. Like for the COVID-19 EIDL process, IRS and SBA revised this approach to share only specific tax data variables instead of tax transcripts.[50] The tax data variables generally pertained to taxpayer identification, revenue, and expenses, or IRS rejection codes when it could not process a data request. According to SBA and IRS officials, the use of tax data variables benefited both agencies by speeding up the transfer of taxpayer information and by improving the security of taxpayer data by eliminating disclosure of unnecessary tax data.

Reimbursements. Beginning in fiscal year 2023, SBA was required to reimburse IRS for the costs of reviewing tax data requests and creating an automation tool to retrieve tax data for the Disaster Loan Program. SBA reimbursed IRS almost $300,000 for these costs in fiscal years 2023 and 2024 (see table 3).

	Fiscal year		Total
	2023	2024
All reimbursements	$60,473	$230,763	$291,236

Source: Small Business Administration (SBA). | GAO‑26‑107682

Note: The requirement for SBA to reimburse the Internal Revenue Service for these costs took effect on October 1, 2022.

Process enhancements. In 2024, SBA launched the Unified Lending Platform, a new application system for the Disaster Loan Program. According to SBA officials, this platform was based in part on the COVID-19 EIDL platform and is expected to expedite the application process and reduce decision wait times.[51]

The platform includes an online portal through which disaster loan applicants complete and submit their applications and provide supporting documentation, including tax information request forms (IRS Form 4506-C).[52] According to SBA documents and officials, after an application is submitted, the platform automatically screens the applicant’s information against third-party data sources to verify applicant identity, check credit history, and identify potential fraud indicators.

SBA then pauses the automated review process while it requests and waits for IRS to provide tax information. SBA officials said that IRS typically meets the processing requirement of 3 business days, as stated in the MOU, to respond to SBA requests for tax information. Once received, the platform uploads this information to the applicant files, according to SBA officials.

Finally, SBA staff are to manually review the application and decide if the applicant is qualified to receive a loan. After approval but before disbursement, staff are also to conduct additional applicant screening, such as checks against SBA loan history and Treasury’s Do Not Pay service.[53]

Most Loans SBA Approved Did Not Require Taxpayer Information

SBA Approved Most COVID-19 EIDL Loans Before It Required Taxpayer Information

As of June 2024, SBA approved almost 3.7 million loans totaling about $360 billion, according to SBA’s COVID-19 EIDL data (see fig. 2).[54] SBA approved most of the loans during the first year of the program, during which tax information was not required to approve loan applications.[55]

Of the almost 3.7 million loans, about 1.8 million or about 48 percent, had evidence of associated tax request-related documents.[56] Those loans accounted for about 73 percent of the total COVID-19 EIDL funding (about $261 billion), which exceeds their 48 percent share of total approved loans. This is largely because about half of these loans were later modified to increase loan amounts.

About half of the approved loan files we analyzed contained documentation indicating SBA received responses to its requests for taxpayer information.

Note: We used SBA data as of June 2024 to calculate the number and value of approved loans (original loans, reconsiderations, and appeals) with and without modifications for which SBA received responses to its requests for tax information. These data do not include loans to U.S. territories or reflect whether approved loans were later cancelled.

SBA Cannot Readily Determine If It Got Required Taxpayer Information for COVID-19 EIDL, but Can for Ongoing Disaster Loan Program

Taxpayer information was required for some COVID-19 EIDL applications to be eligible for funding. But SBA cannot determine whether this information was obtained without manually reviewing loan files due to limitations in its data systems and the way the systems saved taxpayer information. COVID-19 EIDL policy required SBA to obtain taxpayer information from applicants who originally applied after April 2021 as well as from borrowers who requested additional funding (modifications) or certain reconsiderations and appeals of denied loans, regardless of when they originally applied.

To obtain taxpayer information, SBA submitted requests to IRS and applicants. SBA saved responses from both sources as electronic documents (portable document formats or PDFs), according to SBA officials.[57] SBA used a naming convention for these documents that reflected the type of taxpayer information requested.[58] But the resulting responses did not always contain actual taxpayer information. For example, when IRS could not process a request or no tax records existed, it would send a message indicating it could not provide taxpayer information.

Loan officers accessed these documents through the applicant’s file in the COVID-19 EIDL platform. However, the platform did not have a field for officers to indicate whether the documents actually included taxpayer information. In addition, we found that SBA declined more than 60,000 of the applications with tax request-related documents citing “No IRS records found” as a reason—indicating that some tax request-related documents did not include actual taxpayer information.

Using SBA’s data, we found that SBA had evidence that it had obtained tax request-related documents for about 4.7 million applications. However, due to limitations in SBA’s systems, including the lack of an indicator or field within the platform to track whether taxpayer information was obtained, we could not determine the extent to which these documents contained actual taxpayer information. As needed, SBA can access and view tax request-related documents for individual COVID-19 EIDL applications through its platform.

Moreover, the COVID-19 EIDL program is now closed, and its platform is not being used for new applications or other programs. SBA officials also said that they have been conducting a reconciliation of the program’s loan population to ensure it is complete and accurate and that loans were disbursed to eligible recipients. The reconciliation efforts are being undertaken to help address COVID-19 EIDL program deficiencies that SBA’s financial statement auditor identified.[59]

The Disaster Loan Program uses a process similar to COVID-19 EIDL to collect and store taxpayer information, but it does not have some of the limitations described above. According to SBA officials, the Disaster Loan Program’s Unified Lending Platform does not have an indicator or a field to track if taxpayer information was obtained for an applicant.

However, SBA has additional steps to ensure this information is obtained.[60] For example, according to SBA officials, if IRS cannot provide taxpayer information or does not respond to SBA’s request for taxpayer information, the Unified Lending Platform automatically alerts SBA staff to review those applications. According to the Disaster Loan standard operating procedures, if taxpayer information cannot be obtained for an application, SBA is to withdraw it from consideration. For SBA to reconsider the application, applicants must reauthorize SBA to receive taxpayer information via a signed IRS Form 8821.

SBA and IRS Generally Followed Leading Practices for Data Sharing, but Opportunities for Improvement Remain

SBA and IRS Actions Followed Most Leading Practices, but Agencies Have Not Made Progress to Fully Automate Data Sharing

SBA and IRS actions to share taxpayer information for COVID-19 EIDL and the Disaster Loan Program generally followed relevant leading practices for interagency data sharing and collaboration. More specifically, their processes for sharing taxpayer information under these two programs generally followed two relevant recommendations (leading practices) from a 2022 report by the Federal Chief Data Officer Council (see fig. 3).[61]

Note: We assessed the extent to which SBA and IRS activities for COVID-19 EIDL and the Disaster Loan Program followed relevant recommendations of the Federal Chief Data Officer Council. We determined that the agencies generally followed a recommendation if their processes reflected most or all the relevant considerations. We determined that the agencies partially followed a practice if its processes reflected some of the relevant key considerations. Federal Chief Data Officer Council, Data Sharing Working Group, Findings and Recommendations (Washington, D.C.: 2022).

·         Expedited agreement process. According to IRS officials, they use a standardized template to develop interagency MOUs to ensure all Internal Revenue Code and IRS requirements for privacy and data security are addressed.[62] They used this template to develop the MOUs for the COVID-19 EIDL program and the Disaster Loan Program. IRS officials also told us that using the template enabled IRS and SBA to finalize the MOU for COVID-19 EIDL within a few days.

·         Improved data trustworthiness. The MOUs describe data quality requirements, such as the data-sharing validation requirements described earlier. The Disaster Loan MOU also requires SBA to conduct monthly reviews and provide IRS an annual report on SBA’s electronic signature process. We obtained a sample of SBA’s monthly reviews and the annual report it sends to IRS to confirm these steps were completed by the agencies. As previously mentioned, in the most recent MOU, SBA and IRS agreed to improve data and privacy safeguards by allowing IRS to periodically inspect SBA’s safeguards for taxpayer information.[63]

We also found that SBA and IRS actions in sharing taxpayer information generally followed four relevant leading practices for interagency collaboration and partially followed three more (see fig. 4).[64]

Note: We assessed the extent to which SBA and IRS data-sharing activities for COVID-19 EIDL and the Disaster Loan Program followed selected leading practices for interagency collaboration outlined in GAO‑23‑105520. We determined that agency processes or activities generally followed a practice if those actions reflected most or all the key considerations and partially followed a practice if its processes reflected some of the relevant key considerations.

Specifically, SBA and IRS actions generally followed four of the seven relevant leading practices:

·         Bridge organizational cultures. Through the MOU process, SBA and IRS established compatible policies to operate across agency boundaries and agreed on common terminology and definitions.

·         Identify and sustain leadership. SBA and IRS share leadership for developing and revising the MOUs that govern the data-sharing process.

·         Clarify roles and responsibilities. The MOUs detail each agency’s roles and responsibilities for data sharing, and the agencies make decisions through the renegotiation of MOUs.

·         Develop and update written guidance and agreements. SBA and IRS documented their agreed approaches to sharing taxpayer information through a series of MOUs, which specify the dates on which the agreements take effect and expire.

SBA and IRS actions partially followed three of the seven relevant leading practices.

·         Define common outcomes. The agencies agreed to share taxpayer information to mitigate improper payments and fraud risk in SBA’s direct lending programs. The current manual process meets this desired short-term outcome. However, manual processing requires staff and time to collect, review, and transmit information between agencies and may be susceptible to backlogs. Both agencies agree that fully automated data sharing—in which their systems would directly share specific tax data variables in near real-time—would be more efficient. IRS officials said this would require SBA to have statutory authority allowing it to receive taxpayer information without first obtaining taxpayer consent. This authority also would eliminate the need for applicants to complete IRS consent forms and for related manual processing of these forms.[65] Although IRS officials have told us that they support SBA gaining this legal authority, SBA does not currently have it and has not requested it from Congress. As a result, the agencies have not progressed toward achieving the long-term outcome that both want—fully automated data sharing.

·         Ensure accountability. SBA and IRS collaborate to ensure accountability in their current process—for instance, by monitoring data requests and communicating about incomplete or incorrect paperwork. They can also update procedures through the Disaster Loan Program MOU, which is usually renegotiated every 3 years.[66] However, while the agencies agree that data sharing could be more efficient if it were fully automated, they have not developed methods to monitor, assess, or communicate progress, or assigned accountability towards achieving it.

·         Leverage resources and information. SBA bears the costs of sharing taxpayer information and reimburses IRS annually. The agencies introduced tools and technologies to manage the large volume of COVID-19 EIDL applications, many of which SBA and IRS adapted for the Disaster Loan Program. However, because of the lack of legal authority, the agencies have not yet leveraged IRS’s existing technologies to further automate data sharing.

Opportunities Exist to Improve the Efficiency of Tax Data Sharing

SBA has opportunities to improve the efficiency of tax data sharing, including (1) pursuing legal authority to obtain taxpayer information directly from IRS, which would eliminate the need to manually process consent forms; and (2) implementing technologies that could improve data sharing.

As noted earlier, SBA has not pursued the legal authority that would allow it to directly obtain taxpayer information from IRS—an action that would require amending section 6103(l) of the Internal Revenue Code. SBA officials cited two key reasons for not seeking this authority. First, they expressed a preference for a more general legislative amendment that would cover a wider range of potential future changes to SBA programs. They said this would avoid the need for repeated congressional action if program requirements change. However, due to the confidential nature of taxpayer information, amendments to section 6103(l) have generally specified for which programs and purposes IRS may disclose taxpayer information and the type of tax data needed.[67] Second, SBA officials stated a preference to continue obtaining applicant consent before accessing taxpayer information. However, even if a section 6103(I) amendment were to eliminate IRS’s requirement for consent, SBA could still choose to obtain applicant consent, such as by integrating it into the loan application process.[68]

Technological improvements also could help reduce reliance on manual processing of tax information request forms, according to SBA and IRS. Agency officials told us they have begun to explore technological improvements that could support more efficient data sharing while maintaining the current requirement for applicant consent. However, officials were not able to provide details on the technologies under consideration.

Office of Management and Budget Circular No. A-129 requires federal credit programs to be designed and administered effectively and efficiently.[69] The circular also states that agencies can propose new or revised legislation to meet these goals. And as noted earlier, a leading practice for interagency collaboration is to collaborate in leveraging information, such as using technology to share relevant data across agencies.

By taking steps to improve the efficiency of data sharing with IRS—such as pursuing statutory authority for direct access or implementing new technologies—SBA could reduce administrative burden and enhance responsiveness, especially during unusually large surges in demand. Furthermore, improvements introduced for the Disaster Loan Program could be leveraged by SBA for future emergency programs to help mitigate fraud and improper payments risks in those programs.

Conclusions

IRS taxpayer information is an important tool for helping SBA assess applicant eligibility and mitigate financial risk in its disaster assistance programs. The inability to use these data during the first year of the COVID-19 EIDL program may have increased the risk of fraud and improper payments.

Although SBA applied data-sharing enhancements from the temporary COVID-19 EIDL program to its ongoing Disaster Loan Program, additional opportunities for improvement remain. These include obtaining legal authority for direct access to taxpayer information to support eligibility determinations. Obtaining this authority would be an important step toward more fully automating data sharing with IRS, enabling near-real time data sharing. Another potential opportunity is introducing new technologies to reduce manual processing. By taking steps to improve the efficiency of data sharing with IRS, SBA could help lower its administrative burden, be better positioned to respond to future disasters or emergencies, and help prevent fraud, waste, and abuse in its disaster response programs.

Recommendation for Executive Action

The Administrator of SBA should take steps to improve the efficiency of data sharing with IRS for the Disaster Loan Program. These steps could include seeking statutory authority for direct access to tax data under section 6103(l) of the Internal Revenue Code or implementing new technologies to reduce manual processing. (Recommendation 1)

Agency Comments

We provided a draft of this report to IRS and SBA for review and comment. IRS did not have any comments on the report. SBA provided written comments, which are reproduced in appendix II. SBA also provided technical comments, which we incorporated as appropriate.

SBA neither agreed nor disagreed with our recommendation but stated that it anticipates addressing it by October 31, 2027, when the Disaster Loan MOU is renewed with IRS. Further, SBA stated its support for better access to data through statutory change or improved technology that would reduce instances of fraud.

We are sending copies of this report to the appropriate congressional committees and to the Administrator of SBA and Acting Commissioner of IRS. This report will also be available at no on GAO’s website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at lafountainc@gao.gov. Contact points for our Office of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

Courtney LaFountain
Director, Financial Markets and Community Investment

This report examines (1) the processes and agreements that the Small Business Administration (SBA) and the Internal Revenue Service (IRS) established to share tax information for the COVID-19 Economic Injury Disaster Loan (EIDL) program; (2) available data on the extent to which SBA obtained taxpayer information for applicants; and (3) the extent to which SBA and IRS data-sharing efforts reflected relevant leading practices in data sharing and interagency collaboration.

Factors Affecting the Sharing of Tax Data

For the first objective, we analyzed relevant statutes, including those authorizing and amending the COVID-19 EIDL program. We also analyzed the relevant provisions of the Internal Revenue Code to identify ways that IRS can legally share taxpayer information with federal agencies and other entities.

We reviewed agency guidance, procedures, and other documentation related to COVID-19 EIDL, the Disaster Loan Program, and SBA and IRS processes for sharing of tax data under those programs. We also reviewed legal agreements (memorandums of understanding and addendums) between SBA and IRS that governed the terms and processes for sharing tax information for COVID-19 EIDL and the Disaster Loan Program. For the Disaster Loan Program, we reviewed memorandums of understanding in effect before and after the pandemic to identify changes in the data-sharing process.

We also reviewed reports from the SBA Office of Inspector General and the Treasury Inspector General for Tax Administration, including those pertaining to IRS’s challenges in sharing tax information during the pandemic and actions taken by SBA and IRS to address them. In addition, we reviewed SBA information on reimbursements paid to IRS for sharing tax information for COVID-19 EIDL (which also included amounts for other pandemic assistance programs) and the Disaster Loan Program.

We interviewed officials at SBA and IRS on procedures for sharing tax information for these programs, including changes made to handle the high volume of COVID-19 EIDL applications.

SBA’s Collection of Taxpayer Information

For the second objective, we analyzed two datasets we received from SBA to help us determine the extent to which SBA obtained taxpayer information for loan applicants. To assess the reliability of these datasets, we reviewed related data documentation, interviewed and obtained written responses from SBA officials, performed electronic data tests, and reviewed the code SBA used to extract data related to applicant taxpayer information from its system.

·         Applicant taxpayer information. SBA provided data describing more than 8 million documents it received from IRS or applicants in response to its requests for tax information. We determined the data were sufficiently reliable for reporting the number of responses SBA received to its requests and the sources of those responses, as well as the date those responses were received. But due to limitations in SBA’s data systems, we determined that the data were not sufficiently reliable for describing the extent to which tax information was obtained or whether the source data included both tax and other information.

·         COVID-19 EIDL application data. SBA also provided data on more than 15 million COVID-19 EIDL applications submitted from March 2020 through May 2022, as of June 2024.[70] We determined the data were sufficiently reliable for describing application characteristics such as type (original loan, reconsideration, appeal, or modification), status, dates SBA received and processed applications, loan amount, and decline reasons. But based on information provided by SBA officials, we determined the data were not sufficiently reliable for describing the total number of applications, number and value of loans cancelled after approval, or total value of funds disbursed for the program.[71]

We merged these datasets by application number and then analyzed the combined data.[72] Within the limits of what we considered reliable for reporting, we calculated the number and value of approved loans (original loans, reconsiderations, and appeals) and loan modifications for which SBA received responses to its requests for tax information. We also calculated the number and value of applications by outcome (approved, declined, withdrawn, and in-process). We also analyzed the processing times for approved original loan applications that SBA funded by comparing the date the application was submitted to the date it was approved. We then used these data to assess how processing times changed before and after SBA required taxpayer information for original loans.

Extent to Which Data-Sharing Reflected Leading Practices

For the third objective, we first identified relevant criteria by reviewing federal and GAO reports with leading practices that pertained to data-sharing and interagency collaboration.

·         For data-sharing, we selected a 2022 report from the Federal Chief Data Officer Council Data Sharing Working Group, which examined data-sharing needs across federal agencies and included recommendations to address identified challenges.[73] We further refined our criteria by selecting two of the report’s four recommendations, based on their applicability to our scope.[74]

·         For interagency collaboration, we selected GAO’s framework on interagency collaboration, which includes eight leading practices for effective collaboration.[75] We selected seven of these practices, based on their applicability to our scope.

After identifying the criteria, we assessed SBA and IRS data-sharing processes and actions to determine the extent to which actions reflected the recommendations and leading practices. We scored our assessment using a three-point scale: generally followed, partially followed, or did not follow.

We also examined the extent to which the SBA IRS data-sharing process and the manual processing of tax information request forms for the Disaster Loan Program aligned with agencies’ responsibilities for managing federal credit programs efficiently.[76] Additionally, we interviewed SBA and IRS officials about potential alternatives to the current data-sharing process.

We conducted this performance audit from July 2024 to March 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO Contact

Courtney LaFountain, LaFountainC@gao.gov

Staff Acknowledgments

In addition to the contact above, Andrew Pauline (Assistant Director), Colleen Moffatt Kimer (Analyst in Charge), Jill Lacey, Kun-Fang (K.F.) Lee, Ying Long, Alberto Lopez, Marc Molino, Barbara Roesmann, and Farrah Stone made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us