GAO-26-107682: SBA Should Make IRS Data Sharing More Efficient

Summary

U.S. Government Accountability Office report GAO-26-107682, Disaster Assistance: SBA Should Take Steps to Make Data Sharing with IRS More Efficient, a report to congressional committees dated March 2026, with a letter dated March 3, 2026. The report states that during the first year of the COVID-19 Economic Injury Disaster Loan program SBA was statutorily prohibited from requiring taxpayer information and that SBA began requesting tax data from the IRS in April 2021. It states that GAO analyzed SBA data on almost 3.7 million approved loans totaling about $360 billion, about half of which had tax-related documents in their application records. GAO recommends that SBA take steps to improve the efficiency of data sharing with IRS for the Disaster Loan Program, and SBA neither agreed nor disagreed with the recommendation.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

DISASTER ASSISTANCE

SBA Should Take Steps to Make Data Sharing with
IRS More Efficient

Report to
Congressional Committees

March 2026

GAO- 26-107682

United
States Government Accountability Office

Highlights

A report to congressional committees.

For more information, contact: Courtney
LaFountain at LaFountainC@gao.gov .

What GAO Found

During the first year of the COVID-19 Economic Injury
Disaster Loan (COVID-19 EIDL) program, the Small Business Administration (SBA)
was statutorily prohibited from requiring taxpayer information to verify
applicant eligibility and application details. In April 2021, after receiving
authorization, SBA began requesting tax data from the Internal Revenue Service
(IRS).

SBA and IRS established a legal framework and enhanced
processes for sharing tax data. The agencies approved an administrative
agreement for the COVID-19 EIDL program that identified the tax information IRS
would provide to SBA. To process the large volume of requests, both agencies
upgraded IT system components and implemented process changes, including for
obtaining applicants’ consent to access their tax information. However, IRS
backlogs led SBA to request taxpayer information from some applicants directly.

SBA and IRS
Data-Sharing Process for COVID-19 EIDL Program

GAO analyzed SBA COVID-19 EIDL data on almost 3.7 million
approved loans totaling about $360 billion. About half of the loans had
tax-related documents in their application records and these loans accounted
for about 73 percent of COVID-19 EIDL funding (about $261 billion). But some
tax-related documents may not have contained actual tax data (i.e., they
contained IRS messages that tax records were not available).

SBA and IRS actions to share data for COVID-19 EIDL and the
ongoing Disaster Loan Program (which uses tax data for similar purposes)
generally reflected relevant leading practices for data sharing and interagency
collaboration. For example, the agencies conducted periodic data quality
control reviews and documented roles and responsibilities.

SBA does not have the statutory authority to receive tax
information from IRS without the loan applicant first providing consent through
tax request forms. Both agencies manually verify these forms, a process that
requires time and staff resources and carries the risk of backlogs or delays.
The challenges could be mitigated if SBA were authorized to receive taxpayer
information directly from IRS through an amendment to section 6103(l) of the
Internal Revenue Code. SBA and IRS have begun to explore opportunities for
technological improvements that could introduce efficiencies. By taking steps
to improve the efficiency of tax data sharing for the Disaster Loan Program,
SBA would be better positioned to leverage existing federal data to serve
applicants during future disasters and emergencies and to prevent fraud, waste,
and abuse.

Why GAO Did This
Study

From March 2020 through May 2022, the temporary COVID-19
EIDL program assisted small businesses and nonprofits affected by the pandemic.
SBA’s ongoing Disaster Loan program, which offers similar loans, continues to
assist businesses and nonprofits affected by disasters. Since March 2021,
COVID-19 EIDL has been on GAO’s High Risk List due to control deficiencies that
make it susceptable to improper payments and fraud.

The explanatory statement accompanying the Further
Consolidated Appropriations Act, 2024, includes a provision for GAO to examine
SBA and IRS data sharing for COVID-19 EIDL. This report examines (1) SBA and
IRS processes for sharing tax information, (2) available data on the extent to
which SBA obtained this information, and (3) the extent to which the agencies’
data sharing reflected relevant leading practices.

GAO reviewed laws, regulations, and agency agreements for
sharing tax data and analyzed application-level COVID-19 EIDL data covering the
full application period (March 2020–May 2022). GAO also assessed the agencies’
data-sharing process against leading practices and interviewed SBA and IRS
officials.

What GAO Recommends

GAO recommends that SBA take steps to improve the
efficiency of data sharing with IRS for the Disaster Loan Program, such as by
seeking statutory authority for direct access to tax data or by implementing
new data-sharing technologies. SBA neither agreed nor disagreed with the
recommendation but identified plans to address it.

Abbreviations

COVID-19 EIDL | COVID-19 Economic Injury
 Disaster Loan
IRS | Internal Revenue Service
MOU | memorandum of understanding
OIG | Office of the Inspector General
PDF | portable document format
SBA | Small Business Administration

This is a work of the U.S. government and is not
subject to copyright protection in the United States. The published product may
be reproduced and distributed in its entirety without further permission from
GAO. However, because this work may contain copyrighted images or other material,
permission from the copyright holder may be necessary if you wish to reproduce
this material separately.

Letter

March 3, 2026

The Honorable Bill Hagerty Chair The Honorable Jack Reed Ranking Member Subcommittee on Financial Services and General Government Committee on
Appropriations United States Senate

The Honorable Dave Joyce Chairman The Honorable Steny Hoyer Ranking Member Subcommittee on Financial Services and General Government Committee on
Appropriations House of Representatives

Federal agencies sometimes use taxpayer information to
verify applicant identities, incomes, and business earnings for programs. The
CARES Act provided funding to the COVID-19 Economic Injury Disaster Loan
(COVID-19 EIDL) program in March 2020 to aid small businesses affected by the
pandemic. [1] However, the act prohibited Small Business Administration (SBA) from requiring
applicants to submit tax returns (referred to hereafter as taxpayer
information), which limited SBA from using this information to verify applicant
eligibility and application accuracy. [2]

SBA subsequently was authorized to use taxpayer
information by the Consolidated Appropriations Act, 2021, and began doing so in
April 2021. [3] However, the act did not provide the Internal Revenue Service (IRS) authority
to share taxpayer information directly with SBA, so SBA had to obtain loan
applicants’ consent for IRS to release their tax information. SBA uses a
similar process to obtain taxpayer information for its ongoing Disaster Loan
Program.

The explanatory statement accompanying the Further
Consolidated Appropriations Act, 2024, includes a provision for GAO to examine
the tax data-sharing process between SBA and IRS for the COVID-19 EIDL program. [4] This report examines (1) the
processes and agreements SBA and IRS established to share taxpayer information,
(2) available data on the extent to which SBA obtained taxpayer information for
applicants, and (3) the extent to which SBA and IRS data-sharing efforts
reflected relevant leading practices in data sharing and interagency
collaboration.

For the first objective, we reviewed legal requirements
governing SBA and IRS sharing of taxpayer information, as well as memorandums
of understanding (MOU) and other agency documentation pertaining to the
data-sharing process for COVID-19 EIDL and the Disaster Loan Program. We also
interviewed SBA and IRS officials about the data-sharing process and changes
made to accommodate pandemic relief program needs.

For the second objective, we sought to determine the
extent to which SBA obtained taxpayer information for applicants by analyzing
available data. SBA provided two datasets. One dataset described more than 8
million documents SBA received from IRS or from applicants in response to its
requests for tax information. [5] The second dataset covered more than 15 million COVID-19 EIDL applications
submitted from March 2020 through May 2022 (as of June 2024). [6] We merged these datasets by
application number and calculated the number and value of applications for
which SBA received responses to its tax information requests. [7] We also analyzed the processing times
for applications that SBA funded after approval.

For the third objective, we compared SBA and IRS practices
to share taxpayer information against selected leading practices for data
sharing and interagency collaboration. [8] We also interviewed SBA and IRS officials about potential alternatives to the
current data-sharing process. See appendix I for additional information about
our scope and methodology.

We conducted this performance audit from July 2024 to March
2026 in accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on
our audit objectives.

Background

SBA’s Disaster Loan Program

SBA primarily supports small businesses through programs
offering training, contracting help, and grants and loans. SBA’s Disaster Loan
Program, created in 1953, offers low-interest loans to businesses, nonprofits,
homeowners, and renters to help repair and rebuild damaged property and recover
economic losses after a declared disaster. Most loans are made to individuals,
households, or businesses to help repair and replace physical property. [9] The program also offers Economic
Injury Disaster Loans to eligible small businesses and nonprofit organizations located
in a disaster area to help meet financial obligations or cover regular and
necessary operating expenses, such as payroll or rent.

Among other application requirements, Disaster Loan
Program applicants must authorize IRS to release their tax information to SBA.
SBA uses this information to assess applicants’ eligibility and repayment
ability, verify applicants’ personal information, and estimate the extent of
their economic loss.

COVID-19 EIDL Program

The COVID-19 EIDL program provided funds to small
businesses from March 2020 through May 2022 to help them recover from the
economic effects of the pandemic (see table 1). The CARES Act provided funds
for SBA to establish this program, building on the existing Economic Injury
Disaster Loan offered under the Disaster Loan Program. [10] According to the SBA Office of
Inspector General (OIG), SBA approved over $377 billion in COVID-19 EIDL
funding from March 2020 through May 2022, which was more than all disaster loan
funding since SBA’s creation in 1953. [11]

Table 1: Overview of SBA’s COVID-19 Economic Injury
Disaster Loan Program Terms and Funding

Eligible businesses | · Businesses with not more than 500 employees or meeting SBA size
 standards · Small agricultural cooperatives, Employee Stock Ownership
 Plans, tribal concerns, sole proprietorships, independent contractors,
 agricultural enterprises, and most private nonprofit organizations · Businesses established on or before January 31, 2020
Eligible expenses | Payroll, business rent, and certain mortgage and
 fixed debt payments
Repayment period | Up to 30 years
Interest rate | 3.75 percent for businesses; 2.75 percent for nonprofits

Source: GAO analysis of Small Business Administration (SBA)
information. | GAO‑26‑107682

Note: In March 2022, SBA deferred the first payment for
loans to up to 30 months.

The COVID-19 EIDL program contained some programmatic
elements that differed from the Disaster Loan Program’s Economic Injury
Disaster Loans. For example, it included a grant component known as an advance,
and eligibility was expanded to include more types of small businesses. [12] In addition, Congress initially
allowed SBA to approve original loan applications based solely on applicants’
credit scores.

Congress also initially restricted SBA from requiring
applicants to submit tax returns or tax transcripts for original (initial) loan
applications, effectively prohibiting the agency from using taxpayer
information to verify eligibility. According to the SBA OIG, this restriction
reduced the accuracy of eligibility determinations. [13] Congress removed this restriction in
late December 2020 and allowed SBA to use taxpayer information, and SBA began
doing so in April 2021. [14] According to SBA officials, taxpayer information was key to verifying a
business’s existence and revenues and for detecting fraud and mitigating
improper payments.

SBA’s application process for COVID-19 EIDL had other
controls and verification features. The agency introduced a new platform to
process applications after determining that the existing system used for the
Disaster Loan Program did not have the capacity to accommodate the volume of
COVID-19 EIDL applications. We previously reported that this new platform
automatically screened whether applicants met minimum credit score
requirements, had open bankruptcies, and were delinquent on child support
obligations, among other minimum eligibility requirements. [15] We also reported that the platform
automatically declined applicants who did not meet minimum credit score
requirements. Declined loan applicants could request that SBA reconsider their
applications.

Applicants who passed the automatic screening were able to
create an account and request a loan amount, up to their estimated economic
injury or the program’s maximum loan limit. The initial $2 million maximum loan
limit changed over the course of the program—first being lowered, then
gradually raised—before returning to $2 million in October 2021. [16] Borrowers who initially received
less than the maximum could request additional funding.

There were three types of COVID-19 EIDL applications:

· Original (initial) loan applications. As noted above, the
CARES Act initially prohibited SBA from obtaining taxpayer information from
original loan applicants, but the Consolidated Appropriations Act, 2021, later
removed the prohibition.

· Reconsiderations and appeals. Loan applicants whose
original applications were declined could ask SBA to reconsider their
application. If a reconsideration was declined, the applicant could then pursue
an appeal. SBA required applicants to provide their tax information for
reconsiderations and appeals from the beginning of the program. [17]

· Modifications. Approved borrowers could request additional
funding or revised loan terms. SBA required tax information for modifications
for additional funding from the beginning of the program.

GAO’s High Risk List

Since March 2021, we have included SBA’s emergency loan
programs—including COVID-19 EIDL—on our High Risk List, due to a combination of
limited program controls and the massive volume of loans and expenditures in a
short period. [18] The High Risk List highlights federal programs vulnerable to waste, fraud,
abuse, and mismanagement. SBA has made some progress in addressing continuing
risks related to the program’s loans. [19] However, it has yet to address all material weaknesses in internal controls
identified by its financial statement auditor. In addition, in February 2025,
we added the federal government’s need to improve the delivery of federal
disaster assistance to our High Risk List, in part due to the numerous
challenges survivors faced receiving needed aid, including lengthy application
review processes.

Legal Framework for Sharing Taxpayer Information

Federal taxpayer information consists of federal tax
returns and return information that IRS possesses or controls. [20] This encompasses information
received directly by IRS or obtained through an authorized secondary source,
such as the Social Security Administration or another entity acting on IRS’s
behalf.

Taxpayer information is confidential and protected under
section 6103 of the Internal Revenue Code. [21] IRS may disclose such information only under certain circumstances, including
to a taxpayer’s designee (such as accountant or lawyer) or to federal, state,
or local agencies and nongovernmental entities. [22] In these instances, the shared
information is still considered taxpayer information and must be protected from
further disclosure.

Taxpayer information can be disclosed in different forms.
For taxpayers and most third parties, IRS shares tax return transcripts that
describe select line items from a tax return, along with any forms and
schedules. For certain federal agencies, IRS has provided only the specific tax
data variables needed to verify applicant information. For example, for federal
student aid applications, IRS shares with the Department of Education only the
tax data needed to verify the applicant’s identity and income.

Section 6103 enables IRS to disclose tax data in specific
circumstances. These include:

· Disclosure through taxpayer consent. Section 6103(c)
permits IRS to disclose tax returns and tax information with taxpayers’ consent
to do so. [23] Taxpayers can provide this consent by completing and signing a tax information
request form (Form 4506-T or 4506-C).

· Disclose for purposes other than tax administration. Section 6103(l) permits IRS to disclose tax information to specific agencies or
programs for purposes other than tax administration. [24] This section lists the programs to
which, and purposes for which, IRS is permitted to disclose specified taxpayer
information directly.

SBA and IRS Established
a Legal Framework and Processes for Sharing Taxpayer Information

SBA and IRS Obtained Treasury Approval and Entered Interagency Agreements
to Share Taxpayer Information

Although COVID-19 EIDL began in March 2020, SBA was not authorized
to require a loan applicant to submit tax returns until late December 2020, as
previously mentioned. Receiving this authorization was important because
taxpayer information was SBA’s primary tool for verifying applicant identity
and preventing fraud in its other programs, according to SBA officials. [25] SBA officials also said that the
initial prohibition on obtaining tax records resulted in greater fraud risks in
the COVID-19 EIDL program. Aside from loan applicants, IRS is the only source
from which SBA can obtain taxpayer information.

Between late December 2020, when SBA was authorized to use
taxpayer information, and April 2021, when SBA implemented the use of taxpayer
information for original loans, the agencies executed legal and administrative
agreements, met administrative requirements, and overcame IT and other
challenges to processing data requests.

IRS Obtained Treasury Approval to Share Taxpayer Information with SBA

SBA lacked legal authority to obtain taxpayer information
directly from IRS without taxpayer consent. [26] To share taxpayer information with SBA, IRS obtained approval from the
Department of the Treasury’s Office of Tax Policy to share taxpayer information
with SBA with loan applicants’ consent, according to IRS officials. This
authority was predicated on SBA obtaining completed and signed IRS Form 4506-T
or 4506-C (tax information request forms) from applicants, which constituted
consent to IRS releasing their information to SBA. [27]

SBA and IRS Formalized Data Sharing

SBA and IRS also implemented a data-sharing MOU (and
subsequent addendums) for COVID-19 EIDL. According to IRS officials, they used
a standard template, based on interagency agreements with other agencies, which
enabled them to finalize the initial MOU within a few days. SBA and IRS signed
the initial MOU on March 1, 2021. They then signed addendums revising the MOU
on October 4, 2021; October 6, 2021; December 14, 2022; and June 13, 2023.

The MOU outlined the legal authority for taxpayer
information sharing, its purpose, agency duties and responsibilities,
information safeguards, and the specific tax data shared.

· Statutory authority. The MOU cited the provision under
section 6103(c) that allows IRS to share taxpayer information with SBA upon
receiving taxpayers’ signed consent. [28]

· Purpose. SBA could use the taxpayer information to verify
applicant eligibility and the accuracy of application information. According to
IRS officials, this section prevented SBA from using the information for other
purposes beyond loan processing, such as conducting program-wide analyses to
identify potential indicators of fraud or improper payments.

· Duties and responsibilities. The MOU detailed data-sharing
procedures. Generally, SBA electronically faxed data requests and signed
taxpayer consent forms to IRS. IRS then sent requested taxpayer information to
an electronic mailbox that SBA accessed to retrieve the data. In addition, the
MOU stipulated, and SBA officials confirmed, that IRS generally would provide
the requested taxpayer information within 5 business days.

· Information safeguards. The MOU required SBA to establish
protections to prevent unauthorized access or disclosure, including secure
storage, access restrictions (authorized agency staff and contractors), and
training on confidentiality rules. [29]

· Tax data variables. SBA and IRS agreed to share only the
specific taxpayer information SBA needed to verify COVID-19 EIDL eligibility
and application information. An appendix listed the specific tax data variables
for tax years 2018 and 2019 that IRS agreed to share, including year of
filings, types of tax forms, and income and expense amounts. [30]

SBA Reimbursed IRS for Data-Sharing Costs

In 2021, SBA began reimbursing IRS for the costs related
to obtaining taxpayer information for COVID-19 EIDL and two other pandemic
assistance programs (Restaurant Revitalization Fund and Shuttered Venue
Operators Grant) (see table 2). [31] Under the 2021 MOU, SBA agreed to cover the cost of IRS services, and IRS would
provide SBA with its annual cost estimates. These included estimates for cost
of personnel administering the data-sharing program, processing tax information
requests, and maintaining data security. SBA officials said they needed to seek
budget approval to pay IRS. Although COVID-19 EIDL ended in May 2022, SBA
continued to obtain taxpayer information to verify borrower eligibility prior
to processing loan disbursements or servicing actions.

Table 2: SBA’s Reported Reimbursements to the Internal
Revenue Service for Costs of Sharing Taxpayer Information for COVID-19 EIDL and
Two Other Programs, Fiscal Years 2021–2024

Fiscal year | Totals
2021 | 2022 | 2023 | 2024
Reimbursements for COVID-19 Economic Injury Disaster
 Loan (EIDL) and two other SBA pandemic relief programs a | $1,048,155 | $626,629 | —- | —- | $1,674,784
Reimbursements for COVID-19 EIDL b | —- | —- | $99,573 | $39,238 | $138,811
All reimbursements | $1,813,595

Source: Small Business Administration (SBA). | GAO‑26‑107682

a For fiscal years 2021 and 2022, SBA also made
reimbursements to the Internal Revenue Service for two other pandemic relief
programs—the Restaurant Revitalization Fund and the Shuttered Venue Operators
Grant. SBA was unable to provide separate reimbursement data for each program.

b For fiscal years 2023 and 2024, SBA continued
to obtain taxpayer information to verify borrower eligibility prior to
disbursing previously approved loans or processing requests for loan deferments
or modifications.

SBA and IRS Made Process Enhancements to Share Taxpayer Information but
Still Performed Manual Reviews

SBA and IRS Refined Their Processes and IT

In response to the demand for COVID-19 EIDL, SBA and IRS
streamlined their process for sharing taxpayer information and IRS enhanced IT
components. For instance, in March 2021, SBA and IRS formally agreed to share
taxpayer information via specific tax data variables instead of entire tax
transcripts. [32] The SBA OIG also reported that SBA took steps to fully implement the use of tax
information for COVID-19 EIDL, as outlined below. [33]

· January 7, 2021: SBA’s contractors modified the loan
application system to upload taxpayer information received from IRS to
applicants’ loan files.

· February 19, 2021: Contractors added functionality for the
system to automatically generate an IRS form for applicants to consent to IRS
disclosing their taxpayer information to SBA.

· April 21, 2021: SBA obtained approval from the Office of
Management and Budget to revise the COVID-19 EIDL application to include
applicant consent for IRS to share taxpayer information.

· April 28, 2021: SBA fully implemented the requirement to
obtain taxpayer information.

IRS officials said that once the MOU was signed, it
created a new interface in its data system to automate retrieval of specific
tax data variables. According to IRS officials, automated retrieval reduced IRS
processing times and improved response times to SBA.

SBA and IRS Manually Verified Taxpayer Information

Although the data-sharing processes for COVID-19 EIDL
incorporated some automation, both agencies still performed manual reviews. The
MOU required these reviews to ensure taxpayers had given permission to IRS to
disclose their taxpayer information to SBA (see fig. 1). Before faxing requests
to IRS, SBA was to manually verify that applicants had completed and signed the
IRS tax information request forms. According to IRS officials, SBA could fax
requests for up to 35 applicants at a time. [34] The MOU also required IRS to manually verify the tax request information. If
IRS was unable to validate the information or did not have such records, it
would reject the request and provide SBA with a reason for the rejection. [35]

Figure 1: SBA and IRS Processes for Sharing Tax
Information of COVID-19 Economic Injury Disaster Loan Applicants

Reviews to ensure that the tax information matched the
loan applicant were important because, as previously mentioned, taxpayer
information is considered confidential and SBA used applicants’ tax information
to verify eligibility and accuracy of loan applications. These verification
checks served as one control to help SBA detect potential fraud and mitigate
improper payments. IRS officials also recognized that taxpayer information
could help SBA identify fraudulent loan applications and mitigate improper payments.

IRS and SBA Initially Experienced Backlogs in Sharing Taxpayer Information

After SBA began requiring taxpayer information for
original COVID-19 EIDL loan applications in April 2021, IRS backlogs created
challenges in obtaining this information. Using SBA-provided data, we found
that average processing times for approved original loan applications increased
after March 2021. [36] According to our analysis of SBA’s data, SBA processed applications received
from January through March 2021 on average within 5 weeks and processed
applications received from April through August 2021 on average within 9–12
weeks. [37] In addition to IRS-related delays, other factors that could have contributed to
increased processing times include an increased volume of modification
applications and SBA launching other pandemic relief programs.

IRS Backlogs in Processing Taxpayer Information

IRS experienced delays in processing taxpayer information
during the period COVID-19 EIDL operated. According to the Treasury Inspector
General for Tax Administration, during 2020–2023, IRS had significant backlogs
in processing 2019 tax returns and taxpayer information requests from multiple
agencies and programs, including COVID-19 EIDL. [38] For example, the backlog of
unprocessed annual tax returns at year-end grew from 183,000 in 2019 to over
3.5 million in 2020 and over 4.6 million as of October 2021.

IRS officials said the cause of the backlog was
pandemic-related evacuations and social-distancing requirements at processing
centers. They also said that in preparation for closing one center in September
2021, IRS had reassigned work to another center starting in July 2020. However,
the Inspector General reported that IRS had not effectively reassigned workload
across the processing centers to address backlogs in processing taxpayer
information requests. [39]

According to the Inspector General, IRS began addressing
these backlogs in 2020 by expanding telework and providing incentive pay. [40] IRS officials also said they
developed a system interface to automate tax information retrieval, which
improved timeliness in processing information requests. In 2022, IRS took
further action to address these backlogs by shifting workloads across processing
centers, transitioning from paper to electronic processing of requests, and
creating an inventory system to estimate workloads and shift staffing. [41]

According to agency officials, IRS did not track
processing times for SBA’s COVID-19 EIDL taxpayer information requests until
October 2021. By that time, according to IRS officials, IRS fulfilled SBA’s
requests within 7 business days. By mid-December 2021, according to IRS
officials, they met the 5-business-day processing target stipulated in the MOU
and had cleared the SBA-related COVID-19 EIDL backlog.

SBA Issues with Obtaining Taxpayer Information

Due to IRS backlogs, SBA modified how it obtained taxpayer
information for COVID-19 EIDL applications. In April 2021, when SBA began
requiring taxpayer information for original loan applications, IRS often was
unable to provide the data, according to the SBA OIG. [42] To address this problem, in May
2021, SBA instructed its loan officers to ask for copies of applicants’ 2019
income tax returns. In August 2021, SBA required applicants to include copies
of their 2019 income tax returns as part of their applications, according to
SBA officials. However, the SBA OIG reported in September 2022 that SBA did not
always obtain tax returns from applicants and that some loans were approved
without taxpayer information or for ineligible applicants. [43] In response to the SBA OIG report,
SBA agreed to corrective actions to review and address the loans identified by
the SBA OIG in its audit. [44]

We previously reported that SBA approved a COVID-19 EIDL
application flagged for lack of taxpayer information and other reasons in
December 2021, after discussions with the applicant and the receipt of
additional documentation. [45] This applicant later pleaded guilty to fraud, was sentenced to prison, and
ordered to repay the loan.

In addition, we previously reported that SBA had to modify
application verification and documentation requirements for the Restaurant
Revitalization Fund and select Shuttered Venue Operators Grants due to IRS
taxpayer information processing delays. [46] These programs operated roughly between April and August 2021, the same period
in which SBA started using tax data for COVID-19 EIDL.

SBA and IRS Adapted COVID-19 EIDL Processes to the Disaster Loan Program

For the Disaster Loan Program, SBA directly administers
the application process including the process for obtaining applicant’s
taxpayer information. [47] As SBA also does not have the authority to obtain taxpayer information directly
from IRS for the Disaster Loan Program without taxpayer consent, it uses a
process similar to COVID-19 EIDL to obtain this information from IRS.
Applicants must complete and sign IRS Form 4506-C (tax information request) to
consent to IRS disclosing their information to SBA and then SBA and IRS must
manually process these forms. [48]

In recent years, SBA and IRS have taken steps to enhance
data sharing for the Disaster Loan Program. For example, like COVID-19 EIDL, SBA
and IRS agreed to share specific tax data variables (instead of tax
transcripts) and for SBA to reimburse IRS for the cost of providing taxpayer
information. Additionally, in the most recent MOU for the Disaster Loan
Program, SBA and IRS agreed to improve data and privacy safeguards by allowing
IRS to periodically review SBA’s safeguards for taxpayer information. [49] SBA also launched a new application
platform that leverages the data sharing process used for the COVID-19 EIDL
program.

Tax data variables. Before the pandemic, IRS
provided SBA with taxpayer information in the form of tax transcripts to verify
Disaster Loan Program applicant data, according to IRS officials. Like for the
COVID-19 EIDL process, IRS and SBA revised this approach to share only specific
tax data variables instead of tax transcripts. [50] The tax data variables generally pertained to
taxpayer identification, revenue, and expenses, or IRS rejection codes when it
could not process a data request. According to SBA and IRS officials, the use
of tax data variables benefited both agencies by speeding up the transfer of
taxpayer information and by improving the security of taxpayer data by
eliminating disclosure of unnecessary tax data.

Reimbursements. Beginning in fiscal year 2023, SBA
was required to reimburse IRS for the costs of reviewing tax data requests and
creating an automation tool to retrieve tax data for the Disaster Loan Program.
SBA reimbursed IRS almost $300,000 for these costs in fiscal years 2023 and
2024 (see table 3).

Table 3: SBA’s Reported Reimbursements to Internal Revenue
Service for Costs of Sharing Taxpayer Information for Disaster Loan Program,
Fiscal Years 2023–2024

Fiscal year | Total
2023 | 2024
All reimbursements | $60,473 | $230,763 | $291,236

Source: Small Business Administration (SBA). | GAO‑26‑107682

Note: The requirement for SBA to reimburse the Internal
Revenue Service for these costs took effect on October 1, 2022.

Process enhancements. In 2024, SBA launched the
Unified Lending Platform, a new application system for the Disaster Loan
Program. According to SBA officials, this platform was based in part on the
COVID-19 EIDL platform and is expected to expedite the application process and reduce
decision wait times. [51]

The platform includes an online portal through which
disaster loan applicants complete and submit their applications and provide
supporting documentation, including tax information request forms (IRS Form
4506-C). [52] According to SBA documents and officials, after an application is submitted,
the platform automatically screens the applicant’s information against
third-party data sources to verify applicant identity, check credit history,
and identify potential fraud indicators.

SBA then pauses the automated review process while it
requests and waits for IRS to provide tax information. SBA officials said that
IRS typically meets the processing requirement of 3 business days, as stated in
the MOU, to respond to SBA requests for tax information. Once received, the
platform uploads this information to the applicant files, according to SBA
officials.

Finally, SBA staff are to manually review the application
and decide if the applicant is qualified to receive a loan. After approval but
before disbursement, staff are also to conduct additional applicant screening,
such as checks against SBA loan history and Treasury’s Do Not Pay service. [53]

Most Loans SBA Approved
Did Not Require Taxpayer Information

SBA Approved Most COVID-19 EIDL Loans Before It Required Taxpayer
Information

As of June 2024, SBA approved almost 3.7 million loans
totaling about $360 billion, according to SBA’s COVID-19 EIDL data (see fig.
2). [54] SBA approved most of the loans during the first year of the program, during
which tax information was not required to approve loan applications. [55]

Of the almost 3.7 million loans, about 1.8 million or
about 48 percent, had evidence of associated tax request-related documents. [56] Those loans accounted for about 73
percent of the total COVID-19 EIDL funding (about $261 billion), which exceeds
their 48 percent share of total approved loans. This is largely because about
half of these loans were later modified to increase loan amounts.

Figure 2: SBA-Approved COVID-19 Economic Injury Disaster
Loans, by Tax Request Documentation, as of June 2024

About half of the approved
loan files we analyzed contained documentation indicating SBA received
responses to its requests for taxpayer information.

Note: We used SBA data as of June 2024 to calculate the
number and value of approved loans (original loans, reconsiderations, and
appeals) with and without modifications for which SBA received responses to its
requests for tax information. These data do not include loans to U.S.
territories or reflect whether approved loans were later cancelled.

SBA Cannot Readily Determine If It Got Required Taxpayer Information for
COVID-19 EIDL, but Can for Ongoing Disaster Loan Program

Taxpayer information was required for some COVID-19 EIDL
applications to be eligible for funding. But SBA cannot determine whether this
information was obtained without manually reviewing loan files due to
limitations in its data systems and the way the systems saved taxpayer
information. COVID-19 EIDL policy required SBA to obtain taxpayer information
from applicants who originally applied after April 2021 as well as from
borrowers who requested additional funding (modifications) or certain
reconsiderations and appeals of denied loans, regardless of when they
originally applied.

To obtain taxpayer information, SBA submitted requests to
IRS and applicants. SBA saved responses from both sources as electronic
documents (portable document formats or PDFs), according to SBA officials. [57] SBA used a naming convention for
these documents that reflected the type of taxpayer information requested. [58] But the resulting responses did not
always contain actual taxpayer information. For example, when IRS could not
process a request or no tax records existed, it would send a message indicating
it could not provide taxpayer information.

Loan officers accessed these documents through the
applicant’s file in the COVID-19 EIDL platform. However, the platform did not
have a field for officers to indicate whether the documents actually included
taxpayer information. In addition, we found that SBA declined more than 60,000
of the applications with tax request-related documents citing “No IRS records
found” as a reason—indicating that some tax request-related documents did not
include actual taxpayer information.

Using SBA’s data, we found that SBA had evidence that it
had obtained tax request-related documents for about 4.7 million applications.
However, due to limitations in SBA’s systems, including the lack of an
indicator or field within the platform to track whether taxpayer information
was obtained, we could not determine the extent to which these documents
contained actual taxpayer information. As needed, SBA can access and view tax
request-related documents for individual COVID-19 EIDL applications through its
platform.

Moreover, the COVID-19 EIDL program is now closed, and its
platform is not being used for new applications or other programs. SBA
officials also said that they have been conducting a reconciliation of the
program’s loan population to ensure it is complete and accurate and that loans
were disbursed to eligible recipients. The reconciliation efforts are being
undertaken to help address COVID-19 EIDL program deficiencies that SBA’s
financial statement auditor identified. [59]

The Disaster Loan Program uses a process similar to
COVID-19 EIDL to collect and store taxpayer information, but it does not have
some of the limitations described above. According to SBA officials, the
Disaster Loan Program’s Unified Lending Platform does not have an indicator or
a field to track if taxpayer information was obtained for an applicant.

However, SBA has additional steps to ensure this information
is obtained. [60] For example, according to SBA officials, if IRS cannot provide taxpayer
information or does not respond to SBA’s request for taxpayer information, the
Unified Lending Platform automatically alerts SBA staff to review those
applications. According to the Disaster Loan standard operating procedures, if
taxpayer information cannot be obtained for an application, SBA is to withdraw
it from consideration. For SBA to reconsider the application, applicants must
reauthorize SBA to receive taxpayer information via a signed IRS Form 8821.

SBA and IRS Generally
Followed Leading Practices for Data Sharing, but Opportunities for Improvement
Remain

SBA and IRS Actions Followed Most Leading Practices, but Agencies Have Not
Made Progress to Fully Automate Data Sharing

SBA and IRS actions to share taxpayer information for
COVID-19 EIDL and the Disaster Loan Program generally followed relevant leading
practices for interagency data sharing and collaboration. More specifically,
their processes for sharing taxpayer information under these two programs
generally followed two relevant recommendations (leading practices) from a 2022
report by the Federal Chief Data Officer Council (see fig. 3). [61]

Figure 3: Extent to Which SBA and IRS Data Sharing
Followed Key Recommendations of the Federal Chief Data Officer Council

Note: We assessed the extent to which SBA and IRS
activities for COVID-19 EIDL and the Disaster Loan Program followed relevant
recommendations of the Federal Chief Data Officer Council. We determined that
the agencies generally followed a recommendation if their processes reflected
most or all the relevant considerations. We determined that the agencies
partially followed a practice if its processes reflected some of the relevant
key considerations. Federal Chief Data Officer Council, Data Sharing Working Group,
Findings and Recommendations (Washington, D.C.: 2022).

· Expedited agreement process. According to IRS officials,
they use a standardized template to develop interagency MOUs to ensure all
Internal Revenue Code and IRS requirements for privacy and data security are
addressed. [62] They used this template to develop the MOUs for the COVID-19 EIDL program and
the Disaster Loan Program. IRS officials also told us that using the template
enabled IRS and SBA to finalize the MOU for COVID-19 EIDL within a few days.

· Improved data trustworthiness. The MOUs describe data
quality requirements, such as the data-sharing validation requirements
described earlier. The Disaster Loan MOU also requires SBA to conduct monthly
reviews and provide IRS an annual report on SBA’s electronic signature process.
We obtained a sample of SBA’s monthly reviews and the annual report it sends to
IRS to confirm these steps were completed by the agencies. As previously
mentioned, in the most recent MOU, SBA and IRS agreed to improve data and
privacy safeguards by allowing IRS to periodically inspect SBA’s safeguards for
taxpayer information. [63]

We also found that SBA and IRS actions in sharing taxpayer
information generally followed four relevant leading practices for interagency
collaboration and partially followed three more (see fig. 4). [64]

Figure 4: Extent to Which SBA and IRS Taxpayer Information
Sharing Followed Selected Leading Practices for Interagency Collaboration

Note: We assessed the extent to which SBA and IRS
data-sharing activities for COVID-19 EIDL and the Disaster Loan Program
followed selected leading practices for interagency collaboration outlined in GAO‑23‑105520 . We
determined that agency processes or activities generally followed a practice if
those actions reflected most or all the key considerations and partially
followed a practice if its processes reflected some of the relevant key
considerations.

Specifically, SBA and IRS actions generally followed four
of the seven relevant leading practices:

· Bridge organizational cultures. Through the MOU process,
SBA and IRS established compatible policies to operate across agency boundaries
and agreed on common terminology and definitions.

· Identify and sustain leadership. SBA and IRS share
leadership for developing and revising the MOUs that govern the data-sharing
process.

· Clarify roles and responsibilities. The MOUs detail each
agency’s roles and responsibilities for data sharing, and the agencies make
decisions through the renegotiation of MOUs.

· Develop and update written guidance and agreements. SBA
and IRS documented their agreed approaches to sharing taxpayer information
through a series of MOUs, which specify the dates on which the agreements take
effect and expire.

SBA and IRS actions partially followed three of the seven
relevant leading practices.

· Define common outcomes. The agencies agreed to share
taxpayer information to mitigate improper payments and fraud risk in SBA’s
direct lending programs. The current manual process meets this desired
short-term outcome. However, manual processing requires staff and time to
collect, review, and transmit information between agencies and may be
susceptible to backlogs. Both agencies agree that fully automated data
sharing—in which their systems would directly share specific tax data variables
in near real-time—would be more efficient. IRS officials said this would
require SBA to have statutory authority allowing it to receive taxpayer
information without first obtaining taxpayer consent. This authority also would
eliminate the need for applicants to complete IRS consent forms and for related
manual processing of these forms. [65] Although IRS officials have told us that they support SBA gaining this legal
authority, SBA does not currently have it and has not requested it from
Congress. As a result, the agencies have not progressed toward achieving the
long-term outcome that both want—fully automated data sharing.

· Ensure accountability. SBA and IRS collaborate to ensure
accountability in their current process—for instance, by monitoring data
requests and communicating about incomplete or incorrect paperwork. They can
also update procedures through the Disaster Loan Program MOU, which is usually
renegotiated every 3 years. [66] However, while the agencies agree that data sharing could be more efficient if
it were fully automated, they have not developed methods to monitor, assess, or
communicate progress, or assigned accountability towards achieving it.

· Leverage resources and information. SBA bears the costs of
sharing taxpayer information and reimburses IRS annually. The agencies
introduced tools and technologies to manage the large volume of COVID-19 EIDL
applications, many of which SBA and IRS adapted for the Disaster Loan Program.
However, because of the lack of legal authority, the agencies have not yet
leveraged IRS’s existing technologies to further automate data sharing.

Opportunities Exist to Improve the Efficiency of Tax Data Sharing

SBA has opportunities to improve the efficiency of tax
data sharing, including (1) pursuing legal authority to obtain taxpayer
information directly from IRS, which would eliminate the need to manually
process consent forms; and (2) implementing technologies that could improve
data sharing.

As noted earlier, SBA has not pursued the legal authority
that would allow it to directly obtain taxpayer information from IRS—an action
that would require amending section 6103(l) of the Internal Revenue Code. SBA
officials cited two key reasons for not seeking this authority. First, they
expressed a preference for a more general legislative amendment that would
cover a wider range of potential future changes to SBA programs. They said this
would avoid the need for repeated congressional action if program requirements
change. However, due to the confidential nature of taxpayer information, amendments
to section 6103(l) have generally specified for which programs and purposes IRS
may disclose taxpayer information and the type of tax data needed. [67] Second, SBA officials stated a
preference to continue obtaining applicant consent before accessing taxpayer
information. However, even if a section 6103(I) amendment were to eliminate IRS’s
requirement for consent, SBA could still choose to obtain applicant consent,
such as by integrating it into the loan application process. [68]

Technological improvements also could help reduce reliance
on manual processing of tax information request forms, according to SBA and
IRS. Agency officials told us they have begun to explore technological
improvements that could support more efficient data sharing while maintaining
the current requirement for applicant consent. However, officials were not able
to provide details on the technologies under consideration.

Office of Management and Budget Circular No. A-129
requires federal credit programs to be designed and administered effectively
and efficiently. [69] The circular also states that agencies can propose new or revised legislation
to meet these goals. And as noted earlier, a leading practice for interagency
collaboration is to collaborate in leveraging information, such as using
technology to share relevant data across agencies.

By taking steps to improve the efficiency of data sharing
with IRS—such as pursuing statutory authority for direct access or implementing
new technologies—SBA could reduce administrative burden and enhance
responsiveness, especially during unusually large surges in demand. Furthermore,
improvements introduced for the Disaster Loan Program could be leveraged by SBA
for future emergency programs to help mitigate fraud and improper payments risks
in those programs.

Conclusions

IRS taxpayer information is an important tool for helping
SBA assess applicant eligibility and mitigate financial risk in its disaster
assistance programs. The inability to use these data during the first year of
the COVID-19 EIDL program may have increased the risk of fraud and improper
payments.

Although SBA applied data-sharing enhancements from the
temporary COVID-19 EIDL program to its ongoing Disaster Loan Program,
additional opportunities for improvement remain. These include obtaining legal
authority for direct access to taxpayer information to support eligibility
determinations. Obtaining this authority would be an important step toward more
fully automating data sharing with IRS, enabling near-real time data sharing.
Another potential opportunity is introducing new technologies to reduce manual
processing. By taking steps to improve the efficiency of data sharing with IRS,
SBA could help lower its administrative burden, be better positioned to respond
to future disasters or emergencies, and help prevent fraud, waste, and abuse in
its disaster response programs.

Recommendation for
Executive Action

The Administrator of SBA should take steps to improve the
efficiency of data sharing with IRS for the Disaster Loan Program. These steps
could include seeking statutory authority for direct access to tax data under
section 6103(l) of the Internal Revenue Code or implementing new technologies
to reduce manual processing. (Recommendation 1)

Agency Comments

We provided a draft of this report to IRS and SBA for
review and comment. IRS did not have any comments on the report. SBA provided
written comments, which are reproduced in appendix II. SBA also provided
technical comments, which we incorporated as appropriate.

SBA neither agreed nor disagreed
with our recommendation but stated that it anticipates addressing it by October
31, 2027, when the Disaster Loan MOU is renewed with IRS. Further, SBA stated
its support for better access to data through statutory change or improved
technology that would reduce instances of fraud.

We are sending copies of this report to the appropriate
congressional committees and to the Administrator of SBA and Acting
Commissioner of IRS. This report will also be available at no on GAO’s website
at https://www.gao.gov .

If you or your staff have any questions about this report,
please contact me at lafountainc@gao.gov .
Contact points for our Office of Congressional Relations and Media Relations may
be found on the last page of this report. GAO staff who made key contributions
to this report are listed in appendix II.

Courtney LaFountain Director, Financial Markets and Community Investment

Appendix I: Objective,
Scope, and Methodology

This report examines (1) the processes and agreements that
the Small Business Administration (SBA) and the Internal Revenue Service (IRS)
established to share tax information for the COVID-19 Economic Injury Disaster
Loan (EIDL) program; (2) available data on the extent to which SBA obtained
taxpayer information for applicants; and (3) the extent to which SBA and IRS
data-sharing efforts reflected relevant leading practices in data sharing and
interagency collaboration.

Factors Affecting the Sharing of Tax Data

For the first objective, we analyzed relevant statutes,
including those authorizing and amending the COVID-19 EIDL program. We also
analyzed the relevant provisions of the Internal Revenue Code to identify ways
that IRS can legally share taxpayer information with federal agencies and other
entities.

We reviewed agency guidance, procedures, and other
documentation related to COVID-19 EIDL, the Disaster Loan Program, and SBA and
IRS processes for sharing of tax data under those programs. We also reviewed
legal agreements (memorandums of understanding and addendums) between SBA and
IRS that governed the terms and processes for sharing tax information for
COVID-19 EIDL and the Disaster Loan Program. For the Disaster Loan Program, we
reviewed memorandums of understanding in effect before and after the pandemic
to identify changes in the data-sharing process.

We also reviewed reports from the SBA Office of Inspector
General and the Treasury Inspector General for Tax Administration, including
those pertaining to IRS’s challenges in sharing tax information during the
pandemic and actions taken by SBA and IRS to address them. In addition, we
reviewed SBA information on reimbursements paid to IRS for sharing tax
information for COVID-19 EIDL (which also included amounts for other pandemic
assistance programs) and the Disaster Loan Program.

We interviewed officials at SBA and IRS on procedures for
sharing tax information for these programs, including changes made to handle
the high volume of COVID-19 EIDL applications.

SBA’s Collection of Taxpayer Information

For the second objective, we analyzed two datasets we
received from SBA to help us determine the extent to which SBA obtained
taxpayer information for loan applicants. To assess the reliability of these
datasets, we reviewed related data documentation, interviewed and obtained
written responses from SBA officials, performed electronic data tests, and
reviewed the code SBA used to extract data related to applicant taxpayer
information from its system.

· Applicant taxpayer information. SBA provided data
describing more than 8 million documents it received from IRS or applicants in
response to its requests for tax information. We determined the data were
sufficiently reliable for reporting the number of responses SBA received to its
requests and the sources of those responses, as well as the date those
responses were received. But due to limitations in SBA’s data systems, we
determined that the data were not sufficiently reliable for describing the
extent to which tax information was obtained or whether the source data
included both tax and other information.

· COVID-19 EIDL application data. SBA also provided data on
more than 15 million COVID-19 EIDL applications submitted from March 2020
through May 2022, as of June 2024. [70] We determined the data were sufficiently reliable for describing application
characteristics such as type (original loan, reconsideration, appeal, or
modification), status, dates SBA received and processed applications, loan
amount, and decline reasons. But based on information provided by SBA
officials, we determined the data were not sufficiently reliable for describing
the total number of applications, number and value of loans cancelled after
approval, or total value of funds disbursed for the program. [71]

We merged these datasets by application number and then
analyzed the combined data. [72] Within the limits of what we considered reliable for reporting, we calculated
the number and value of approved loans (original loans, reconsiderations, and
appeals) and loan modifications for which SBA received responses to its
requests for tax information. We also calculated the number and value of
applications by outcome (approved, declined, withdrawn, and in-process). We
also analyzed the processing times for approved original loan applications that
SBA funded by comparing the date the application was submitted to the date it
was approved. We then used these data to assess how processing times changed
before and after SBA required taxpayer information for original loans.

Extent to Which Data-Sharing Reflected Leading Practices

For the third objective, we first identified relevant
criteria by reviewing federal and GAO reports with leading practices that
pertained to data-sharing and interagency collaboration.

· For data-sharing, we selected a 2022 report from the Federal
Chief Data Officer Council Data Sharing Working Group, which examined
data-sharing needs across federal agencies and included recommendations to
address identified challenges. [73] We further refined our criteria by selecting two of the report’s four
recommendations, based on their applicability to our scope. [74]

· For interagency collaboration, we selected GAO’s framework on
interagency collaboration, which includes eight leading practices for effective
collaboration. [75] We selected seven of these practices, based on their applicability to our
scope.

After identifying the criteria, we assessed SBA and IRS
data-sharing processes and actions to determine the extent to which actions
reflected the recommendations and leading practices. We scored our assessment
using a three-point scale: generally followed, partially followed, or did not
follow.

We also examined the extent to which the SBA IRS
data-sharing process and the manual processing of tax information request forms
for the Disaster Loan Program aligned with agencies’ responsibilities for
managing federal credit programs efficiently. [76] Additionally, we interviewed SBA and IRS officials about potential alternatives
to the current data-sharing process.

We conducted this performance audit from July 2024 to March
2026 in accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on
our audit objectives.

Appendix II: Comments
from the U.S. Small Business Administration

Appendix III: GAO
Contact and Staff Acknowledgments

GAO Contact

Courtney LaFountain, LaFountainC@gao.gov

Staff Acknowledgments

In addition to the contact above, Andrew Pauline
(Assistant Director), Colleen Moffatt Kimer (Analyst in Charge), Jill Lacey,
Kun-Fang (K.F.) Lee, Ying Long, Alberto Lopez, Marc Molino, Barbara Roesmann,
and Farrah Stone made key contributions to this report.

GAO’s Mission

The Government Accountability
Office, the audit, evaluation, and investigative arm of Congress, exists to
support Congress in meeting its constitutional responsibilities and to help
improve the performance and accountability of the federal government for the
American people. GAO examines the use of public funds; evaluates federal
programs and policies; and provides analyses, recommendations, and other
assistance to help Congress make informed oversight, policy, and funding
decisions. GAO’s commitment to good government is reflected in its core values
of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and
correspondence. You can also subscribe to GAO’s email
updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual
cost of production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and white.
Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm .

Place orders by calling (202) 512-6000, toll free (866) 801-7077,
or TDD (202) 512-2537.

Orders may be paid for using American
Express, Discover Card, MasterCard, Visa, check, or money order. Call for
additional information.

Connect with GAO

Connect with GAO on X , LinkedIn , Instagram , and YouTube . Subscribe to our Email Updates . Listen to our Podcasts . Visit GAO on the web at https://www.gao.gov .

To Report Fraud, Waste, and Abuse in Federal
Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us

[1] CARES Act, Pub. L. No. 116-136,
134 Stat. 281, 533 (2020).

[2] Under the CARES Act, the SBA
Administrator was allowed to approve COVID-19 EIDLs based solely on credit
score or by using alternative appropriate methods to determine ability to repay
a loan. Pub. L. No. 116-136, div. A, tit. I, § 1110(d), 134 Stat. 281, 306
(2020) (codified as amended at 15 U.S.C. § 9009(d)).

[3] Consolidated Appropriations
Act, 2021, Pub. L. No. 116-260, div. N, § 332(2), 134 Stat. 1182, 2045 (2020)
(codified at 15 U.S.C. § 9009(d)).

[4] Section 4 of the Further
Consolidated Appropriations Act, 2024, notes that the explanatory statement
printed in the Congressional Record shall be treated as if it were a joint
explanatory statement of a committee of conference. Further Consolidated
Appropriations Act, 2024, Pub. L. No. 118-47, § 4, 138 Stat. 460, 461; 170
Cong. Rec. H1501 (Mar. 22, 2024) . See 170 Cong. Rec. H1752 for
congressional directive to provide this report.

[5] To assess the reliability of
SBA’s data describing documents received in response to tax information
requests, we reviewed related documentation, interviewed and obtained written
responses from SBA officials, performed electronic data tests, and reviewed the
code SBA used to extract data from its system. We determined the data to be
sufficiently reliable for reporting the number, date received, and sources of
SBA’s tax information requests. However, due to limitations in SBA’s data
systems and because the source data included both tax and other information, we
determined the extracted data were not sufficiently reliable for our purposes
of assessing whether actual tax information was obtained.

[6] The program closed in May 2022,
but SBA continued to make administrative changes to loan records through June
2024 that are reflected in the data. To assess the reliability of the
application data, we reviewed related data documentation, interviewed and obtained
written responses from SBA officials, and performed electronic data tests. We
determined the data were sufficiently reliable for describing application
characteristics such as type (original loan, reconsideration, or appeal) and
modifications, application status, dates SBA received and processed
applications, loan amount, and decline reasons. However, we determined the data
were not sufficiently reliable for describing the total number of applications,
number and value of loans cancelled after approval, or total value of funds
disbursed for the program. According to SBA officials, additional
information needed for these determinations is contained in a separate financial
system.

[7] We excluded from our analysis
applications from five U.S. territories (American Samoa, Guam, Mariana Islands,
Puerto Rico, and Virgin Islands), which are generally served by territorial tax
authorities (not IRS) unless the business had income that can be sourced (or
connected) to the United States.

[8] For data sharing, see Federal
Chief Data Officer Council, Data Sharing Working Group, Findings and
Recommendations (Washington, D.C.: 2022). For interagency collaboration,
see GAO, Government Performance Management: Leading Practices to Enhance
Interagency Collaboration and Address Crosscutting Challenges , GAO‑23‑105520 (Washington,
D.C.: May 24, 2023).

[9] GAO, Small Business Administration: Targeted Outreach about Disaster Assistance
Could Benefit Rural Communities , GAO‑24‑106755 (Washington,
D.C.: Feb. 22, 2024).

[10] The COVID-19 EIDL program was
separate from the Disaster Loan Program. COVID-19 EIDL was a type of Economic
Injury Disaster Loan that addressed economic injury incurred from the pandemic.

[11] The OIG also reported that in
the 67 years before the pandemic, SBA had approved over 2.2 million disaster
loans for $66.7 billion. In addition, SBA received over 14 million applications
in the first 5 months of the COVID-EIDL program. Small Business Administration,
Office of Inspector General, Follow-up Inspection of SBA’s Internal Controls
to Prevent COVID-19 EIDLs to Ineligible Applicants , 22-22 (Washington,
D.C.: Sept. 29, 2022); and COVID-19 Economic Injury Disaster Loan Servicing
Capability , 25-16 (Washington, D.C.: May 29, 2025).

[12] Advances included EIDL advances
(introduced in 2020), targeted advances (enacted 2020, implemented 2021), and
supplemental targeted advances (2021). EIDL advances could be used toward
payroll, sick leave, and other business obligations. Borrowers did not have to
repay these amounts, even if they subsequently were not approved for a COVID-19
EIDL loan. See CARES Act, Pub. L. No. 116-136, § 1110(e)(5), 134 Stat.
281, 308 (2020) (codified at 15 U.S.C. 9009(e)(5)).

[13] Small Business Administration,
Office of Inspector General, Follow-up Inspection of SBA’s Internal Controls
to Prevent COVID-19 EIDLs to Ineligible Applicants .

[14] See Pub. L. No.
116-260, div. N, tit. III, § 332, 134 Stat. 1182, 2045 (2020).

[15] GAO, Economic Injury
Disaster Loan Program: Additional Actions Needed to Improve Communication with
Applicants and Address Fraud Risks , GAO‑21‑589 (Washington,
D.C.: July 30, 2021).

[16] The Food, Conservation, and
Energy Act of 2008 amended the Small Business Act to authorize the SBA
Administrator to set aggregate maximum loan limits not to exceed the $2
million. See Pub L. No. 110-246, § 12078, 122 Stat. 1651, 2177 (codified
at 15 U.S.C § 636(b)(8)). The statute also allows the SBA Administrator to
waive the aggregate loan limits under certain circumstances.

[17] According to SBA officials,
they interpreted the CARES Act’s prohibition on obtaining tax information as
applying only to initial (original) loan applications, not to subsequent
requests for reconsiderations or loan increases.

[18] GAO, High-Risk Series:
Heightened Attention Could Save Billions More and Improve Government Efficiency
and Effectiveness , GAO‑25‑107743 (Washington, D.C.: Feb. 25, 2025). For March 2021, see GAO, High-Risk
Series: Dedicated Leadership Needed to Address Limited Progress in Most
High-Risk Areas , GAO‑21‑119SP (Washington, D.C.: Mar. 15, 2021).

[19] Although the COVID-19 EIDL
program closed on May 16, 2022, its loans have 30-year terms, and fraud
monitoring efforts remain ongoing.

[20] See 26 U.S.C. §
6103(b)(1)-(3). Taxpayer information is a ny
information submitted to or received or collected by IRS related to a return or
related to the determination of taxpayer liability under the Internal Revenue
Code. Return information also includes
information derived from a return, such as whether a taxpayer is under audit or
owes taxes or penalties. 26 U.S.C. § 6103(a)(2)(A).

[21] 26 U.S.C. § 6103.

[22] See , e.g., 26 U.S.C. §§
6103(c), (d), (h), (i), (l).

[23] See 26 U.S.C. §
6103(c).

[24] See 26 U.S.C. §
6103(l).

[25] We previously reported on
SBA’s four-step antifraud process developed to detect potential fraud in the
COVID-19 EIDL program and the Paycheck Protection Program. The four steps were
screening, data analytics, human-led reviews, and OIG referrals. SBA’s use of
tax information in loan reviews is incorporated into the screening step. See
GAO, COVID-19 Relief: Improved Controls Needed for Referring Likely Fraud in
SBA’s Pandemic Loan Programs , GAO‑25‑107267 (Washington,
D.C.: Mar. 24, 2025).

[26] SBA was not authorized to
obtain taxpayer information directly from IRS without taxpayer consent for any
of its programs, including the Disaster Loan Program and COVID-19 EIDL. See 26
U.S.C. § 6103(l). SBA had required Disaster Loan Program applicants to provide consent
for IRS to disclose their information to SBA the prior to the introduction of
the COVID-19 EIDL program in March 2020.

[27] We use “tax information
request forms” to refer to two IRS forms (Request for Transcript of Tax Return,
Form 4506-T or 4506-C). As we describe later in this report, IRS shifted from
providing SBA full transcripts to only the specific tax data variables needed
to verify applicant information. See 26 U.S.C. § 6103(c).

[28] See 26 U.S.C. §
6103(c). Also see 26 C.F.R. § 301.6103(c)-1.

[29] The Internal Revenue Code also
sets out requirements for safeguarding tax information received directly from
IRS under section 6103. However, agencies that obtain tax information by
submitting Form 4506-T or 4506-C (that is, obtain taxpayer consent) may not be
subject to these requirements, including IRS inspections of their information
safeguards.

[30] The MOU also stipulated that
when IRS was unable to process a request for tax information, it would provide
rejection reasons, such as an incomplete Form 4506-T or 4506-C.

[31] The Restaurant Revitalization
Fund program assisted small businesses in the food service industry affected by
the pandemic. Businesses were not required to repay program awards and could
use them for eligible expenses such as payroll, business debt, or construction
of outdoor seating. This program accepted applications from May 3, 2021,
through June 30, 2021. See Pub. L. No. 117-2, § 5003, 135 Stat. 4, 85
(codified at 15 U.S.C. 9009c). The Shuttered Venue Operators Grant program
provided grants to small businesses in the live performing arts and
entertainment industry affected by the pandemic. Recipients could use the
grants for eligible expenses such as payroll, rent or mortgage, and utilities.
This program accepted applications from April 26, 2021, through August 20,
2021. See Pub. L. No. 116-260, div. N, § 324, 134 Stat. 1182, 2022
(codified at 15 U.S.C. § 9009a).

[32] The MOU signed on March 1,
2021, stated that IRS would provide the following information from 2019
taxpayer returns: taxpayer name, business name, mailing address, return form
type (e.g., 1040, 1120, 1120S, 1065), reported gross receipts/sales/wages, and
reported gross rents. Tax transcripts (a copy of most line items from a tax
return, along with any forms and schedules) include taxpayer information beyond
what SBA required for the COVID-19 EIDL program.

[33] Small Business Administration,
Office of Inspector General, Follow-up Inspection of SBA’s Internal Controls
to Prevent COVID-19 EIDLs to Ineligible Applicants .

[34] SBA requests to IRS were to
include a list of up to 35 applicants with taxpayer identification numbers,
type of tax form, and zip codes, as well as a copy of the applicants’ signed
tax request form (IRS Forms 4506-T or 4506-C).

[35] Specifically, if IRS could not
process SBA’s request, it would provide a rejection reason: invalid taxpayer
identification number, invalid zip code, invalid form request type, or
unavailable 2019 return data. The rejection reasons were revised in the MOU
addendums.

[36] As noted in this report, SBA
fully implemented the requirement to obtain taxpayer information on April 28,
2021. But we found that SBA had tax request-related documents for some original
loans approved before that date. SBA had tax request-related documents for
about 37 percent of original loans approved between January and March. In
April, SBA had tax request-related documents for almost 57 percent of approved
original loans. By July, SBA had tax request-related documents for all approved
original loans. For the purposes of this analysis, approved loans consist of
applications that SBA had funded after approval.

[37] Our analysis compared
processing times for about 65,000 approved original loans. About 58 percent of
these loan applications were received between January and March.

[38] Department of the Treasury,
Inspector General for Tax Administration, Results of the 2021 Filing Season ,
2022-40-024 (Washington, D.C.: Mar. 9, 2022); and Delays in Management
Actions Contribute to the Continued Tax Processing Center Backlogs ,
2022-46-057 (Washington, D.C.: Sept. 16, 2022).

[39] Department of the Treasury,
Inspector General for Tax Administration, Delays in Management Actions
Contribute to the Continued Tax Processing Center Backlogs.

[40] Department of the Treasury,
Inspector General for Tax Administration, The IRS Continues to Reduce
Backlog Inventories in the Tax Processing Centers , 2024-406-020
(Washington, D.C.: Mar. 18, 2024).

[41] Department of the Treasury,
Inspector General for Tax Administration, Delays in Management Actions
Contribute to the Continued Tax Processing Center Backlogs. Also, in March
2024, the Inspector General reported that, by the end of 2022, IRS had
significantly reduced the backlog of tax returns and that many processing
center functions had returned to pre-pandemic levels. Department of the
Treasury, Inspector General for Tax Administration, The IRS Continues to
Reduce Backlog Inventories in the Tax Processing Centers .

[42] Small Business Administration,
Office of Inspector General, Follow-up Inspection of SBA’s Internal Controls
to Prevent COVID-19 EIDLs to Ineligible Applicants .

[43] Small Business Administration,
Office of Inspector General, Follow-up Inspection of SBA’s Internal Controls
to Prevent COVID-19 EIDLs to Ineligible Applicants .

[44] Our analysis of SBA data
indicated tax request-related documents were obtained by SBA for more than 99
percent of original loans approved after April 28, 2021.

[45] GAO‑25‑107267 .

[46] For the Restaurant
Revitalization Fund, SBA officials said that IRS systems were unable to handle
the volume of requests, and therefore SBA had to use third-party data sources
to verify applicant identity. GAO, Restaurant Revitalization Fund:
Opportunities Exist to Improve Oversight , GAO‑22‑105442 (Washington,
D.C.: July 14, 2022). For the Shuttered Venue Operators Grants of $500,000 or
less, SBA had to modify its requirement for obtaining applicants’ tax data and
instead relied on financial statements and other documents submitted by
applicants. GAO, Covid Relief: SBA Could Improve Communications and Fraud
Risk Monitoring for Its Arts and Entertainment Venues Grant Program , GAO‑23‑105199 (Washington,
D.C.: Oct. 11, 2022).

[47] SBA’s 7(a) and 504 loan
programs also use taxpayer information but for those programs private lenders
obtain the taxpayer information.

[48] See 26 U.S.C. §
6103(c). The current agreement (effective January 6, 2025) between SBA and IRS
to share tax information for the Disaster Loan Program continues to require the
agencies to manually verify tax information request forms to ensure taxpayers
had given permission to IRS to disclose their taxpayer information to SBA.

[49] According to IRS officials,
the MOU (signed January 2025) incorporated enhanced safeguard requirements
described in IRS Publication 1075 guidance to ensure the policies, practices,
controls, and safeguards employed by recipient agencies, agents, contractors,
or sub-contractors adequately protect the confidentiality of federal tax
information. See Internal Revenue Service, Publication 1075 : Tax
Information Security Guidelines for Federal, State and Local Agencies (Washington, D.C.: revised November 2021).

[50] SBA and IRS renewed their
agreement to share tax information for the Disaster Loan Program. The MOU
became effective October 1, 2022, and replaced an agreement drafted before the
pandemic. The new MOU included an appendix that listed specific tax data that
IRS would share with SBA. When the 2022 MOU expired on January 3, 2025, the
agencies signed a new MOU. The 2025 MOU will remain in effect until October 1,
2027. It specifies that IRS and SBA will review the agreement every 3 years to
evaluate the continuing need for data sharing and whether provisions require
updates.

[51] For example, the COVID-19 EIDL
online platform accepted and processed applications and incorporated the IRS
tax transcript request form (Form 4506-T) into the application package. SBA was
able to upload tax information to the corresponding loan application file in
the platform.

[52] Borrowers also can use this
portal (MySBA) to access their loan statements and manage payments.

[53] The Office of Management and
Budget and the Department of the Treasury developed the Do Not Pay working
system, a web-based, centralized data matching service that allows agencies to
review multiple databases—such as those with data on deceased individuals and
on entities barred from receiving federal awards—before making payments.

[54] These data do not include
loans to U.S. territories or reflect whether approved loans were later
cancelled. SBA reported that as of April 2022, it had approved about 3.9
million loans totaling nearly $378 billion for the COVID-19 EIDL program,
including about 33,000 loans worth about $3.2 billion to businesses in the U.S.
territories. Small Business Administration, Disaster Assistance Update Nationwide
COVID EIDL, Targeted EIDL Advances, Supplemental Targeted Advances (Washington,
D.C.: Apr. 28, 2022). SBA’s OIG reported that as of October 2024, about 7
percent of loans were cancelled before full disbursement. Small Business
Administration, Office of Inspector General, COVID-19 Economic Injury
Disaster Loan Servicing Capability , 25-16 (Washington, D.C.: May 29, 2025).

[55] More than 94 percent of loans
were approved before April 28, 2021, when SBA began requiring taxpayer
information for original loan applications. SBA approved loans to approximately
144,000 applicants who originally applied after April 2021 and approximately
150,000 applicants who applied for reconsiderations or appeals after their
original applications were declined.

[56] We use “tax request-related
documents” to describe the electronic documents SBA saved with responses to
their requests for taxpayer information. Tax request-related documents may
contain taxpayer information or other information such as an IRS message indicating
it could not provide taxpayer information.

[57] The electronic documents were
saved to a read-only data warehouse accessible in the COVID-19 EIDL application
portal. These documents could include tax returns, tax transcripts, or select
tax variables or indicate that the requested information was not available.

[58] Documents from IRS were named
as a “partial tax transcript” and documents from the borrower were named for
the IRS form (for example, Form 1040).

[59] Small Business Administration,
Office of Inspector General, Independent Auditors’ Report on SBA’s Fiscal
Year 2024 Financial Statements, 25-05 (Washington, D.C.: Nov. 15, 2024).

[60] According
to the Disaster Loan standard operating procedures, SBA requires taxpayer
information from IRS for all disaster loan applicants except for applicants
from U.S. territories and those exempt from filing income tax. (SBA requires
supporting documentation from applicants exempt from filing income tax.) In
addition, SBA uses taxpayer information to calculate an applicant’s ability to
repay, a requirement for loan approval.

[61] Federal Chief Data Officer
Council, Data Sharing Working Group, Findings and Recommendations (Washington, D.C.: 2022). This report was produced to help the Council
understand data-sharing needs across federal agencies and included
recommendations to address identified challenges. We selected two of the four
recommendations based on their applicability to our scope. The Council was
established in the OPEN Government Data Act to improve the management, use,
protection, dissemination, and generation of data in government decision-making
and operations. See Pub. L. No. 115-435, § 202(f), 132 Stat. 5529, 5542
(2019) (codified at 44 U.S.C. § 3520A).

[62] IRS and Internal Revenue Code
requirements broadly pertain to tax data privacy, disclosure, security, and
incident reporting. See 26 U.S.C. § 6103. Also see 26 C.F.R §§
301.6103(a)-1 through (p)(7)-1.

[63] We previously recommended that
Congress consider providing IRS with direct statutory authority to inspect
receiving agencies’ safeguards for taxpayer information shared under subsection
6103(c) of the Internal Revenue Code. See GAO, Security of Taxpayer
Information: IRS Needs to Address Critical Safeguard Weaknesses , GAO‑23‑105395 (Washington,
D.C.: Aug. 14, 2023). As of February 2026, Congress had not introduced
legislation that would address this recommendation.

[64] In our prior work, we found
that effective interagency collaboration benefits from certain leading
practices. See GAO‑23‑105520 .
We selected seven of the eight leading practices based on their applicability
to our scope.

[65] According to IRS officials, to
introduce automated data sharing, IRS requires SBA to obtain statutory
authority to receive taxpayer information directly through an amendment to
section 6103(l) of the Internal Revenue Code. IRS also requires agencies to
have entered into a computerized data matching agreement. Computerized data
matching refers to comparing records (including personally identifiable
information such as names and social security numbers) from two or more systems
to find matches or overlaps. See GAO, Computer Matching Act: OMB and
Selected Agencies Need to Ensure Consistent Implementation , GAO‑14‑44 (Washington,
D.C.: Jan. 13, 2014).

[66] In 2019–2025, SBA and IRS
established 10 agreements to share tax data: one MOU and four addendums related
to COVID 19 EIDL, one covering the Shuttered Venue Operators Grant and
Restaurant Revitalization Fund programs, and three for the Disaster Loan Prog­ram.
Nine of these agreements are expired. The most recent one for the Disaster Loan
Program remains in effect until October 1, 2027.

[67] See 26 U.S.C. §
6103(l).

[68] For example, the Department of
Education has the legal authority to receive taxpayer information directly from
IRS for the federal student loan program. See 26 U.S.C. § 6103(l)(13). However,
the Department of Education also requires applicants to consent to obtaining
their taxpayer information from IRS as part of the federal student loan
application.

[69] Office of Management and
Budget, Policies for Federal Credit Programs and Non-Tax Receivables ,
Circular No. A-129 (Washington, D.C.: revised 2025).

[70] The program closed in May
2022, but SBA continued to make administrative changes to loan records through
June 2024 that are reflected in the data.

[71] According to SBA officials,
the COVID-19 application data SBA provided to us did not reflect more than
300,000 approved loans that were later cancelled and not disbursed. Also,
according to SBA officials, the data did not include around 7 million
applications that were not approved.

[72] We excluded from our analysis
applications from five U.S. territories (American Samoa, Guam, Mariana Islands,
Puerto Rico, and Virgin Islands) that generally are served by territorial tax
authorities (not IRS) unless the business had income that can be sourced (or
connected) to the United States.

[73] Federal Chief Data Officer
Council, Data Sharing Working Group: Findings and Recommendations (Washington, D.C.: 2022).

[74] The four recommendations for
data-sharing needs across federal agencies are (1) expedite agreement process,
(2) improve data awareness, (3) improve data trustworthiness, and (4) establish
the Office of the Chief Data Officer as the central source of information. We
excluded the recommendations to “improve data awareness” and “establish the
Office of the Chief Data Officer” because these were beyond our more focused
engagement scope of assessing the sharing of taxpayer information for COVID-19
EIDL and the Disaster Loan Program.

[75] The eight leading practices
for effective collaboration are (1) define common outcomes, (2) ensure
accountability, (3) bridge organizational cultures, (4) identify and sustain
leadership, (5) clarify roles and responsibilities, (6) include relevant participants,
(7) leverage resources and information, and (8) develop and update written
guidance and agreements. GAO, Government Performance Management: Leading
Practices to Enhance Interagency Collaboration and Address Crosscutting
Challenges , GAO‑23‑105520 (Washington, D.C.: May 24, 2023). We excluded “include relevant
participants” because of its applicability to agency-wide scaled efforts, which
is beyond our more focused engagement scope assessing the sharing of taxpayer
information for COVID-19 EIDL and the Disaster Loan Program.

[76] Office of Management and
Budget, Policies for Federal Credit Programs and Non-Tax Receivables ,
Circular No. A-129 (Washington, D.C.: revised 2025).

File and source

File

26-107682-sba-irs-data-sharing.html

Size

275,108 bytes

SHA-256

99fdb35c37f07111cafee59012124f4fd7dd6d3179f2a25d08074ade87b0d20e

Our copy

26-107682-sba-irs-data-sharing.html

Original

files.gao.gov