SBA Form 2508 Notice of Selection for SMART Full Review and Form

U.S. SMALL BUSINESS ADMINISTRATION WASHINGTON, DC 20416

OMB Control Number 3245-0365

Expiration Date XX/XX/XXXX

Sent via Box email link to [CDC email address]

[Date]

[CDC Contact Name]

[CDC Contact Title]

[CDC Name]

[CDC Address]

[CDC Address]

RE: Notice of Selection for SMART Full Review

Dear [Mr./Ms.] [CDC Contact Name]:

The SBA’s Office of Credit Risk Management has selected [CDC Name] for a SMART Full Review scheduled for [Date] to [Date]. We anticipate holding the entrance conference on the morning of [Date], at a time to be mutually agreed. Due to the current COVID-19 situation, this review will be conducted remotely.

In accordance with 15 USC 657t(c)(2), 13 CFR §120.1000 (Risk-Based Lender Oversight), and 13 CFR §120.1050 (Reviews), the U.S. Small Business Administration (SBA) conducts risk-based reviews (Reviews) of its Certified Development Companies (CDCs) to assess: portfolio performance; SBA operations management; credit administration; and compliance with Loan Program Requirements as defined in 13. CFR 120.10.

The Review protocol features a SMART methodology that assesses the above areas within review components that SBA has developed for the oversight of CDCs. The SMART components to be examined are as follows: Solvency & Financial Condition, Management & Board Governance, Asset Quality & Servicing, Regulatory Compliance, and Technical Issues & Mission.

SBA’s 504 Oversight Contractor, (Contractor Name) will be working on your review. Attached is a list of items required from you for pre-site review and during the review. In order to facilitate the Review process, please provide the properly-indexed documentation listed in the Attachment below by [Date]. Please provide complete responses to each request, as incomplete responses may result in unnecessary deficiencies or Findings.

Please provide the documentation below in electronic format. Each requested item must be a separate document and labeled with the corresponding item number in the notification letter and then the document title (e.g., '1. 504 Loans'). If the information is not available, please note the reasons.

Please upload copies of the requested items to Box (a secure file sharing platform) in the required indexed format. A link to access Box will be emailed to you later today.

Thank you for your participation in the 504 lending program. We look forward to working with you during our Review. Should you have any questions, please contact [Financial Analyst], your assigned Financial Analyst in the Office of Credit Risk Management, at [Financial Analyst email address]. If you have any technical issues, including upload issues, please contact XXXX XXXX at [email protected].

Sincerely,

XXXXXXXx

Chief, Supervised Lender Oversight Division

U.S. Small Business Administration

Office of Credit Risk Management

cc:

OMB Control Number 3245-0365

Expiration Date X/XX/XXXX

Certified Development Company

SMART Full Review Information Request

SBA 504 Loan Program Review

Attachment to Notice of Review

In accordance with 15 USC 657t(c)(2), 13 CFR §120.1000 (Risk-Based Lender Oversight) and 13 CFR §120.1050 (Reviews and Examinations), SBA conducts reviews of the SBA loan operations of SBA Lenders. The information requested below assists in SBA’s evaluation of the Certified Development Company’s (CDC’s) portfolio performance; SBA operations management; credit administration; and, compliance with Loan Program Requirements.P0F¹P Submission of this information is required so that SBA can conduct that evaluation.

Instructions for the submission of requested information are in the attached cover letter.

**Please note, in general, for information that has already been provided by a CDC but is unchanged, the CDC may certify that the information was already provided and is unchanged in lieu of resubmitting the information. The certification that must accompany this document submission must also state to whom and on what date the information was provided to SBA.

Please provide the following:

Portfolio Performance

1. List of all 504 loans in an Excel spreadsheet with SBA loan number, loan balance, delivery method (regular, 504 Debt-Refi, ALP or PCLP), borrower’s name, current status of each loan (approved pending funding, current, in catch-up, in deferment, past due [please note number of months past due], purchased by SBA in liquidation, purchased by SBA but returned to servicing, purchased by SBA and charged-off by SBA, or paid in full), paid through date, the name of the agent/broker associated with the loan (if applicable), the third party lender, the name of the CDC’s business development officer (BDO) responsible for the loan, the current loan classification (risk rating), and date of last risk rating classification. For charged-off loans, please only include those loans charged-off in the past five years.

Management and Operations

Organization

2. Please provide a) a current organizational chart detailing the position, name and full-time, part-time or intern designation of each CDC staff member including management, and b) the month/year that Executive Director began leading the CDC. For key staff (i.e. CDC management and functional managers), please provide the month/year the individual joined the CDC.

3. Summary of delegations and responsibilities for the executives and program managers of the SBA 504 program. List any significant changes regarding CDC delegations, authorities, responsibilities, and structure since the CDC’s last Annual Report.

4. Most recent list of Board of Directors (Board), Loan Committee, Executive Committee, and Audit Committee members, as applicable, including contact information (phone number and city and state of residence and employment), primary employer and area of expertise. 13 CFR §120.823.

5. Please complete the following Composition Matrix based upon the CDC’s current Board.

	Director’s Role & Committee Membership							Director’s Background & Expertise
No.	Director’s Name	Residence (city/state)	Company and Title	# of Years on the Board	Voting	Executive	Loan	Commercial Lending	Workforce, Community or Economic Dev.	Financial Risk Management	Corporate Governance	Legal Issues Relating to Commercial Lending	Internal Controls
1
2
3
4
5
6
7
8
9
10

6. Detail the changes to the Board’s composition since the CDC’s last Annual Report submission and include the corresponding effective dates of all changes and the Board minutes that evidence approval of each change.

7. Current curriculum vitae for Board Members.

8. For any Directors who serve on other Boards, please respond to each of the following requests:

   1. Name of the business or other entity that the other Board governs;

   2. The type of business or other entity and services offered by the business or other entity that the other Board governs;

   3. Note if the business or other entity that the other Board governs is a civic, charitable or comparable organization; and

   4. Note if the business or other entity that the other Board governs is active in financial services, economic development or underwriting loans.

9. If any Board Members receive compensation, describe who receives compensation, what amount they receive, and for what purposes.

10. If the CDC has a Loan Committee (LC); please respond to each of the following requests:

    1. Please provide the procedure by which the LC member recuses themself to avoid any conflict of interest vote, such as being an employee of a third-party lender bank who is affiliated with the subject loan package being reviewed.

    2. Please indicate the city of each LC members’ home and work, if not submitted with the last Annual Report.

Business Plans

11. The CDC’s Capital Plan detailing actions to raise additional capital, if needed, and the Board meeting minutes documenting discussions and approval of this Capital Plan.

12. The CDC’s current written Investment Policy that includes the requirements for the quality of investments, counterparty risk assessments, Board oversight, and reporting.

13. The CDC’s written plan or policy to mitigate the risk of deposits exceeding insurance limits.

14. The CDC's succession plan for management and key staff functions, and evidence of Board approval.

Financial Information

15. The CDC’s last fiscal year-end audited/reviewed financial statements that have been issued since the CDC last submitted its Annual Report; and, date of the Board meeting minutes in which the financials were presented, discussed and approved, and breakout of 504 Revenue by Processing Fees, Servicing Fees, Float Interest revenue, and 504 Expenses. If the CDC is operating as a Multi-State CDC, provide a separate accounting of each state of all 504 fee income and expenses and evidence that all funds resulting from its Multi-State CDC operations are being invested in economic development activities in each state in which they were generated.

16. Interim financial statement (balance sheet and income statement) as of the most recent quarter-end.

17. A list of the CDC's deposit institutions, and the balance by institution as of the last two fiscal year-ends.

18. The amount of the CDC’s reserves for future operations as of the i) last two fiscal year-ends and, ii) the current quarter. Please provide the line item descriptions that were used in calculating these totals.

19. List the report names/frequency that provide the necessary information for the Board to maintain its awareness of and direction over the 504 Loan Program and CDC operations.

20. Strategic and current operating plans, budgets and comparative performance reports related to the SBA program objectives for portfolio growth, performance, product lines, and geographic and industry (i.e., NAICS) concentrations, and the Board meeting minutes documenting discussions and approval of strategic/operating plans.

21. List any inter-CDC affiliations between Board members and CDC staff members. This would include such relationships as a close relative, spouse, parent, child, or sibling that works for the CDC.

22. Updates or changes to the CDC’s Articles of Incorporation and signed bylaws, if not submitted with the last Annual Report. If the bylaws have changed since SBA last reviewed them, please provide either a tracked changes version and a summary of the revisions.

23. The CDC’s current: a) written Executive Compensation policy, b) Executive Director’s compensation package that details the base salary, benefits, and if applicable, bonus structure. Please provide the Board meeting minutes documenting Board approval of the compensation package and the Board’s annual performance review of the Executive Director (if minutes have been previously provided, please indicate the date of Board approval). If the CDC has conducted a review of executive compensation at peer organizations, please provide a copy of the review.

24. Any other final or, if the report has not been finalized, draft reports received within the last two years relating to your SBA lending program resulting from:

    1. Internal audits, examinations, reviews and management letters;

    2. External audits, examinations, reviews and management letters; and

    3. Management’s response and a summary of actions taken to address the findings and recommendations of each audit, examination, and review. Include Board’s meeting minutes documenting discussion and decisions made about corrective actions.

25. Most recent audit Engagement Letter from CPA Firm, if not submitted with most recent Annual Report.

26. Evidence that CPA Firm and appointed individual are licensed to practice as public accountants in the CDC’s principal office location.

27. Please provide the Board meeting minutes documenting CPA Firm discussing/presenting the most recent audit results to the CDCs Board. (If minutes have been previously provided, please indicate the date of Board approval.)

28. For CDCs with a 504 portfolio balance above $30 milion: Evidence of CPA Firm’s letter to CDC management on internal control weaknesses in accordance with 13 CFR 120.830(a)(1)(e), if not submitted with most recent Annual Report.

Eligibility and Credit Administration

29. Final or draft reports on the last two Independent Loan Reviews to include: a) date of the Board meeting minutes that evidence its review of the Independent Loan Review report b) date of the Board meeting minutes which evidence its approval to conduct the Independent Loan Reviews; and c) copy of an executed agreement for the next Independent Loan Review and the dates scheduled, if one is pending.

30. Detail the CDC’s practices for evaluating continued creditworthiness (e.g., annual financial statement analysis, credit modeling for portfolio management purposes, etc.). If borrowers do not submit their annual financial statements after repeated attempts by the CDC, what additional steps are taken to evaluate continued creditworthiness? Please identify the location (page number) in the CDC’s Servicing Policy documenting the CDC’s policy for this effort.

31. Credit Policy Manual, Loan Policy and Procedures Manual, and Loan Servicing Policies and Procedures Manual, including meeting minutes documenting the Board’s last review/approval of the policies. Please identify the page(s) in the CDC’s written Loan Policy that details the required abstention procedure.

32. Description of the internal and/or external credit evaluation methodology employed, including credit scoring techniques utilized to:

    1. Screen or evaluate for loan approval; and,

    2. Risk rate existing loans.

33. A copy of the three most recent Credit Approval Memorandums along with their corresponding SBA authorization letter.

34. Please describe your department structure/function for ongoing servicing and for liquidation activities.

35. What is your business model for resolutions (liquidations/purchase requests)?

    1. Is it centralized or decentralized? Please explain.

    2. Are SBA liquidations managed by a “special assets” department? If not, how do you ensure SBA requirements are met?

36. List of Designated Attorneys (Priority CDCs) and Closing Attorneys (non-Priority CDCs), including contact information, name(s) of state(s) licensed, training certificates for Designated Attorneys, and professional liability insurance policies binder that specifies each attorney's name as being covered in the policy. If a Designated Attorney was granted a hardship waiver from SBA for the policy limit or deductible requirements, please provide a copy of the waiver. Note: Effective January 1, 2018, hardship waivers must be renewed annually.

Compliance with Loan Program Requirements

37. Please complete the table below regarding SBA Training by listing all SBA-specific (do not list non-SBA loan program sessions) training for the last two years for all staff (including the Executive Director) and Board members, name of session, and month/year attended. Please also indicate who conducted the trainings and by what means (e.g., webinar, District Office classroom session, NADCO conference session, etc.). Add lines as needed.

Staff/Executive Director Name	Title	SBA Loan Program Training Session Attended	Month/Year of Attendance	Training Conducted By

38. For new officers, directors, Loan Committee members, employees, and contractors with a start date in the last three years:

    1. Documentation supporting the submission of Statements of Personal History Forms (SBA Forms 1081) and fingerprint cards (FD 258) to the Office of Financial Assistance for new officers, directors, Loan Committee members, employees, and contractors. Response should include the completed Form 1081, CV, and transmittal correspondence evidencing submission to the Office of Financial Assistance at [email protected], along with the written approval from SBA. Please also provide the date each new staff member began work related to the 504 Loan Program. In addition, if the CDC's address or phone number has changed since January 1, 2018, please provide transmittal correspondence evidencing submission to the Office of Financial Assistance.

39. Minutes of all Board, Executive and Loan Committee meetings as applicable, for the last 24 months if not submitted with the most recent Annual Report, including evidence that: i) any affiliated Board and Committee members (i.e. third-party lender) abstained from voting where a potential or actual conflict existed, ii) there was a quorum of at least five members voting on all loan approval decisions, and iii) at least two of the members voting on all loans had a background in commercial lending.

40. List all loans that were provided to CDC associates, including the loan date, rate and terms, amount, and their relationship to the CDC.

41. The CDC’s a) written Conflict of Interest Policy and b) the Board meeting minutes documenting its approval.

42. Internal Control Policy (including Independent Loan Review Policy and Risk Rating system) with the date of the meeting minutes documenting the Board’s last review/approval of the policies.

43. Most recent month-end Central Servicing Agent report on outstanding loans.

44. Quarterly Delinquency Reports submitted to the SBA Loan Servicing Center for the last three-quarters with email documenting when it was sent.

45. A list of all current ongoing litigations, claims, commitments, or contingencies which may impact the CDC’s balance sheet, ratios, or loan covenants.

46. The most recent two years of IRS Form 990 tax returns, if not submitted with most recent Annual Report.

47. Any renewals, updates or changes to Directors’ and Officers’ liability insurance policy since the CDC’s submission with the last Annual Report with all endorsements.

48. Any renewals, updates or changes to Errors and Omissions liability insurance policy since the CDC’s submission with the last Annual Report.

49. The Board-approved budget for investment in other economic development in each of the states in the CDC’s Areas of Operation for the CDC’s current and prior fiscal years (pursuant to 13 CFR 120.823(d)(10)).

50. The report used by CDC management/Board to monitor its investment in other local economic development, including: i) activities with descriptions, ii) amount invested and/or service hours in each of the Board-approved activities, iii) the CDC’s analysis of the impact that the investment had on the community, and iv) evidence of Board approval. Please explain if there were no investments made. This should also include CDC’s dollar amount invested in other local economic development activity for the latest two completed fiscal years.

51. For each non-504 loan program that the CDC administers supporting other local economic development, please provide the dollar amount of loans disbursed through the program during the most recent completed fiscal year, and the outstanding portfolio balance for each program as of the most recent fiscal year-end.

52. The written policy and narrative describing any relationships with and monitoring of commissioned non-employees or any other type of non-employee, loan application agents, brokers or similar individuals.

53. A list of all executed Professional Service Contracts (for services acquired by the CDC or provided to other CDCs), along with date of SBA’s pre-approval. Provide the a) month/year that the Professional Service Provider first began providing services to the CDC, and b) Board minutes that evidence its most recent approval of the current contract. Additionally, if the CDC Manager is not a full-time employee, please provide evidence of a waiver for this requirement from SBA.

54. Is the CDC a Lender Service Provider for any 7(a) lender? If so, please provide a list of all loans packaged in the last 12 months.

55. List of all loans issued under the Community Advantage Program (in an Excel spreadsheet), if applicable, with the loan number, borrower's name, original loan amount, date funded, maturity date, and current status.

56. List of all Mezzanine, Micro-loans, or any other loan program managed by the CDC, if applicable, with the loan number, borrower's name, original loan amount, date funded, maturity date, and current status (in an Excel spreadsheet).

57. List of all development grants issued in the last 24 months if applicable, with the name of each recipient and amount.

58. A copy of bank operating account and short-term investment account statements as of [date of previous quarter end] and any subsequent month end report.

59. Copies of signature cards for all bank and investment accounts held by the CDC.

60. Evidence of funds held for loan reserve under the PCLP program, if applicable.

61. Copies of Board meeting minutes for the latest 24 months, along with all supporting documentation and reports provided to the board.

62. Available dates for at least three Board Members for individual interviews by the SBA. Please provide times and dates for Board members not previously interviewed during the SMART Review process.

63. All loan files for the loans selected by the SBA for review in electronic or paper format, including:

1. Evidence of Loan/Executive Committee and Board approval, as applicable, including appropriate abstention of any conflicted committee or Board members;

2. Transcripts of account activity for the most recent 12 months for each loan;

3. All notes (correspondence between CDC and Borrower) for each loan; and

4. All documentation from the small business borrower that support the jobs created/retained figure submitted in your most recent annual report.

Attachment A

OCRM is asking the questions below to learn about what CDCs are doing around IT Security. While this SMART Review will not take these items into consideration, it is possible that these items will be evaluated in future SMART Reviews.

Please answer the following questions:

1. Have you identified and implemented an information security program for data protection, identity management, and continuous monitoring? If so, who is responsible for oversight of the program?

2. How do you store data (i.e., in a system, spreadsheet, physically, etc)?

3. What processes are in place for granting, certifying, and revoking access to systems/data?

4. Have you experienced an information security incident (e.g., data breach)? Do you have an incident response plan?

5. Have you previously done penetration/vulnerability testing?

PLEASE NOTE: You are not required to respond to any collection of information unless it displays a currently valid OMB Approval number. The number for this collection of information is 3245-0365. The total estimated time to respond to this collection of information, including gathering and maintaining the data needed, and completing and reviewing the collection of information, is 4200 minutes. You may send comments or questions regarding this estimated time or any other aspect of this collection of information including suggestions for reducing the time or other burden to: Director, Records Management Division, 409 Third Street, S.W., Washington D. C. 20416, and Desk Officer for the Small Business Administration, Office of Management and Budget, New Executive Office Building, Room 10202, Washington DC 20503.

The Privacy Act information you provide will not be disclosed outside of the SBA, except with your consent, and as otherwise allowed by the Privacy Act of 1974, 5 U.S.C. §552a, or unless the information is subject to disclosure under the Freedom of Information Act. 5 U.S.C. §552. The Privacy Act authorizes SBA to make certain “routine uses” of information protected by that Act, which are set forth in SBA’s Systems of Records Notice SOR #21 Loan System at https://www.sba.gov/about-sba/open-government/privacy-act#:~:text=SBA%27s%20System%20of%20Records%20Notices%20(SORNs). SBA has instituted procedures to protect confidentiality and only aggregate and summary data will be provided as appropriate.

1 Information requested may be applicable to the evaluation of more than one area.

SBA Form [2508] (Previous edition is obsolete)