SBA Form 2512 CDC SMART Analytic Review

OMB Control Number 3245-0365

Expiration Date XX/XX/XXXX

U.S. SMALL BUSINESS ADMINISTRATION WASHINGTON, DC 20416

Sent via Box email link to CDC Manager Email Address

Month, Day Year

CDC Manager Name

CDC Manager Title

CDC Name

CDC Address

RE: Notice of Selection for SMART Analytical Review

Dear Mr./Ms. CDC Manager Last Name:

The SBA’s Office of Credit Risk Management has selected CDC Name for a SMART Analytical Review. In accordance with 15 USC 657t(c)(2); 13 CFR §120.1000 (Risk-Based Lender Oversight) and 13 CFR §120.1050 (Reviews and Examinations), the U.S. Small Business Administration (SBA) conducts risk-based reviews (Reviews) of its Certified Development Companies (CDCs) to assess portfolio performance, SBA operations management, credit administration, and compliance with loan program requirements.

This Virtual Review protocol features a SMART methodology that assesses component areas which SBA has developed for the oversight of CDCs. The SMART components to be reviewed are Solvency & Financial Condition, Management & Board Governance, Asset Quality & Servicing, Regulatory Compliance, and Technical Issues & Mission.

SBA’s 504 Oversight Contractor, (enter name of contractor here), will be working on your review. In order to facilitate the Review process, please provide the properly indexed documentation listed in the Attachment below by Month, Day Year. Please provide complete responses to each request, as incomplete responses may result in unnecessary deficiencies or Findings.

Please provide the documentation below in electronic format. Each requested item must be a separate document and must be labeled with the corresponding item number in the notification letter and then the document title (e.g., '1. 504 Loans'). If the information is not available, please note the reasons.

Please upload copies of the requested items to Box (a secure file sharing platform) in the required indexed format. A link to access Box has been emailed to you separately.

Thank you for your participation in the 504 lending program. We look forward to working with you during our Review. If you have any questions, please contact (Financial Analyst Name), your assigned Financial Analyst in the Office of Credit Risk Management, at Financial Analyst Email Address. If you have any technical issues, including upload issues, please contact (enter reviewer name here) at (enter reviewer email address here).

Sincerely,

(enter Chief name here)

Chief, Supervised Lender Oversight Division

U.S. Small Business Administration

Office of Credit Risk Management

(enter Chief phone number here)

cc: (Financial Analyst Name), Financial Analyst, Office of Credit Risk Management

(District Director Name), District Director, (enter district office name here)

OMB Control Number 3245-0365

Expiration Date 4/30/2022

Certified Development Company

SMART Analytical Review Information Request

SBA 504 Loan Program Review

Attachment to Notice of Review

In accordance with 15 USC 657t(c)(2); 13 CFR §120.1000 (Risk-Based Lender Oversight); and 13 CFR §120.1050 (Reviews and Examinations), SBA conducts reviews of the SBA loan operations of SBA Lenders. The information requested below assists in SBA’s evaluation of the Certified Development Company’s (CDC’s) portfolio performance; SBA operations management; credit administration; and compliance with Loan Program Requirements.¹ Submission of this information is required so that SBA can conduct that evaluation.

Instructions for the submission of requested information are in the attached cover letter.

**Please note that in general, and for information that has already been provided by a CDC but is unchanged, the CDC may certify that the information was already provided and is unchanged in lieu of resubmitting the information. The certification that must accompany this document submission must also state to whom—and on what date—the information was provided to SBA.

Please provide the following:

Portfolio Performance

1. List of all 504 loans in an Excel spreadsheet with SBA loan number, loan balance, delivery method (regular, 504 Debt-Refi, ALP, or PCLP), borrower’s name, current status of each loan (approved pending funding, current, in catch-up, in deferment, past due [please note number of months past due], purchased by SBA in liquidation, purchased by SBA but returned to regular servicing, purchased by SBA and charged-off by SBA, or paid in full), paid through date, the name of the agent/broker associated with the loan (if applicable), the third party lender, the name of the CDC’s business development officer (BDO) responsible for the loan, the current loan classification (risk rating), and the date of last risk rating classification. For charged-off loans, please only include those loans charged-off in the past five years.

Management and Operations

Organization

2. a) A current organizational chart detailing the position, name, and full-time, part-time or intern designation of each CDC staff member (including management), and b) the month/year that the Executive Director began leading the CDC. For key staff (e.g., CDC management and functional managers), please provide the month/year the individual joined the CDC.

3. Summary of delegations and responsibilities for the executives and program managers of the SBA 504 program. List any significant changes regarding CDC delegations, authorities, responsibilities, and structure since the CDC’s last Annual Report.

4. Most recent list of Board of Directors (Board), Loan Committee, Executive Committee, and Audit Committee members, as applicable, including contact information (phone number and employment city/state), primary employer, and area of expertise (for Loan Committee members, indicate whether the individual has a background in financial risk management, commercial lending, or legal issues relating to commercial lending).

5. Please complete the following Composition Matrix based upon the CDC’s current Board.

	Director’s Role & Committee Membership							Director’s Background & Expertise
No.	Director’s Name	Residence	Company and Title	# of Years on the Board	Voting	Executive	Loan	Commercial Lending	Workforce, Community or Economic Dev.	Financial Risk Management	Corporate Governance	Legal Issues Relating to Commercial Lending	Internal Controls
1
2
3
4
5
6
7
8
9
10

• Enter “N/A” if individual is not a Board Member.

6. Detail the changes to the Board’s composition since the CDC’s last Annual Report submission and include the corresponding effective dates of all changes, as well as the Board minutes that evidence approval of each change.

7. Current curriculum vitae for Board Members.

8. For any Directors who serve on other Boards, please respond to each of the following requests:

   1. Name of the business that the other Board governs;

   2. The type of business and services offered by the business that the other Board governs;

   3. Note whether the business that the other Board governs is a civic, charitable, or comparable organization; and

   4. Note whether the business that the other Board governs is active in financial services, economic development, or loan underwriting.

9. If any Board Members receive compensation, list the recipients, what they receive, and the purpose of this compensation.

10. If the CDC has a Loan Committee (LC); please respond to each of the following requests:

    1. Please provide the procedure by which the LC members recuse themselves to avoid any conflict of interest vote, such as being an employee of a third-party lender bank which is affiliated with the subject loan package being reviewed.

    2. Please indicate the city of all LC members’ home and work, if not submitted with the last Annual Report.

Business Plans

11. The CDC’s Capital Plan detailing actions to raise additional capital, if needed, and the Board meeting minutes documenting discussions and approval of this Capital Plan.

12. The CDC’s current written Investment Policy includes the requirements for the quality of investments, counterparty risk assessments, Board oversight, and reporting.

13. The CDC’s written plan or policy to mitigate the risk of deposits exceeding insurance limits.

14. The CDC’s succession plan for management and key staff functions, and evidence of Board approval.

Financial Information

15. The CDC’s last fiscal year-end audited/reviewed financial statements that have been issued since the CDC last submitted its Annual Report; date of the Board meeting minutes in which the financials were presented, discussed, and approved; and breakout of 504 Revenue by Processing Fees, Servicing Fees, Float Interest revenue, and 504 Expenses. If the CDC is operating as a Multi-State CDC, provide a separate accounting for each state of all 504 fee income and expenses, and evidence that all funds resulting from its Multi-State CDC operations are being invested in economic development activities in each state in which they were generated.

16. Interim financial statement (balance sheet and income statement) as of the most recent quarter-end.

17. A list of the CDC's deposit institutions, and the balance by institution as of the last two fiscal year-ends.

18. The amount of the CDC’s reserves for future operations as of : a) the last two fiscal- year ends; and b) the current quarter. Please provide the line item descriptions that were used in calculating these totals.

19. List the report names/frequency that provide the necessary information for the Board to maintain its awareness of—and direction over—the 504 Loan Program and CDC operations.

20. Strategic and current operating plans, budgets, and comparative performance reports related to the SBA program objectives for portfolio growth, performance, product lines, geographic and industry (i.e., NAICS) concentrations, and the Board meeting minutes documenting discussions and approval of strategic/operating plans.

21. List any inter-CDC affiliations between Board members and CDC staff members. This would include such relationships as a close relative, spouse, parent, child, or sibling who works for the CDC.

22. Updates or changes to the CDC’s Articles of Incorporation and signed bylaws, if not submitted with the last Annual Report. If the bylaws have changed since SBA last reviewed them, please provide either a tracked changes version or a summary of the revisions.

23. The CDC’s current: a) written Executive Compensation policy, b) Executive Director’s compensation package that details the base salary, benefits, and (if applicable) bonus structure. Please provide the Board meeting minutes documenting Board approval of the compensation package and the Board’s annual performance review of the Executive Director (if minutes have been previously provided, please indicate the date of Board approval). If the CDC has conducted a review of executive compensation at peer organizations, please provide a copy of the review.

24. Any other final reports (or, if the report has not been finalized, draft reports) received within the last two years relating to your SBA lending program resulting from:

    1. Internal audits, examinations, reviews, and management letters;

    2. External audits, examinations, reviews, and management letters; and

    3. Management’s response and a summary of actions taken to address the findings and recommendations of each audit, examination, and review. Include Board meeting minutes documenting discussion and decisions made about corrective actions.

25. Most recent audit Engagement Letter from CPA Firm, if not submitted with most recent Annual Report.

26. Evidence that CPA Firm and appointed individual are licensed to practice as public accountants in the CDC’s principal office location.

27. Board meeting minutes documenting CPA Firm discussing/presenting the most recent audit results to the CDCs Board. (If minutes have been previously provided, please indicate the date of Board approval.)

28. Evidence of CPA Firm’s letter to CDC management on internal control weaknesses, if not submitted with the most recent Annual Report.

Eligibility and Credit Administration

29. Final or draft reports on the last two Independent Loan Reviews, to include: a) date of the Board meeting minutes that evidence its review of the Independent Loan Review report; b) date of the Board meeting minutes which evidence its approval to conduct the Independent Loan Reviews; and c) copy of an executed agreement for the next Independent Loan Review and the dates scheduled, if one is pending.

30. Detail the CDC’s practices for evaluating continued creditworthiness (e.g., annual financial statement analysis, credit modeling for portfolio management purposes, etc.). If borrowers do not submit their annual financial statements after repeated attempts by the CDC, what additional steps are taken to evaluate continued creditworthiness? Please identify the location (page number) in the CDC’s Servicing Policy documenting the CDC’s policy for this effort.

31. Credit Policy Manual, Loan Policy and Procedures Manual, and Loan Servicing Policies and Procedures Manual, including meeting minutes documenting the Board’s last review/approval of the policies. Please identify the page(s) in the CDC’s written Loan Policy that details the required abstention procedure.

32. Description of the internal and/or external credit evaluation methodology employed, including credit scoring techniques utilized to:

    1. Screen or evaluate for loan approval; and

    2. Risk rate existing loans.

33. A copy of three most recent Credit Approval Memorandums, along with the corresponding SBA E-Tran Terms and Conditions letters.

34. Please describe your department structure/function for ongoing servicing and for liquidation activities.

35. What is your business model for resolutions (liquidations/purchase requests)?

    1. Is it centralized or decentralized? Please explain.

    2. Are SBA liquidations managed by a “special assets” department? If not, how do you ensure that SBA requirements are met?

36. List of Designated Attorneys (Priority CDCs) and Closing Attorneys (non-Priority CDCs), including contact information, name(s) of state(s) licensed, training certificates for Designated Attorneys, and professional liability insurance policies binders that specifies each attorney's name as being covered in the policy. If a Designated Attorney was granted a hardship waiver from SBA for the policy limit or deductible requirements, please provide a copy of the waiver. Note: Effective January 1, 2018, hardship waivers must be renewed annually.

Compliance with Loan Program Requirements

37. Please complete the table below regarding SBA Training by listing all SBA-specific (do not list non-SBA loan program sessions) training for the last two years for all staff (including the Executive Director) and Board members, name of session, and month/year attended. Please also indicate who conducted the trainings and by what means (e.g., webinar, District Office classroom session, conference session, etc.). Add lines as needed.

Staff/Executive Director/Board Member Name	Title	SBA Loan Program Training Session Attended	Month/Year of Attendance	Training Conducted By

38. For new officers, directors, Loan Committee members, employees, and contractors with a start date in the last three years:

    1. Documentation supporting the submission of Statements of Personal History Forms (SBA Forms 1081) and fingerprint cards (FD 258) to the Office of Financial Assistance for new officers, directors, Loan Committee members, employees, and contractors. Response should include the completed Form 1081, CV, and transmittal correspondence evidencing submission to the Office of Financial Assistance at [email protected], along with the written approval from SBA. Please also provide the date each new staff member began work related to the 504 Loan Program. In addition, if the CDC's address or phone number has changed since January 1, 2018, please provide transmittal correspondence evidencing submission to the Office of Financial Assistance.

39. Minutes of all Board, Executive, and Loan Committee meetings as applicable, for the last 24 months if not submitted with the most recent Annual Report, including evidence that: (i) any affiliated Board and Committee members (i.e. third-party lender) abstained from voting where a potential or actual conflict existed; ii) there was a quorum of at least four members voting on all loan approval decisions; and iii) at least two of the members voting on all loans had a background in commercial lending.

40. List all loans that were provided to CDC associates, the loan date, rate and terms, amount, and their relationship to the CDC.

41. The CDC’s a) written Conflict of Interest Policy, and b) the Board meeting minutes documenting its approval.

42. Internal Control Policy (including Independent Loan Review Policy and Risk Rating system) with the date of the meeting minutes documenting the Board’s last review/approval of the policies.

43. Most recent month-end Central Servicing Agent report on outstanding loans.

44. Quarterly Delinquency Reports submitted to the SBA Loan Servicing Center for the last three quarters, with email documenting when it was sent.

45. A list of all current ongoing litigations, claims, commitments, or contingencies which may impact the CDC’s balance sheet, ratios, or loan covenants.

46. The most recent two years of IRS Form 990 tax returns, if not submitted with the most recent Annual Report.

47. Any renewals, updates, or changes to Directors’ and Officers’ liability insurance policy since the CDC’s submission with the last Annual Report (including all endorsements).

48. Any renewals, updates, or changes to Errors and Omissions liability insurance policy since the CDC’s submission with the last Annual Report.

49. The Board-approved budget for investment in other economic development in each of the states in the CDC’s Areas of Operation for the CDC’s current and prior fiscal years (pursuant to 13 CFR §120.823(d)(10)).

50. The report used by CDC management/Board to monitor its investment in other local economic development, which should include: i) activities with descriptions; ii) amount invested and/or service hours in each of the Board-approved activities; iii) the CDC’s analysis of the impact that the investment had on the community; and iv) evidence of Board approval. Please explain if there were no investments made. This should also include CDC’s dollar amount invested in other local economic development activity for the latest two completed fiscal years.

51. For each non-504 loan program that the CDC administers supporting other local economic development, please provide the dollar amount of loans disbursed through the program during the most recent completed fiscal year, and the outstanding portfolio balance for each program as of the most recent fiscal year-end.

52. The written policy and narrative describing any relationships with—and monitoring of—commissioned non-employees or any other type of non-employee, loan application agents, brokers, or similar individuals. Describe relationship with loan agents and how the CDC tracks/monitors them. In what circumstance does the CDC utilize the agent and what criteria were used to select them? What percent of current production had an agent participation?

53. All executed Professional Service Contracts (for services acquired by the CDC or provided to other CDCs), along with the date of SBA’s pre-approval. Provide the: a) month/year that the Professional Service Provider first began providing services to the CDC; and b) Board minutes that is evidence of its most recent approval of the current contract. Additionally, if the CDC Manager is not a full-time employee, please provide evidence of a waiver for this requirement from SBA (pursuant to 13 CFR §120.824).

54. Is the CDC a Lender Service Provider for any 7(a) lender? If so, please provide a list of all loans packaged in the last 12 months.

55. Latest quarterly PCLP Loan Loss Reserve Fund Report, if applicable, with evidence that it was submitted to the SBA District Office. Copies of the most recent quarterly bank statement statements evidencing PCLP reserve funds on deposit, if applicable.

56. List of all loans issued under the Community Advantage Program (in an Excel spreadsheet), if applicable, with the loan number, borrower's name, original loan amount, date funded, maturity date, and current status.

57. List of all Mezzanine, Microloans, CDFI, or any other loan program managed by the CDC, if applicable, with the loan number, borrower's name, original loan amount, date funded, maturity date, and current status (in an Excel spreadsheet).

58. List of all development grants issued in the last 24 months, if applicable, with the name of each recipient and amount.

59. A copy of bank operating account and short-term investment account statements as of MM/DD/YEAR and any subsequent month-end report.

60. Copies of signature cards for all bank and investment accounts held by the CDC.

61. Copy of Board Books along with all supporting documentation and reports for the latest 24 months.

62. Complete loan files (including all application, closing, and servicing documents) for the loans selected below in electronic form, including:

    1. Evidence of Loan/Executive Committee and Board approval, as applicable, including appropriate abstention of any conflicted committee or Board members.

    2. Full loan payment transcripts of account activity for the most recent 12 months for each loan.

    3. All notes (correspondence between CDC and Borrower during servicing, and correspondence between the CDC and borrower shared with the Sacramento Loan Processing Center at the time of application) for each loan.

    4. All documentation from the small business borrower that support the jobs created/retained figure submitted in your most recent annual report.

Add loan sample list

63. For the following loans, all documentation from the small business borrower that support the jobs created/retained figures submitted in the CDC’s most recent annual report. Include a copy of SBA Form 1244 for each loan listed below.

Add jobs created/retained sample list

Attachment A

OCRM is asking the questions below to learn about what CDCs are doing to address IT Security. While this SMART Review will not take these items into consideration, it is possible that these items will be evaluated in future SMART Reviews.

Please answer the following questions:

1. Have you identified and implemented an information security program that meets requirements for data protection, identity management, and continuous monitoring? If so, who is responsible for the oversight of the program?

2. How do you store data (e.g., in a system, spreadsheet, physically, etc.)?

3. What processes are in place for granting, certifying, and revoking access to systems/data?

4. Have you experienced an information security incident (i.e., data breach)? Do you have an incident response plan?

5. Have you previously done penetration/vulnerability testing?

1 Information requested may be applicable to the evaluation of more than one area.

Note: According to the Paperwork Reduction Act, you are not required to respond to any collection of information unless it displays a currently valid OMB Control Number. The number for this collection of information is 3245-0365. The total estimated time to respond to this collection of information, including gathering and maintaining the data needed, and completing and reviewing the collection of information, is 1620 minutes. You may send comments or questions regarding this estimated time or any other aspect of this collection of information including suggestions for reducing the time or other burden to: Director, Records Management Division, 409 Third Street, S.W., Washington D. C. 20416, and Desk Officer for the Small Business Administration, Office of Management and Budget, New Executive Office Building, Room 10202, Washington DC 20503. PLEASE DO NOT SEND FORMS TO THESE ADDRESSES.

Disclosure of Information – Requests for information contained herein may be denied unless SBA has the written permission of the individual to release the information to the requestor or unless the information is subject to disclosure under the Freedom of Information Act, 5 U.S.C. §552. The Privacy Act, 5 U.S.C. §552a, authorizes SBA to make certain “routine uses” of information protected by that Act. One such routine use is the disclosure of information maintained in SBA’s system of records when this information indicates a violation or potential violation of law, whether civil, criminal, or administrative in nature. Specifically, SBA may refer the information to the appropriate agency, whether Federal, State, local or foreign, charged with responsibility for, or otherwise involved in investigation, prosecution, enforcement, or prevention of such violations. Another routine use is disclosure to other Federal agencies conducting background checks but only to the extent the information is relevant to the requesting agencies’ function. See, 74 F.R. 14890 (2009), and as amended from time to time for additional background and other routine uses.

SBA Form 2512 [INSERT EFFECTIVE DATE] Previous edition is obsolete