The bill amends Title V of the Small Business Investment Act of 1958 by adding Section 511, which obliges the Administrator of the Small Business Administration to perform an annual portfolio risk analysis for all loans guaranteed under the 504 (Title V) program and to submit the results to Congress. The report must quantify overall program risk, break risk out by industry concentration and loan-size buckets, provide a consolidated (but unnamed) assessment of development companies responsible for at least 1% of gross approvals, and include vintage, borrower-age, and limited/special-purpose property analyses.
It also requires reporting of purchases, collections, charge-offs, enforcement actions, and assessed civil penalties.
Beyond internal review, the bill requires the SBA to post each annual report on its website within seven days of delivering it to Congress. The measure increases program-level transparency and creates new data and reporting obligations that will affect the SBA’s analytics capacity, certified development companies (CDCs), secondary-market participants, and congressional oversight staff.
At a Glance
What It Does
The bill adds Section 511 to Title V, directing the SBA to run an annual risk analysis of the 504 loan guarantee portfolio and to deliver a detailed report to Congress by December 1, 2025 and each year after. The report must include industry concentration analysis, consolidated CDC-level risk for CDCs responsible for ≥1% of approvals, loan-size and vintage breakdowns, borrower-age categories, limited/special-purpose property risk, mitigation steps, and enforcement and loss metrics.
Who It Affects
SBA program staff and risk teams, certified development companies (CDCs) that originate 504 loans, lenders and secondary-market investors in guaranteed paper, and congressional committees overseeing small business finance. Small-business borrowers are indirectly affected through potential changes in underwriting, oversight, or program adjustments driven by the report findings.
Why It Matters
This law creates a formal, recurring mechanism for granular program surveillance that can drive supervisory action, influence investor perception of 504 assets, and identify concentration risks by CDC, industry, loan size, and borrower vintage. For compliance and risk professionals, it signals higher transparency expectations and a greater emphasis on data-driven mitigation.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act inserts a new Section 511 into Title V to formalize annual portfolio-level risk surveillance for the SBA’s 504 loan guarantee program. The SBA must perform a full risk analysis of its guaranteed- loan portfolio and translate that analysis into a written report to Congress.
The first report is due December 1, 2025, and the requirement repeats each year.
The report is prescriptive about the categories the SBA must analyze. It requires an overall program risk statement and separate breakdowns by industry concentration.
The Administrator must produce a consolidated assessment for any development companies that account for at least 1% of gross loan approvals — the analysis must not name CDCs but must show each qualifying CDC’s dollar volume, loan counts, and risk distributed across four explicit loan-size bands. The statute also instructs the SBA to analyze loans by vintage (less than one year, one-to-two years, and over two years) and by borrower business age (startups using the loan to open a business, businesses in operation ≤2 years, and businesses in operation >2 years).
The Act pulls limited or special purpose property into the risk matrix by reference to the SBA’s SOP 50 10 8 definition as of June 1, 2025.Operationally, the bill forces the SBA to assemble or refine data pipelines that connect origination, servicing, charge-off, and enforcement records into a reproducible annual product. It also requires the SBA to disclose loss-mitigation actions taken and to report the number and dollar value of Administrator purchases of defaulted guaranteed loans, related collections and charge-offs, enforcement actions recommended by the agency, and civil monetary penalties assessed.
Finally, the law compels public transparency by requiring the SBA to post the full report on its website no later than seven days after transmitting it to Congress.
The Five Things You Need to Know
The Act adds Section 511 to Title V of the Small Business Investment Act, creating an annual portfolio risk-analysis mandate for SBA 504 guaranteed loans.
The first report is due to Congress by December 1, 2025, and the Administrator must deliver a similar report annually thereafter.
The SBA must publish each report on its website within seven days of submitting it to Congress.
The Act requires a consolidated, unnamed analysis of any development companies responsible for at least 1% of gross loan approvals, including dollar value, loan counts, and risk broken into four loan-size bands (≤$500K; >$500K–≤$1M; >$1M–≤$2M; >$2M–≤$5.5M).
Reports must include vintage and borrower-age risk breakdowns, a flag for limited or special purpose properties (per SOP 50 10 8 as of June 1, 2025), and metrics on purchases, collections, charge-offs, enforcement actions, and civil penalties.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Provides the Act’s name, the '504 Program Risk Oversight Act.' This is procedural but signals the statute’s aim: program-level risk oversight for the SBA 504 portfolio.
Annual portfolio risk analysis requirement
Directs the Administrator to conduct an annual risk analysis of the SBA’s portfolio of loans guaranteed under Title V (the 504 program). Practically, this mandates recurring, institution-level surveillance rather than ad hoc reviews and implies a need for analytic capacity, standardized metrics, and internal QA to produce a defensible annual product.
Overall and industry-concentration risk analyses
Requires the report to present an overall program risk assessment and to disaggregate risk by industry concentration. For program managers and examiners, this creates a mandated view into sectoral exposures — useful for spotting correlated defaults — and sets an expectation that industry-level metrics will be comparable year-to-year.
Consolidated CDC-level analysis for CDCs ≥1% of approvals
Obliges the SBA to produce a consolidated analysis (without naming firms) for any development company accounting for at least 1% of gross loan approvals. For each qualifying CDC the SBA must report dollar volume, loan counts, and risk segmented into four specific loan-size categories. This is a targeted concentration control: it flags CDCs with systemic importance while attempting to preserve anonymity, although the aggregation threshold and disclosure of volume/counts may still allow identification in thin markets.
Vintage, borrower-age, and limited/special-purpose property risk breakdowns
Mandates analyses by loan vintage (origination age buckets), borrower business tenure (startup/opening loan, ≤2 years, >2 years), and exposure for limited or special purpose properties (as defined in SOP 50 10 8 as of June 1, 2025). These breakdowns enable the SBA and external stakeholders to see whether newer loans, younger businesses, or property types concentrate losses and therefore require different underwriting or servicing strategies.
Mitigation, program metrics, loss and enforcement reporting, and public posting
Requires the report to list mitigation steps the Administrator took to address identified risks, counts of CDCs and loans, gross loan amounts, purchases of defaulted guaranteed loans (and recovery/charge-off figures), enforcement actions recommended by the SBA, and assessed civil monetary penalties. It also requires the SBA to post the report publicly within seven days of transmitting it to Congress and defines limited/special-purpose property by reference to the existing SOP. The provision couples transparency with a requirement to describe corrective action, but it does not itself create new enforcement tools beyond reporting.
This bill is one of many.
Codify tracks hundreds of bills on Finance across all five countries.
Explore Finance in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Congressional oversight committees — Get a consistent, evidence-based annual product to evaluate portfolio health and demand corrective action or statutory fixes when concentration or systemic risks appear.
- Secondary-market investors and rating agencies — Obtain standardized disclosures that reduce information asymmetry about 504 asset concentrations, loan-size risk distribution, and servicer/CDC exposure, improving pricing and risk modeling.
- SBA risk and supervisory teams — Gain a statutory mandate and dataset to prioritize examinations, calibrate reserves, and design targeted interventions when industry or CDC concentrations show elevated risk.
- Policy analysts and small-business advocates — Receive public data enabling independent evaluation of program outcomes by borrower vintage, industry, and property type, useful for program reform or technical assistance targeting.
Who Bears the Cost
- Small Business Administration — Must build or expand data collection, analytics, and publication workflows, which requires staff time, IT investment, and ongoing maintenance to meet the annual cadence and public-disclosure timeline.
- Certified Development Companies (CDCs) — Face heightened scrutiny and potential reputational or market consequences when they exceed the 1% approvals threshold, and may need to provide more standardized data to the SBA.
- Lenders and program servicers — May incur additional reporting requirements, operational burden, or changes in origination behavior if SBA uses report findings to tighten underwriting or servicing guidance.
- Taxpayers and appropriators — Indirectly bear the cost if the SBA requires supplemental funding to implement data and analytics improvements; the bill creates an unfunded mandate on agency capacity.
Key Issues
The Core Tension
The central dilemma is transparency versus operational practicality: the bill forces timely, detailed public disclosure to reduce information asymmetry and surface concentration risk, but that disclosure increases data and privacy complexity, may trigger destabilizing market reactions for CDCs and borrowers, and places new analytic and funding burdens on the SBA without granting additional enforcement authority.
The statute mandates granular disclosures but stops short of prescribing analytical methodology, confidentiality protections, or how the SBA should act on findings. That combination raises immediate implementation questions: what risk metrics (PD/LGD, delinquency thresholds, stress scenarios) does the SBA use; how will the agency anonymize CDCs while publishing volumes and counts that could allow identification; and what quality controls will ensure year-over-year comparability?
The Act also ties the limited/special-purpose property definition to an SOP as of a specific date, which fixes meaning at that snapshot but could create mismatch if the SBA later revises the SOP—the statute does not state whether updates to SOP definitions automatically update the statutory reference.
Another tension is between transparency and market effects. Public posting within seven days maximizes timeliness but may create short-term market reactions if the report highlights a concentrated CDC, industry, or loan-size band.
Those market responses could raise funding costs for CDCs or affect secondary-market prices, producing collateral effects on borrowers. Finally, the bill mandates reporting on enforcement actions and civil penalties recommended or assessed, but it does not expand enforcement tools or timelines; reporting may therefore expose problems without prescribing corrective authority or resources to resolve them, potentially leaving the SBA and Congress with information but limited rapid remedies.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.