2024-04830. SBA Lender Risk Rating System

AGENCY:

Small Business Administration.

ACTION:

Notice of revised SBA Lender Risk Rating System; request for comments.

SUMMARY:

This notice implements changes to the Small Business Administration's (SBA's) Lender Risk Rating System. The SBA Lender Risk Rating System is an internal, off-site monitoring tool used by SBA's Office of Credit Risk Management (OCRM) to assess and monitor the risk of each active 7(a) Lender and Certified Development Company (CDC) and to inform supervision and enforcement activities. SBA is also updating the Lender Portal to reflect the changes to the SBA Lender Risk Rating System and corresponding metrics. SBA is publishing this notice with a request for comments to provide the public with an opportunity to comment.

DATES:

Applicability Date: This notice applies March 7, 2024.

Comment Date: Comments must be received on or before May 6, 2024.

ADDRESSES:

You may submit comments, identified by Docket number SBA–2023–0016 by using any of the following methods:

• Federal eRulemaking Portal:http://www.regulations.gov. Identify comments by “Docket Number SBA–2023–0016, SBA Lender Risk Rating System,” and follow the instructions for submitting comments.

• EMail: Edward Ledford, Deputy Director, Office of Credit Risk Management, U.S. Small Business Administration, at [e-mail].

All comments will be posted on http://www.Regulations.gov. If you wish to include within your comment confidential business information (CBI), as defined in the Privacy and Use Notice/User Notice at http://www.Regulations.gov, and you do not want that information disclosed, you must submit the comment by either Mail or Hand Delivery and you must address the comment to the attention of Edward Ledford, Deputy Director, Office of Credit Risk Management, U.S. Small Business Administration, 409 Third Street SW, 8th Floor, Washington, DC 20416. In the submission, you must highlight the information that you consider is CBI and explain why you believe this information should be held confidential. SBA will make a final determination, in its discretion, of whether the information is CBI and, therefore, will be published or not.

FOR FURTHER INFORMATION CONTACT:

Edward Ledford, Deputy Director, Office of Credit Risk Management, U.S. Small Business Administration, 409 Third Street SW, 8th Floor, Washington, DC 20416, (202) 205–7857.

SUPPLEMENTARY INFORMATION:

I. Background Information

The SBA Lender Risk Rating System is a series of predictive default models that use SBA data and borrower credit data to assess the risk of each 7(a) Lender and CDC (each, an SBA Lender) on a uniform basis. The SBA Lender Risk Rating System is a deliverable under OCRM's Loan and Lender Monitoring System (L/LMS) contract. The current model redevelopment is part of the transition of the L/LMS contract to a new vendor.

SBA first introduced the SBA Lender Risk Rating System as a proposal for comment in the Federal Register on May 1, 2006 (71 FR 25624). SBA published the final notice in the Federal Register on May 16, 2007 (72 FR 27611). On March 1, 2010, SBA published a notice describing revisions to the Risk Rating System (75 FR 9257), with a correction notice published on March 18, 2010 (75 FR 13145). In 2014, SBA revised the system again and published a notice and request for comments on April 29, 2014 (79 FR 24053). The most recent revision to the SBA Lender Risk Rating System was published in the Federal Register on February 16, 2021 (86 FR 9562).

II. Request for Comments

This notice provides program participants and other parties with an explanation of the components and a description of other modeling enhancements. SBA welcomes comments and feedback on all aspects of this notice, including but not limited to the components and enhancements. SBA will review any comments received and will consider them during the next update. The changes outlined in this notice will be applicable upon publication of this notice and are expected to be incorporated in the Lender Portal update for December 31, 2023, that will post no later than the end of February 2024.

III. SBA Lender Risk Rating System

(A) Overview

As set forth in 13 CFR 120.1015, SBA may assign a Risk Rating to all SBA Lenders and Intermediaries on a periodic basis. Risk Ratings are based on certain risk-related portfolio performance factors as set forth in notices or SBA's SOPs and as published from time to time. On a quarterly basis, each SBA Lender is assigned a Risk Rating from 1 (which represents the lowest risk and thus that the least degree of SBA oversight is likely needed) to 5 (which represents the highest risk and that the highest degree of SBA oversight is likely needed). As indicated in 13 CFR 120.1400, SBA generally does not use the Risk Rating as the sole basis for taking a formal enforcement action against an SBA Lender pursuant 13 CFR 120.1500. Rather, consistent with SBA's authority to conduct monitoring and reviews under 13 CFR 120.1025 and 120.1050, the primary purpose of the Risk Rating is to focus SBA's oversight resources on those SBA Lenders whose portfolios demonstrate a need for further review and evaluation by SBA.

To calculate each SBA Lender's risk rating, SBA first calculates a risk score for each active 7(a) (non-PPP) and 504 loan based on the likelihood the loan will default in the next 12 months. Then, SBA assigns a Forecasted Purchase Rate (FPR) to each loan based on both the risk score and the default rate of similarly risky SBA loans over the previous 12 months. The FPR calculation will be recalibrated on a quarterly basis. Once the loan-level FPR's are assigned, SBA calculates a Projected Purchase Rate (PPR) for each SBA Lender based on its loan portfolio's weighted average FPR. Finally, SBA will assign a Lender Risk Rating from 1-to-5 based on the PPR where: PPR<1% = LRR 1; PPR 1% to <2% = LRR 2; PPR 2% to <4% = LRR 3; PPR 4% to <8% = LRR 4; & PPR 8%+ = LRR 5. OCRM may change the PPR to LRR assignments in the future, if appropriate.

SBA has and will continue to perform annual validations of the Lender Risk Rating. The personnel performing the validation will be separate from the model developers.

SBA Lenders can access their Risk Rating and other key metrics through SBA's Lender Portal. Additionally, an SBA Lender can view the factors that impact the Risk Rating for each loan in its portfolio.

(B) Redevelopment Process

The goals of the redevelopment include: (i) improve the accuracy of the SBA Lender Risk Rating (LRR); (ii) ensure model reliability across economic conditions; (iii) increase transparency and usability to the SBA Lender; (iv) incorporate the latest SBA performance data; and (v) evaluate new variables that can provide additional insight into SBA Lender and portfolio risk.

SBA reviewed over 500 potential variables from SBA's L/LMS archive along with over 2,500 potential variables from Experian's commercial and consumer sources over a 14-year period (2008 through 2022). This wide array of variables was evaluated using a rigorous and thorough statistical process utilizing the Extreme Gradient Boosted (XGB) machine learned modeling method. Through this method, a comprehensive set of SBA account characteristic and payment behavior variables, and consumer and commercial credit risk variables covering credit age, payment experiences, utilization, derogatory events, and inquiries, was selected and optimized to predict the likelihood of actual defaults.

(C) Enhancements

The most notable changes in the new Risk Rating System are:

1. Utilization of XGB Machine Learned Modeling Method. The XGB machine learned modeling method (XGB) was used to predict the probability of loan default. A significant advantage of XGB is the ability to incorporate hundreds of predictive risk variables through the development of hundreds of decision trees, each learning from the deficiencies of the prior developed trees and able to improve on the deficiencies of the prior developed trees. This ensemble of decision tree models works together to generate a more comprehensive and accurate SBA Lender Risk Rating system.

2. Changes to Segmentation. The redeveloped 7(a) and 504 loan program models each have three segments based on the availability of credit bureau data: (i) a blended segment is used when business and consumer credit information is available from Experian; (ii) a consumer segment is used when only the consumer credit information is available; and (iii) a commercial segment is used when only the commercial credit information is available. SBA loan data is also incorporated in all segments. Each segment comprises an ensemble of up to 300 decision trees utilizing 100+ model variables across the SBA and Experian credit attributes.

3. Model Development Spans Multiple Economic Cycles. The model development population spanned from 2008 through 2022, capturing multiple economic cycles, from the housing market contraction, financial crisis and resulting recession from 2008 through 2010, a period of stable economic prosperity from 2015 through 2019, and the COVID–19 pandemic period from 2020 through 2022. By developing the model across different vintages, SBA avoids creating a model that is fitted and optimized to be predictive in only one specific economic condition. Instead, SBA developed a model that is robust and can perform under varying economic conditions.

(D) Rating Components

The SBA Lender Risk Rating System uses two types of data sources: SBA loan data and Experian credit bureau data. SBA loan data includes detailed loan- and borrower-level information from SBA's database. The credit bureau data includes information on the small business borrower from Experian's credit databases. The borrower information from Experian includes business and business owner credit information. The previous Risk Rating model was designed with six segments that each had a distinct and separate model algorithm using up to eleven data variables. In the new model, each segment comprises an ensemble of up to 300 decision trees and utilizes over a hundred data variables. Below is a summary of the data types and most significant variables.

1. SBA Loan Data Types

• Loan Payment Behavior: the loan's current payment status, historical payment behaviors, months since disbursement, and whether the SBA Lender reported the loan status on their most recent 1502 report.

• Loan characteristics: loan amount, loan term, fixed or variable interest, revolver status, and sold on secondary market indicator.

• Business characteristics: risk associated with the North American Industry Classification System (NAICS) sector.

2. Experian Borrower Data Types

• Consumer information

○ Account payment experiences: how the business owner has been paying their consumer financial obligations currently and historical.

○ Payment experience is assessed across all account types and by specific account types including credit card, line of credit, auto loan and lease, and personal loan.

○ Worst status and number of delinquent accounts are assessed as of the rating date, and historically over multiple intervals, such as past month, 3 months, 6 months, 12 months, etc.

○ Credit depth and history: by all account types and by specific account types.

○ Age of the oldest account and the average age of the oldest account.

○ Number of accounts open, number of recently opened account.

○ Recent credit inquiries.

○ The total balance outstanding.

○ Scheduled monthly payments.

○ The balance to credit ratio.

○ Credit inquiries: recency and frequency of consumer credit inquiries.

• Business information.

○ Account payment experiences: how the business has been paying its financial obligations currently and historically. Factors include the number of current and delinquent accounts, the worst status across all accounts as of the report date and historically up to the past 36 months. Total balance outstanding, balance that is current, and delinquent balance are assessed.

○ Credit depth and history.

○ Total number of accounts, total number of active and inactive accounts, total number of newly opened accounts.

○ Recent credit inquiries.

○ Total balance outstanding.

○ Balance to credit ratio.

○ Derogatory events.

○ Recency, frequency, and dollar value of accounts sent to collections agencies, tax lien filings, judgments, and bankruptcies.

○ Credit inquiries: recency and frequency.

○ UCC filings: recency and frequency.

(E) Overriding Factors

As with prior LRR models, the redeveloped SBA Lender Risk Rating System gives SBA discretion to adjust an SBA Lender's calculated rating on a case-by-case basis when the occurrence of factors not incorporated in the rating (overriding factors) lead SBA to conclude that the calculated rating is not fully reflective of a lender's true risk.

Such overriding factors may apply to a particular SBA Lender or group of SBA Lenders. Overriding factors may result from SBA Lenders' risk-based reviews, examinations and/or evaluations. SBA routinely conducts reviews of SBA Lenders, performs examinations of SBA Small Business Lending Companies (SBLCs) and Non-Federally Regulated Lenders (NFRLs), and uses certain evaluation measures for other SBA Lenders. Examples of other overriding factors include, but are not limited to: enforcement or other actions of regulators or other authorities, including, but not limited to, Cease & Desist orders by, or related agreements with, Federal Financial Institution Regulators (FFIRs); capital adequacy levels not in conformity with FFIRs; secondary market issues and concerns; receipt of a Going Concern opinion issued by an independent auditor; early loan default trends; purchase rate or projected purchase rate trends; abnormally high default, purchase or liquidation rates; denial of liability occurrences; lending concentrations; rapid growth of SBA lending; net yield rate (or losses) significantly worse than average; violation of SBA Loan Program Requirements; inadequate, incomplete, or untimely reporting to SBA; fraud/indictment of lender, officers, or key employees; an identified condition that affects capital, solvency or prudent commercial lending ability; inaccurate submission of required fees or amounts due SBA or the Federal Government; and other risk-related or program integrity concerns.

(F) Confidential Information

Each SBA Lender must handle its Reports, Risk Ratings, and related Confidential Information in accordance with the confidentiality requirements set forth in 13 CFR 120.1060, Confidentiality of Reports, Risk Ratings, and related Confidential Information. Under this regulation, Reports, Risk Ratings, and Confidential Information are privileged, confidential, and the property of SBA. Further, the regulation states that such information may not be relied upon for any purpose other than SBA's lender oversight and SBA's portfolio management purposes. In addition, the SBA Lender is prohibited from disclosing its Report, Risk Rating, and Confidential Information, in full or in part, in any manner, without SBA's prior written permission, and the SBA Lender must not make any representations concerning the information (including Report findings, conclusions, and recommendations), the Risk Rating, or the Confidential Information. SBA Lenders can email [e-mail] to request SBA permission to share this information.

13 CFR 120.1060(a) defines “Report” to mean “the review or examination report and related documents.” It also provides that Confidential Information “is defined in the SBA Lender information portal and by notice issued from time to time.” The SBA Lender information portal currently defines “Confidential Information” to mean all SBA Lender-related information/data contained in the Lender Portal except the dollar amounts associated with SBA purchase of and charge-off of SBA Lender's loans and information already publicly available related to the Lender's capital, non-performing assets, and regulatory actions ( e.g., from a bank's public Call Report). Confidential Information also includes any information related to SBA's supervision of the SBA Lender ( e.g., review or corrective action correspondence) and any actions taken by SBA related to enforcement ( e.g., informal enforcement actions as defined in SOP 50 53 or by regulation, notices of proposed enforcement action) unless made public by SBA ( e.g., in a Cease and Desist Order).

SBA includes the last sentence because it has long treated supervisory and enforcement information as confidential information and this information is generally related to a risk-based review or examination and, therefore, covered by the confidentiality provisions in 13 CFR 120.1060 and/or FOIA exemption 8. SBA may disclose Reports, Risk Ratings, and Confidential Information in its discretion; however, such disclosures do not waive SBA Lender's obligation under 13 CFR 120.1060 to maintain the confidentiality of the information.

(G) Conclusion

In conclusion, industry best practices and changes in the SBA portfolio, programs, and available data necessitate that the SBA Lender Risk Rating System be periodically redeveloped. This notice marks the fourth redevelopment of the SBA Lender Risk Rating System. SBA will further refine the model as necessary to maintain or improve the predictiveness of its risk scoring.

Authority: 15 U.S.C. 633(b)(3); 15 U.S.C. 634(b)(6) and (7); 15 U.S.C. 657t; 15 U.S.C. 687(f); and 13 CFR 120.10, 120.1015, 120.1025, 120.1050, 120.1060.

Isabella Casillas Guzman,

Administrator of the U.S. Small Business Administration.