13 CFR § 120.1060 - Confidentiality of Reports, Risk Ratings and related Confidential Information.
(a) In general. Reports and other SBA prepared review or examination related documents are the property of SBA and are loaned to an SBA Lender or Intermediary for its confidential use only. The Reports, Risk Ratings, and related Confidential Information are privileged and confidential as more fully explained in paragraph (b) of this section. The Report, Risk Rating, and Confidential Information must not be relied upon for any purpose other than SBA's Lender oversight and SBA's portfolio management purposes. An SBA Lender or Intermediary must not make any representations concerning the Report (including its findings, conclusions, and recommendations), the Risk Rating, or the Confidential Information. For purposes of this regulation, Report means the review or examination report and related documents. For purposes of this regulation, Confidential Information is defined in the SBA Lender information portal and by notice issued from time to time. Access to the Lender information portal may be obtained by contacting the OCRM.
(b) Disclosure prohibition. Each SBA Lender and Intermediary is prohibited from disclosing its Report, Risk Rating, and Confidential Information, in full or in part, in any manner, without SBA's prior written permission. An SBA Lender and Intermediary may use the Report, Risk Rating, and Confidential Information for confidential use within its own immediate corporate organization. SBA Lender's and Intermediary's must restrict access to their Report, Risk Rating and Confidential Information to their respective parent entities, officers, directors, employees, auditors and consultants, in each case who demonstrate a legitimate need to know such information for the purpose of assisting in improving the SBA Lender's or Intermediary's SBA program operations in conjunction with SBA's Program and SBA's portfolio management (for purposes of this regulation, each referred to as a “permitted party”), and to those for whom SBA has approved access by prior written consent, and those for whom access is required by applicable law or legal process. If such law or process requires SBA Lender or Intermediaryto disclose the Report, Risk Rating, or Confidential Information to any person other than a permitted party, SBA Lender or Intermediary will promptly notify SBA and SBA's Information Provider in writing and in advance of such disclosure so that SBA and the Information Provider have, within their discretion, the opportunity to seek appropriate relief such as an injunction or protective order prior to disclosure. For purposes of this regulation, “consultants” means only those consultants that are under written contract with an SBA Lender or Intermediary specifically to assist with addressing its Report Findings and Corrective Actions to SBA's satisfaction. The consultant contract must provide for both the consultant's agreement to abide by the disclosure prohibition in this paragraph and the consultant's agreement not to use the Report, Risk Rating, and Confidential Information for any purpose other than to assist with addressing the Report Findings and Corrective Actions. “Information Provider” means any contractor that provides SBA with the Risk Rating. Each SBA Lender and Intermediary must ensure that each permitted party is aware of and agrees to these regulatory requirements and must ensure that each such permitted party abides by them. Any disclosure of the Report, Risk Rating, or Confidential Information other than as permitted by this regulation may result in appropriate action as authorized by law. An SBA Lender and Intermediary will indemnify and hold harmless SBA from and against any and all claims, demands, suits, actions, and liabilities to any degree based upon or resulting from any unauthorized use or disclosure of the Report, Risk Rating, or Confidential Information. Information Provider contact information is available from the Office of Capital Access.