The SBA FOIA Loan Datasets: Structure and Suppression

The Small Business Administration publishes every 7(a) and 504 loan it has approved since fiscal 1991, borrower by borrower, under the Freedom of Information Act. It is the largest loan-level credit dataset any lender can open without a subscription, it is free, and it is quarterly. It is also the most misread file in small-balance commercial lending, because it looks complete and is not.

It is also one of the load-bearing sources in the public-data stack for commercial real estate analysis, which is exactly why reading it wrongly is expensive.

The gap is not a defect. It is a disclosure rule doing exactly what it was written to do, and it has a specific consequence: the most recent loans, the ones an analyst most wants to learn from, are the ones the file deliberately says least about. An analyst who does not know this will compute a number that is not merely imprecise but pointed in the wrong direction. This article is about the structure of the files, the caveats that govern them, and the suppression that makes honest work possible.

Where the file comes from

The two programs behind the data are statutory. Section 7(a) of the Small Business Act, codified at 15 U.S.C. 636, authorises the guaranteed business loans that make up the larger file. The 504 programme runs through certified development companies under 15 U.S.C. 695 and 696, with the operating rules at 13 CFR Part 120, including 13 CFR 120.801 on how a project is financed and 13 CFR 120.861 on the company's role. Knowing the citations matters less for the analysis than knowing that the two files describe two structurally different transactions, which is why their schemas differ.

The publication itself rests on the Freedom of Information Act, 5 U.S.C. 552. The agency releases loan-level records because the statute requires disclosure, and it withholds the status of live disbursed loans because Exemption 4 protects confidential commercial information. Both halves of that sentence are the statute operating normally. The analyst's job is not to work around the exemption but to compute only what the disclosed population supports.

One consequence is worth stating for anyone planning a long series. Because the exemption attaches to the current state of a loan rather than to its vintage, a loan that is exempt today becomes visible the moment it pays off or charges off. The file is therefore not a fixed historical record that gains rows over time; it is a moving picture in which old rows change status. A figure computed from the FY2010 to FY2019 file this quarter will not reproduce exactly next quarter, and the difference is not an error in either.

It is six files, not one

The first thing to know is that "the SBA tape" does not exist as a single object. The FOIA release is six comma-separated files: four covering 7(a) and two covering 504, all published as of 30 June 2026 at the time of writing, refreshed quarterly with data typically available one month after the quarter ends.

The 7(a) files split at FY1991 to FY1999, FY2000 to FY2009, FY2010 to FY2019, and FY2020 to the present. The 504 files split at FY1991 to FY2009 and FY2010 to the present. Read those windows carefully, because they are not equal. The 7(a) segmentation is roughly decadal while the 504 segmentation is roughly two decades, so a per-file summary statistic is computed over a different span depending on which file produced it. Comparing a 504 file to a 7(a) file without normalising for the window is one of the two most common errors in work built on this data.

The files are also large. Measured by their HTTP content length on 24 August 2026, the four 7(a) files run 139.6 MB, 303.7 MB, 243.3 MB and 172.7 MB, and the two 504 files run 51.1 MB and 56.7 MB, for 1,014,104,487 bytes in total, about 967 MB. That matters in a mundane way that shapes how the work gets done: this is not a spreadsheet. Opening the FY2000 to FY2009 file in a desktop spreadsheet application is not a strategy, and the working method for anyone without a database is a streamed read that aggregates as the bytes arrive and stores nothing.

The fields, and what each program carries

The two programs publish overlapping but different schemas. Reading the header rows directly on 24 August 2026, the 7(a) file carries 42 fields and the 504 file 39, of which 30 are shared.

The shared core is the part most analysis rests on: the borrower's name and address, the gross approval amount, the approval date and fiscal year, the first disbursement date, the processing method, the term in months, the NAICS code and description, the franchise code and name, the project county and state, the SBA district office, the congressional district, the business type, the business age, the loan status, the paid-in-full and charge-off dates, the gross charge-off amount, the jobs supported, and a collateral indicator.

The differences follow the structure of each program. The 7(a) file adds 12 fields that exist because a single bank makes the loan under a government guaranty: the bank's name, its FDIC and NCUA numbers, its address, the SBA-guaranteed portion of the approval, the initial interest rate, a fixed or variable indicator, a revolver status flag, and an indicator for whether the loan was sold on the secondary market. The 504 file adds 9 fields that exist because the structure has three parties: the certified development company's name and address, and the third party lender's name, city, state and dollar contribution.

That asymmetry is analytically useful rather than a nuisance. The 504 file is the only free public source that names the third party lender and its dollar contribution on a project-by-project basis, which makes it the natural starting point for anything about how data moves through the 504 workflow. The 7(a) file is the only one that identifies the originating bank by regulator-issued number, which is what makes lender-level analysis possible at all.

ProcessingMethod, and the pointer that has gone stale

One field repays more attention than it usually gets. ProcessingMethod records the specific authority a loan was approved under, and it is the closest thing the file has to a marker of how much scrutiny the credit received before approval. The 504 side carries eight values: 504 for basic, 5RF for the commercial real estate refinance programme, 5RE for the refinancing programme, ALP for the accredited lenders programme, 5EX for ALP Express, 5XR for ALP Express debt refinance, 5RX for PCLP debt refinance, and PCP for the premier certified lenders programme. The 7(a) side carries its own set, including 7AG for general processing, 7EW for 7(a) with an export working capital component, WCP for the working capital programme, SGC for a builders line of credit, and the community advantage codes.

The distinction that matters analytically is delegated against non-delegated authority. A loan approved under a delegated method was underwritten by the lender and processed on the lender's judgment; a loan sent to the agency for approval was reviewed centrally. Mixing the two in a single performance cohort blends two different underwriting regimes, and the field is the only way to separate them.

There is also a documentation trap here, and it is a good example of why the bytes deserve a second look. The data dictionary directs the reader to SOP 50 10 5 for the definitions and rules behind each processing method. That standard operating procedure has been superseded repeatedly; the version in force since 1 June 2025 is SOP 50 10 8, with 50 10 8.1 carrying a later effective date. The pointer is stale even though the codes are current, so the definitions have to be read against the SOP actually in force at the vintage of the loan rather than against the one the dictionary names.

LoanStatus, and the code that hides the present

Every question about outcomes runs through one field. LoanStatus carries five values in the 7(a) files and six in the 504 files, and the data dictionary defines them: CANCLD for cancelled, CHGOFF for charged off, COMMIT for undisbursed on the 7(a) side and NOT FUNDED for the same thing on the 504 side, PIF for paid in full, and CLOSED on the 504 side for a loan closed for any reason other than those, a status the dictionary states is no longer in use.

The fifth value is the one that governs everything. EXEMPT, in the dictionary's own words, is the status of loans that have been disbursed but have not been cancelled, paid in full or charged off, and those loans are exempt from disclosure under FOIA Exemption 4. In plain terms: a loan that is alive and performing has no published outcome. The file tells you about loans that have finished. It is silent, by law, about loans still running.

This is not a data quality problem and it is not something a better extract can fix. It is the statute working as intended, protecting confidential commercial information about live credits. But it means the file is a register of resolved outcomes wearing the costume of a complete loan book.

The denominator problem

Here is what that does to a number, measured rather than asserted. Streaming three of the six files on 24 August 2026 and counting LoanStatus on every row produces the following.

The 7(a) file for FY2010 to FY2019 holds 545,751 loans. Of those, 394,721 are paid in full, 66,744 cancelled, 50,089 exempt, 34,153 charged off and 44 undisbursed. The cohort is mature: about nine in ten rows have reached a terminal state, and only 9.2% remain exempt.

The 7(a) file for FY2020 to the present holds 388,338 loans, and the composition is inverted. 242,061 are exempt, 68,201 paid in full, 50,104 cancelled, 21,079 undisbursed and 6,893 charged off. Nearly two thirds of the cohort, 62.3%, is exempt. These loans are running, so the file says nothing about how they end.

Now compute a charge-off rate the obvious way, dividing charge-offs by every row in the file. The FY2010 to FY2019 cohort returns 6.26%. The FY2020 to present cohort returns 1.78%. Read naively, recent 7(a) lending looks about three and a half times safer than the lending of the 2010s, and that reading is wrong.

Divide instead by the loans that actually reached an outcome, the paid-in-full and charged-off rows together, which is the only denominator the file supports. The FY2010 to FY2019 cohort returns 34,153 charge-offs against 428,874 resolved loans, or 7.96%. The FY2020 to present cohort returns 6,893 against 75,094, or 9.18%. On the honest basis the recent cohort is not three and a half times safer. It is modestly worse.

The entire reversal is censoring. The naive rate divides a partial numerator by a complete denominator, and because young cohorts are mostly still running, it pushes their apparent loss rate toward zero. The effect is largest exactly where the stakes are highest, in the most recent vintages, and it always flatters them. A credit committee shown a chart of falling default rates by vintage year, built from this file without the correction, is being shown the passage of time rather than the performance of loans.

The 504 side behaves the same way for the same reason. The FY2010 to present file holds 117,983 loans, of which 57,449 are exempt, 36,624 paid in full, 14,469 cancelled, 8,516 not funded, 923 charged off and 2 still carrying the retired CLOSED code. The naive rate is 0.78% and the resolved-loan rate is 2.46%, a factor of about three between the two ways of writing the same fact.

None of this makes the file unusable. It makes it usable for a narrower and better-defined question: of the loans in this cohort that have finished, what share finished badly? That question the tape answers with a precision no paid summary can match, because it answers it loan by loan. The same discipline underlies the performance work by property type, which cuts the resolved population by industry rather than by vintage.

The suppression rule, and why it is not optional

The censoring problem interacts with a second rule that any honest use of this data must apply. Once a cohort is cut finely enough, by NAICS code, by county, by franchise, by lender, the resolved population in each cell becomes small, and a rate computed on a handful of loans is noise presented as a finding.

The standard applied across this platform is a minimum cohort of 10 loans: no performance rate is published or implied for any cohort of fewer than 10 loans, and cells below the floor are aggregated upward or omitted. The rule binds hardest precisely where the analysis is most interesting, because the interesting cuts are the fine ones. A six-digit NAICS code in a single county over a single fiscal year will routinely produce cells of two or three resolved loans, and a 50% charge-off rate computed on two loans is not a rate at all.

The figures published in this article are program-level for that reason. The smallest cohort behind any rate here is 37,547 resolved 504 loans, three and a half orders of magnitude above the floor. Where the cut is finer, as it must be in work about special purpose property risk, the floor decides what can be said.

Rendering traps that cost an afternoon

Two details will silently ruin an extract, and neither is documented anywhere except in the bytes.

The first is that the paid-in-full code is not written the same way in every file. The data dictionary defines it as PIF. The 7(a) files render it as "P I F", with spaces between the letters. The 504 file renders it as "PIF". An analyst who filters the 7(a) files on the documented value gets zero rows and, worse, may conclude that no 7(a) loans were ever paid in full rather than that the filter is wrong. Both spellings were observed directly on 24 August 2026 in the FY2010 to FY2019, FY2020 to present and 504 FY2010 to present files.

The second is that retired codes persist in the data. The dictionary states that CLOSED is no longer in use, and the 504 FY2010 to present file nonetheless carries two rows with that status. Two rows in 117,983 will not move a program-level number, but a completeness check that assumes the documented code list is exhaustive will fail, and a join keyed on status will drop them silently.

The general lesson is the one the rest of this library keeps arriving at: the documentation describes the intent of a file and the bytes describe the file. Where they disagree, the bytes win, and the only way to know they disagree is to look. That is the practical content of the provenance standard.

Working the file without a database

Because the six files total about 967 MB, the practical question is how to get an answer out of them on a laptop. The method that works, and the one used for every figure in this article, is a streamed aggregation: request the file over HTTP, parse it as it arrives, update counters row by row, and keep nothing. Memory holds a few counters rather than a million rows, and the disk never receives the file at all.

Three details make the difference between a streamed read that works and one that quietly lies. Parse with a real comma-separated-values reader rather than splitting on commas, because borrower names and street addresses contain commas inside quoted fields and a naive split will shift every subsequent column on exactly the rows most likely to be interesting. Resolve column positions from the header row rather than hard-coding an index, because the 7(a) and 504 schemas differ and the position of LoanStatus is not the same in both. And count the rows you actually processed, then check that number against the row count you expected, because a truncated stream produces a smaller but perfectly plausible answer.

For a ranged read, where only the structure is needed rather than the contents, an HTTP range request for the first few thousand bytes returns the header row and a handful of records, which is enough to enumerate fields and see how values are formatted. That is how the field counts and the spacing of the paid-in-full code in this article were established, and it costs a fraction of a second against a file of several hundred megabytes.

The method also has a governance benefit worth naming. A streamed read leaves nothing on the machine to manage, back up or forget about, which keeps a research process from turning into a data retention problem.

What the tape does not carry

Knowing the absences is as important as knowing the fields, because each absence is a question the file cannot answer no matter how it is queried.

There is no property address. The borrower's address is published and the project county and state are published, but the collateral itself is not located, so any geographic work is at borrower or county resolution rather than parcel resolution. There is no property type, only NAICS code, so property type has to be inferred from the industry of the borrower, which is an inference and should be labelled as one. There is no appraised value, no loan-to-value ratio, no debt service coverage ratio and no financial statement data, so the file supports outcome analysis and not underwriting analysis. There is no interest rate history on the 504 side and only an initial rate on the 7(a) side. There is no servicing history, no delinquency record short of charge-off, and no modification record, so a loan that struggled and recovered is indistinguishable from one that never missed a payment.

The jobs field deserves its own warning, because it is the one most often quoted without qualification. JobsSupported is defined as jobs created plus jobs retained as reported by the lender on the loan application, and the dictionary states plainly that SBA does not review, audit or validate those numbers. It is an application figure, not an outcome, and it should be described that way or left alone.

Joining the tape to other public data

The file becomes considerably more useful when it is joined to other public sources, and the join keys it offers determine what is possible.

NAICS code is the strongest key. Because every loan carries a six-digit industry code, the tape joins cleanly to County Business Patterns for establishment counts and to the Quarterly Census of Employment and Wages for employment and wages in the same industry and county. That supports a question the tape cannot answer alone: not merely how many loans went to an industry, but how many loans went to it relative to how many businesses exist in it. A raw count of loans by industry is mostly a map of how large the industry is; a rate against establishment counts is closer to a measure of credit intensity.

Geography joins at county level through ProjectCounty and ProjectState, and at congressional district level through the district field. This is where the absence of a property address binds. County is a coarse unit for commercial real estate, and a county-level figure will average an urban core with its exurbs, so any map built from this file should be read as a map of where borrowers are rather than where collateral sits. The distinction matters most in large western counties, where a single county can span an entire metropolitan area and its rural surroundings.

Time joins through ApprovalFY and ApprovalDate, and this is where the vintage discipline described earlier has to be applied rather than assumed. A join of loan vintages to an economic series by year is straightforward arithmetic and will produce a chart whether or not the cohorts are comparable, so the exempt share of each vintage belongs on the same chart or in the same table.

The franchise fields support a cut that few other public sources allow. FranchiseCode and FranchiseName identify loans to franchised businesses, which makes it possible to compare outcomes across brands within an industry on resolved loans. It is also the cut where the suppression floor bites soonest, because most individual brands will not have 10 resolved loans in a given window, and the honest response is to aggregate brands upward or to widen the window rather than to publish a rate on four loans.

Two joins that look available are not. There is no key linking a loan to a specific property, so the tape cannot be joined to assessor records, flood layers or any parcel-level source. And there is no borrower identifier stable across loans, so a borrower who took two loans appears as two rows with matching names and no guarantee that the match is the same entity, which makes borrower-level histories a matter of fuzzy matching and stated confidence rather than a lookup.

How to read it honestly

A defensible method on this data comes down to five habits, each of which follows from something above.

Name the file and the vintage. Every figure should carry which of the six files it came from and the as-of date printed in the file itself, because a figure from the FY2010 to FY2019 file as of 30 June 2026 is a different object from the same figure computed a quarter later.

State the denominator in the sentence, not the footnote. "7.96% of resolved loans" and "6.26% of all approved loans" are both true of the same cohort and mean different things, and only the first is a loss rate.

Never compare cohorts of different maturity on the naive basis. If vintages must be compared, compare them on resolved loans, and say what share of each vintage is still exempt so the reader can judge how much the comparison is worth.

Apply the cohort floor before looking at the answer, not after. Deciding the minimum cell size once the interesting cells are visible is how a suppression rule becomes a presentation choice.

Check the bytes against the dictionary once per refresh. The codes are stable enough to trust and not stable enough to assume, and a quarterly file gives four chances a year to be surprised.

Record the method, not just the result. Because the file moves as loans resolve, a figure is reproducible only if the note beside it says which file, which as-of date, which status values were counted into the numerator and the denominator, and how many rows were processed. That is four short clauses, and it is the difference between a number a colleague can rebuild next quarter and a number that has to be taken on trust. It is also the reason every figure in this article names its file and its retrieval date.

One habit is worth adding for anyone presenting this work to a credit committee rather than to analysts. Show the exempt share on the same slide as the rate. A committee that sees 9.18% next to the statement that 62.3% of the cohort has not yet resolved will ask the right question without being prompted, and a committee that sees the rate alone will not know there was a question to ask. Disclosure of the denominator is not a caveat in small print; on this data it is most of the finding.

Applied together these turn the FOIA release into what it actually is: not a loan book, but the largest public register of finished small-business credit outcomes in the United States, and one of the few places where a lender can check an intuition against a million real loans instead of against a vendor's summary of them. The geography of that register is the subject of the SBA lending map, and the way its evidence enters a live credit file is covered in where data enters the SBA file.

MMCG Analytics is built on this principle: a map-first commercial real estate analytics platform for lenders and investors, built by MMCG Invest, LLC of San Francisco on federal, state and public data with source and vintage provenance carried on displayed values. Its SBA analytical layer is derived from these public 7(a) and 504 FOIA datasets, over one million loan records, and applies the minimum-cohort suppression standard described above: no performance rate is shown for cohorts under 10 loans.

Frequently asked questions

What is the SBA FOIA loan data?

It is the Small Business Administration's loan-level release of every 7(a) and 504 loan approved since fiscal 1991, published under the Freedom of Information Act at data.sba.gov. It arrives as six comma-separated files, four covering 7(a) and two covering 504, and it carries borrower name and address, approval amount and date, NAICS code, county, lender or CDC, loan status and charge-off information.

How often is the SBA FOIA loan data updated?

Quarterly. The dataset page states that data is typically available about one month after the quarter has ended. The files current at the time of writing carry an as-of date of 30 June 2026, and each file also carries that date in its own AsOfDate field, which is the value that should travel with any figure computed from it.

Why are so many SBA loans marked EXEMPT?

Because they are still running. The data dictionary defines EXEMPT as the status of loans that have been disbursed but have not been cancelled, paid in full or charged off, and states that those loans are exempt from disclosure under FOIA Exemption 4, which protects confidential commercial information. Measured on 24 August 2026, 9.2% of the 7(a) FY2010 to FY2019 file was exempt against 62.3% of the FY2020 to present file, because the newer cohort has had less time to resolve.

How do you calculate a default rate from SBA FOIA data?

Divide charge-offs by resolved loans, meaning paid in full plus charged off, not by every row in the file. Dividing by every row mixes loans that finished with loans that have not, and because young cohorts are mostly unresolved it pushes their apparent loss rate toward zero. On the 7(a) FY2010 to FY2019 file the two bases give 6.26% and 7.96%; on the FY2020 to present file they give 1.78% and 9.18%. Apply a minimum cohort size before publishing any cut: this platform's standard is 10 loans, and no rate is shown below it.

What fields are in the SBA FOIA loan files?

The 7(a) files carry 42 fields and the 504 files 39, sharing 30. The shared core includes borrower name and address, gross approval, approval date and fiscal year, first disbursement date, processing method, term, NAICS code and description, franchise code and name, project county and state, district office, congressional district, business type and age, loan status, paid-in-full and charge-off dates, gross charge-off amount, jobs supported and a collateral indicator. The 7(a) files add bank identity and pricing fields; the 504 files add the CDC and third party lender fields.

Does the SBA FOIA data include the property address?

No. It publishes the borrower's address and the project county and state, but it does not locate the collateral, so the data cannot be joined to assessor records, flood layers or any parcel-level source. It also carries no appraised value, no loan-to-value ratio, no debt service coverage ratio and no financial statements, which is why it supports outcome analysis rather than underwriting analysis.

Sources

1. U.S. Small Business Administration, 7(a) and 504 FOIA dataset page, files as of 30 June 2026, refreshed quarterly; page read 24 August 2026. https://data.sba.gov/dataset/7a-504-foia
2. U.S. Small Business Administration, 7(a) and 504 FOIA Data Dictionary (xlsx), retrieved 24 August 2026 (LoanStatus code definitions including EXEMPT under FOIA Exemption 4, ProcessingMethod code lists, JobsSupported and CollateralInd definitions). https://data.sba.gov/sites/default/files/uploaded_resources/7a_504_foia_data_dictionary.xlsx
3. U.S. Small Business Administration, FOIA 7(a) FY2010 to FY2019 file as of 30 June 2026; 545,751 rows counted by streamed read and 255,101,999 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_7a_FY2010_FY2019_asof_260630.csv
4. U.S. Small Business Administration, FOIA 7(a) FY2020 to present file as of 30 June 2026; 388,338 rows counted by streamed read and 181,130,871 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_7a_FY2020_Present_asof_260630.csv
5. U.S. Small Business Administration, FOIA 504 FY2010 to present file as of 30 June 2026; 117,983 rows counted by streamed read and 59,412,738 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_504_FY2010_Present_asof_260630.csv
6. U.S. Small Business Administration, FOIA 7(a) FY1991 to FY1999 file as of 30 June 2026; 146,416,885 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_7a_FY1991_FY1999_asof_260630.csv
7. U.S. Small Business Administration, FOIA 7(a) FY2000 to FY2009 file as of 30 June 2026; 318,425,094 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_7a_FY2000_FY2009_asof_260630.csv
8. U.S. Small Business Administration, FOIA 504 FY1991 to FY2009 file as of 30 June 2026; 53,616,900 bytes by HTTP content length, 24 August 2026. https://data.sba.gov/sites/default/files/uploaded_resources/FOIA_504_FY1991_FY2009_asof_260630.csv
9. United States Code, 15 U.S.C. 636, section 7(a) of the Small Business Act, current text 2026. https://www.law.cornell.edu/uscode/text/15/636
10. United States Code, 15 U.S.C. 695, development company loans, current text 2026. https://www.law.cornell.edu/uscode/text/15/695
11. United States Code, 15 U.S.C. 696, loans for plant acquisition, construction, conversion and expansion, current text 2026. https://www.law.cornell.edu/uscode/text/15/696
12. Code of Federal Regulations, 13 CFR 120.801, how a 504 project is financed, current text 2026. https://www.law.cornell.edu/cfr/text/13/120.801
13. Code of Federal Regulations, 13 CFR 120.861, the certified development company's role, current text 2026. https://www.law.cornell.edu/cfr/text/13/120.861
14. United States Code, 5 U.S.C. 552, the Freedom of Information Act, including Exemption 4, current text 2026. https://www.law.cornell.edu/uscode/text/5/552
15. U.S. Small Business Administration, SOP 50 10 8, Lender and Development Company Loan Programs, effective 1 June 2025, cited for the currency of the standard operating procedure the data dictionary points at; document text read 24 August 2026. https://legacy.sba.gov/sites/default/files/2025-05/SOP%2050%2010%208%20Technical%20Updates%20effective%206.1.2025.docx
16. MMCG Research, loan status composition and resolved-loan charge-off rates computed from the SBA 7(a) and 504 FOIA files as of 30 June 2026 by streamed read, 24 August 2026. https://mmcganalytics.com