SBA Lending Software Problems: The 6 That Cost Real Money, and How to Avoid Them

Why does encoding the SOP as software logic go wrong so often?

The biggest scope failure in this category is a developer writing the operating procedures into code. It sounds efficient. It is the thing that guarantees the system will be wrong within a year, because SBA revises its operating procedures on its own schedule and the revisions are substantive: which documents are required, what counts as an eligible use of proceeds, what a lender may do unilaterally in servicing, what the collateral requirements are at various loan sizes.

When the rules are code, a change means a development ticket, a release cycle and a compliance officer waiting on an engineer. Worse, a system that only knows today's rules cannot validate a loan approved eighteen months ago, so every historical file it touches looks defective. The franchise question shows how unstable the ground is: responsibility for that determination has moved between SBA maintaining a central directory and the lender carrying it, and any file has to show it applied the rule as it stood on the day of approval.

The fix is to make the requirement set effective dated data that your compliance officer configures. A loan is stamped with the version in force at application and permanently validates against that version. Loans in flight either continue under the old rules or are explicitly migrated with the decision recorded. This one design choice converts an operating procedure change from an annual fire drill into a data entry task, and it is the first thing to ask any prospective developer about.

What goes wrong when you migrate a seasoned portfolio into the new structure?

Most lenders assume the new system starts with new originations and quietly hope the back book comes along too. It will not, and the shape of that problem needs deciding before kickoff rather than in month four.

The existing file estate is typically a shared drive organised by whoever set it up, plus documents inside the origination platform, plus correspondence in a shared mailbox. Documents were named by people, so the same item appears as three filenames. Scans have no structure, which means a signed personal guarantee and an unsigned draft look identical to any automated process. And the determinations you most want, why this applicant was eligible and what the analyst examined, were usually never recorded as anything other than a conclusion, so there is nothing to migrate.

Be blunt about what migration can and cannot achieve. You can attach existing documents to a structured loan record and classify them by type and date, which makes a future purchase package assembly far faster. You cannot retroactively create determination evidence that was never captured, and no software will pretend otherwise honestly.

So scope it by value. Seasoned loans still inside their guarantee life, particularly larger balances and anything showing early stress, are worth classifying and gap reporting now, because a gap found at year three can still be cured and a gap found at liquidation cannot. Everything else can stay where it is.

Why do E-Tran and core banking integrations break after launch?

Submission has its own data discipline and its own rejection behaviour, and the common failure is treating a rejection as an error to display rather than a state to manage. A rejected submission needs to sit in a queue with the reason, the field that failed and the person responsible, and it needs to survive someone going on leave. Lenders that log rejections into an application log discover a loan that never made it through weeks later.

The harder problem is drift. The data SBA holds must continue to match your records for the life of the loan, and that is easy on the day of origination and progressively harder afterwards. The loan boards to the core, the department stops looking at it daily, and then a change in ownership, a collateral release or a deferment happens. Each is a point where the two records diverge quietly.

Core banking integration breaks for a different reason: most cores were not designed to be a source of truth for anyone else, so what you get is often a nightly extract with a fixed layout that changes when the core is upgraded. Ask specifically which core, which version and what the interface actually is, an interface, a file or direct database access, because the answers imply very different maintenance costs.

Build a scheduled reconciliation that compares your record against what SBA holds and reports differences rather than assuming agreement, and treat every rejection as work in a queue rather than a message in a log.

What happens when servicing actions and document currency are not covered?

Two gaps produce most of the repairs we see, and both look trivial until purchase.

The first is document currency. Every checklist confirms a document exists. Very few systems know whether it is still good. Financial statements have an age limit at closing. A tax transcript ordered in the spring does not support a closing in the autumn. Insurance lapses, a filing has a continuation date, an environmental report has a shelf life, and a signed form completed before a change in ownership structure no longer describes the borrower. The classic sequence is an approval in spring, a delay for a construction issue, and an autumn closing on aged financials that nobody noticed because the checklist was ticked six months earlier.

The second is servicing. After the loan boards, changes in ownership, additional loans to the same borrower, collateral releases, deferments and workouts each carry a rule about whether you may act unilaterally or must obtain consent. A correct action taken without documentation is indistinguishable at purchase from an incorrect one.

Covering both means computed state rather than stored state. Every document carries a type, an as of date and a validity rule, and staleness is calculated, forecast and surfaced before it bites, so the team is told in week two that a transcript will age out before the projected closing. Signature completeness is tracked at the signature block level, because the most common defect is not a missing document but a document present and unsigned by one of three guarantors. And every servicing action is initiated in the system, with the determination evaluated against the version in force on the day of the action.

Should you build custom or configure what you already own?

If you close under roughly forty SBA loans a year, buy. Abrigo has genuine depth in government guaranteed lending, and Abrigo plus a maintained checklist and a disciplined department manager is proportionate at that volume. The fixed cost of a build will not amortise, and you will have added a maintenance obligation to a small team.

Even above that volume, the answer is rarely a replacement. nCino is a strong commercial origination platform and Baker Hill NextGen is strong at credit analysis and portfolio management, and none of that is the part that fails you. What every product leaves with the lender is interpretation, because the rules are lender applied and they change, so any vendor implementation is a snapshot that trails the actual procedures by their release cycle. Most lenders who build keep their origination platform for pipeline and credit and add only the evidence spine around it, which is cheaper and far less disruptive.

Build when file risk becomes systemic rather than individual: above roughly a hundred and fifty loans a year, after a repair or denial that traced to documentation rather than credit, when a key person leaves and you discover how much lived in their head, or when you are a non bank lender whose funding partners diligence your file quality. That last case is the strongest, because there the file is effectively the collateral.

How do hidden costs get into the quote?

The biggest one is not engineering at all. It is your own interpretation work. Most lenders discover during discovery that their checklist encodes decisions nobody can currently justify from the text, and writing down what your institution actually requires and why takes real time from your compliance officer and your department manager. Budget it explicitly, because a project that stalls waiting on internal decisions still burns calendar and still burns fees.

Running both 7(a) and 504 is a genuine multiplier rather than an increment, since 504 brings the certified development company relationship, the debenture funding cycle and a separate document set. Quote them separately and phase them.

Secondary market sales add settlement and investor reporting, which is a distinct workstream people assume comes free with origination. Portfolio migration, discussed above, is a decision rather than a line item and should never be a launch dependency. And retention infrastructure is a quiet recurring cost: guarantee files must remain retrievable and readable for many years, which means storage, immutability and an exit path if you ever change providers.

What separates a build that works from one that fails here?

The builds that work record determinations rather than conclusions. For every eligibility element the file carries the analyst, the date, the documents examined, the reasoning and the version of the rules in force. Five years later that shows the work rather than the answer, which is exactly what a purchase reviewer needs to read. A text field where someone types eligible is what you already have and it is what fails.

They model affiliation as an entity graph you can extend, so adding an entity recomputes the size determination instead of relying on somebody remembering they considered it. If a prospective developer draws a single borrower record with a notes field, they have not understood the problem.

They assemble the purchase package continuously rather than at the end. Because determinations, document evidence, servicing actions and liquidation steps are captured as structured records when they happen, the package is generated with an index and a completeness report that tells you what is missing before you submit. There is a second benefit that matters more and is harder to price: a gap surfaced at year three can still be cured.

And they leave you owning the evidence chain. You should hold the repository, the cloud environment and every determination record, agreed in writing before kickoff. At Digital Heroes the client owns all of it from the first commit. For a portfolio where the file defends the guarantee, keeping that evidence inside somebody else's platform is a risk you would not accept anywhere else in the institution.