WASHINGTON, DC - U.S. Representatives Suhas Subramanyam (VA-10) and James Walkinshaw(VA-11) have sent a letter to Small Business Administrator Kelly Loeffler pushing for answers after the Small Business Administration (SBA) recently requested sensitive financial information from small businesses that participate in the 8(a) Business Development Program.

The Representatives said, "Given the breadth and sensitive nature of the requested financial information, it is critical that the SBA take steps to protect the data privacy of 8(a) program participants and prevent data leaks which could jeopardize the competitive edge and financial stability of 8(a) businesses. While the SBA has published additional guidance on exactly what information is being requested, they have thus far failed to communicate with Congress or directly with 8(a) businesses on the justification of this information collection or how businesses' financial data will be used, managed, and protected."

Late last year, 4,300 businesses that participate in the 8(a) program were sent notices by the SBA to provide a wide range of sensitive financial information from the past three fiscal years, including bank statements, employment and payroll records, and contracting agreements. Businesses originally had a month to comply, with information required to be submitted by Jan. 5, 2026 or risk losing their eligibility in the program. The deadline was later pushed to Jan. 19th.

The full letter can be found hereand below.

###

Dear Administrator Loeffler:

We are writing to express our concerns regarding the Small Business Administration's (SBA) December 5, 2025, request for financial records from participants in the 8(a) Business Development Program. Our offices have heard from impacted constituents who are alarmed by the lack of clarity and privacy assurances regarding this request.

The notice sent by the SBA's Office of Legal Counsel mandated that the 4,300 businesses participating in the 8(a) program provide a wide range of sensitive financial information from the past three fiscal years, including bank statements, employment and payroll records, contracting and subcontracting agreements, and more. Businesses were required to compile and send this extensive amount of information to the SBA by January 5, 2026, or risk program eligibility or further penalties. This was later extended to January 19, 2026.

Given the breadth and sensitive nature of the requested financial information, it is critical that the SBA take steps to protect the data privacy of 8(a) program participants and prevent data leaks which could jeopardize the competitive edge and financial stability of 8(a) businesses. While the SBA has published additional guidance on exactly what information is being requested, they have thus far failed to communicate with Congress or directly with 8(a) businesses on the justification of this information collection or how businesses' financial data will be used, managed, and protected.

Accordingly, we request answers to the following questions no later than January 30, 2026:

1. What is the SBA's justification for requesting this amount of financial information from 8(a) businesses, especially considering the time and resources that 8(a) firms need to expend to comply with the request?
2. How is the SBA planning to use the information provided by 8(a) program participants from the December 5 information request, and how is it related to the SBA's other reviews of the 8(a) program?
3. What safeguards has the SBA implemented to ensure the safety and security of the financial information provided by these businesses?
   1. Will the SBA allow 8(a) businesses a meaningful opportunity to engage with the development of these safeguards?
4. What tools is the SBA using to analyze businesses' financial data, and do any of those tools utilize artificial intelligence?

We appreciate your attention to this matter and await your prompt response.

Sincerely,

Suhas Subramanyam James R. Walkinshaw
Member of Congress Member of Congress