What documents will a lender or insurer ask my small business for, and how do I keep them ready?

What is each requester trying to judge?

Each requester asks for what it needs to make one decision, so start from the decision. SBA's 7(a) loans page says the contents of a loan application vary with the size of the loan and the lender's processing method, so treat the classes below as what to expect and the requester's own list as final.

SBA's lending-criteria rule (13 CFR 120.150, as published in the 2025 Code of Federal Regulations) says loans must be so sound as to reasonably assure repayment. It lets lenders consider the credit score or credit history of the applicant, its associates and any guarantors; the applicant's earnings or cash flow; and, where applicable, its equity or collateral. The rule governs SBA-backed loans, and it requires credit analysis consistent with what lenders use for similarly sized loans without SBA backing. Expect a lender to look at the people behind the business and any guarantors too; preparing their documents belongs to the loan-application question.

Which financial documents make up the core set?

Union Savings Bank's undated loan-application checklist says that for many traditional business loans, banks typically ask for the first four items below; the last two complete the set:

• Financial statements. The checklist names a year-to-date profit and loss statement and balance sheet; keep each recent full year's statements too, because those are what you agree to each filed return. The checklist says year-to-date statements offer insight into how the business is currently performing.
• Filed tax returns. The checklist says business returns provide historical performance data and verify revenue trends, and IRS Publication 583 tells businesses to keep copies of their filed returns.
• Receivable and payable aging. The checklist says these reports demonstrate how efficiently the business collects payments and manages vendor obligations.
• Debt schedule. List each loan, credit line, card and lease with lender, balance, payment, maturity and collateral. The checklist says a current debt schedule helps lenders assess overall leverage.
• Bank statements. These are the outside record the books are checked against. Their deposits support reported sales once each deposit is identified as business income, personal funds or a loan, as IRS Publication 583 suggests.
• Asset schedules. List equipment and other fixed assets with cost, date acquired and serial number, and keep a separate inventory listing. IRS Publication 583 says you must keep records to verify certain information about your business assets.

Reviewed or audited statements, and preparing the loan application itself, are separate questions.

Which legal and ownership documents apply to your business?

These documents show that the business exists, who owns it, that it may operate and what it has committed to: formation documents and amendments, evidence of current standing from the state registry, ownership and governance records such as an operating agreement, bylaws, share records or a partnership agreement, licenses and permits, and leases and major contracts.

SBA's Launch your business guide says your location and business structure determine how you register, that for most small businesses registering is as simple as registering a business name with state and local governments, and that if you conduct business as yourself under your legal name you need not register anywhere. If the business is not a registered entity (you trade under your own legal name, or under a business name registered with a state or local government), list any name registration and its issuer in place of formation and standing documents, and start at step 3; an LLC, corporation, limited partnership or other entity filed with a state starts at step 1. Otherwise, build your list in this order:

1. Start with the state where the business was formed, and ask its business registry which filings it holds for you and how it certifies your status.
2. Add every other state where the business is registered. The same guide says an LLC, corporation, partnership or nonprofit corporation active in more than one state might need to form in one state and file for foreign qualification in the others where it does business.
3. Add licenses and permits. The same guide says activities regulated by a federal agency need a federal license or permit, that state, county and city licenses depend on your activities and location, and that you have to research your own state, county and city regulations.
4. Record each item's issuer, number and expiration date. The same guide says some licenses and permits expire after a set period and to keep close track of when to renew them.

As one state's example, the California Secretary of State's records-request page says a Certificate of Status certifies an entity's current status. There, certificates of status are available online within minutes for corporations, LLCs and limited partnerships; other entity types request them by mail or in person. The same page says bylaws and operating agreements are kept by the business, not filed with the office, so hold your own signed copies. Check your own registry's documents and turnaround before a request arrives.

If the trade is licensed or the business works in several jurisdictions, keep the list as a grid with one row per jurisdiction and license, showing issuer, number, expiration date and renewal step, and check it at each close.

What does an insurer need at renewal and after a loss?

At renewal the insurer is rating the exposure. The Texas Department of Insurance's bulletin B-0020-20 says the premium for many commercial property and casualty policies is calculated using an auditable exposure such as payroll or sales. Have ready last year's and year-to-date sales and payroll from the books, current lists of locations, equipment and inventory values, and the current policies. What an insurer's premium or self-audit form asks for is a separate question.

After a loss the insurer is validating it, which needs proof of what the business owned and, if the policy includes business income (business interruption) coverage, what it earned. The District of Columbia's insurance regulator (DISB) names receipts, photos and insurance policies, in its disaster-planning checklist for small businesses, among the papers to keep copies of stored offsite, and says these documents will assist you when you file a claim. The IRS's disaster-preparedness page says its Publication 584-B workbook can help you compile a room-by-room list of business equipment, which helps prove the market value of items for insurance claims. For that coverage, the Texas Department of Insurance's undated business interruption guide says the payment is determined by previous sales volumes and expenses based on the business's financial records.

What must the figures pass before anything leaves?

Before anything is shared, check the figures on four points:

• Reconciled. Every bank and card account is reconciled to its statement through the package date. IRS Publication 583 says to make sure the bank statement, your checkbook and your books agree, and to reconcile your checking account each month; it notes the balances may differ because of items such as deposits made after the statement date or checks that have not cleared, so explain each one.
• Closed. No further entries are made to the period, so nothing you send can change afterwards without your knowing.
• Internally consistent. Each schedule agrees with the statements:
  • On accrual-basis statements, the receivable and payable aging totals equal accounts receivable (before any allowance for doubtful accounts) and accounts payable on the balance sheet. If cash-basis statements show neither, label the aging as open invoices and bills not in the statements.
  • Each loan and credit line equals its balance-sheet liability and, after timing items such as payments in transit, its lender's statement; each card balance agrees with its card statement in the same way. List leases separately, agreed to the lease documents and to a lease liability only where the books record one.
  • The fixed-asset schedule's total cost equals fixed assets at cost on the balance sheet, with accumulated depreciation alongside if the balance sheet shows a net figure. List insured items not recorded as fixed assets separately, and agree the inventory listing to inventory on the balance sheet where the books carry inventory.
  • The change in equity equals the period's profit or loss plus owner contributions, less draws or distributions.
• Consistent with what was filed. IRS Publication 583 says you must use the same accounting method to figure your taxable income and to keep your books, and that the records supporting your return are generally those you use to prepare your financial statements. Each full year's statements should agree with the return, or each difference should be known and written out.

Label each statement with its basis (cash or accrual), its period and the date it was produced. The IRS's Income Verification Express Service page says you can authorize banks and lenders to access your tax records when you apply for a loan, so assume a lender may compare your return with your statements. If someone else prepares the package, the owner checks its bank and card balances against statements the owner downloads directly before it goes out.

If recent months are not reconciled and closed, do that first, at least through the period the requester asked about. If the request cannot wait, send only figures you can stand behind, labeled interim and unreconciled as of their date, say what is still open, then send the closed version as a replacement and log both.

How do you keep the package current, and who owns it?

Tie the refresh to the month-end close, when the month's figures first pass those checks. Once a month is closed, the package's owner exports the statements, aging reports and debt and asset schedules as of that date, adds the month's bank and card statements, and saves the set in a folder named for the date, keeping earlier sets. Returns follow each filing, policies and licenses each renewal, and formation and ownership records any change.

Name one person to own the refresh and a second who can produce the package without them, and keep the business owner's own access too. A one-page cover note in the folder gives the as-of date, the next refresh date, the owner and the backup, so anyone can say how old the package is.

Keep the inventory as a table like this one:

Which items take time to obtain?

The slow items are the ones someone else holds: registry certificates and certified copies, licenses and permits, landlord and counterparty documents, insurer policy documents, a counterparty's written agreement to share a contract, and copies of returns you did not keep. Obtain them before a request arrives.

Where should the package live so it survives a loss?

Keep at least two copies in different places. The IRS's disaster-preparedness page calls making duplicates and keeping them in a separate location a good business practice, and warns that a disaster that strikes your home is also likely to affect other facilities nearby, so keep the second copy away from your premises and the area around them.

Make the outside copy one that nothing done on the office's computers or through the owner's everyday logins can change or delete: for example, each month's dated set written to a CD or DVD, an option the same disaster-preparedness page names, or to separate storage that does not sync with the office and whose login is never entered or saved on the office's computers; for example, the backup person adds each month's set to it from their own device. It must open without the office, its computers or its network, and the backup person must reach it with their own access. At each refresh, have the backup person open an earlier set from it, not only the latest.

After a fire, flood, theft or system failure that your insurance may cover, report the loss to the insurer at once, alongside gathering evidence rather than after it: DISB's property-protection guide for business owners says to report a claim immediately. The same guide says that in the event of a loss all reasonable steps must be taken to protect property from further damage, that damaged property should if possible be set aside for the adjusters, and that you should keep a record of the expenses of protecting it, since reasonable expenses can be submitted for consideration in the settlement of the claim. The evidence of what the business owned and earned before the loss then rests on the outside copy, so make sure it holds the asset and inventory records with receipts and photos, the pre-loss statements and bank statements, filed returns and the policies. Rebuilding records lost in bulk is a separate question.

What do you do when a request arrives?

Work through these steps in order:

1. Scope it. Confirm which documents, for which entity and which period or as-of date, in what format and by when. Ask rather than guess: a narrower request is quicker to meet and exposes less.
2. Check who is asking and where it goes. Use the destination check in the next section before anything is sent.
3. Assemble from the package. Refresh only if the requester needs a later date than your last close, and run the checks above on anything new.
4. Remove what was not asked for. Take out other people's details the request does not need.
5. Send and log. Record the date, the person and organization, what was asked, each file with its as-of date, and how it was sent, and save an exact copy of the files as sent in a dated folder. For a claim, DISB's property-protection guide also says to document all communication.
6. Answer follow-ups from that copy. Later answers then match what you represented.

When a requested document does not exist or cannot be produced in time, use the path that fits:

How do you check who is asking and where documents go?

Answer only within an application, renewal or claim you started, or a loan or policy you hold. Send through the requester's portal, reached from a web address you held before the request, such as one on your loan or policy documents, or hand documents over in person. Use no link, address or phone number from the request or any message in its thread: the FTC's guide to protecting personal information says to verify emailed requests for sensitive information independently, without replying or using links, phone numbers or websites in the email.

If the requester takes documents only by email, confirm its address by calling a number you held before the request arrived, such as one on those documents, then write a new message to that address, never a reply, with the files encrypted and the password given by phone; the same FTC guide says to encrypt sensitive information sent to third parties over the internet. That call cannot protect you if the requester's mailbox is taken over later, so use a portal whenever one exists, and treat any new place to send as needing the same call.

What should stay out of the package?

Send what the request needs about the business and its owners, and leave other people's details out by default. The FTC guide tells businesses to keep only what they need for the business and to use Social Security numbers only for required and lawful purposes; apply the same test to what you send. The guide also says to take stock of the law, naming statutes such as the Gramm-Leach-Bliley Act that may require you to provide reasonable security for sensitive information. If your business holds information a particular law protects, check what that law allows before sending any of it. Apply the test this way:

• Customers. Send a receivable aging when asked. Leave customer contact details out unless the request specifically needs them, and leave customer bank and card details out altogether.
• Employees. Send payroll totals by period rather than registers with names and Social Security numbers, and leave personnel and medical files out.
• Third parties. When a contract enters the package, read its confidentiality clause and note in the inventory what it lets you share, including the terms your debt schedule and lease list show. Where you cannot tell, ask the other party for written agreement then, and until you have it, do not send that contract or its terms.

For anything sensitive beyond the standard set, agree in writing how the requester will hold and use it before sending, and mark the files confidential.