The rule is simple and old: if you owe the federal government delinquent, non-tax money, you do not get a federal loan guarantee.
The interesting question is never the rule. It is who has to look.
The finding
EXIM followed its underwriting guidelines but has not fully leveraged available data to identify participants with delinquent federal nontax debt.
And from GAO's own summary of what that means in practice: "those with delinquent federal nontax debt are ineligible for such guarantees. But the Bank's procedures do not always require the use of readily available resources, like no-cost federal databases, to identify who has this debt and is ineligible."
Two phrases carry the whole thing. "Followed its underwriting guidelines" — nobody broke a rule. "Do not always require" — the rule does not ask for the check.
Why this shape of finding is worth publishing
It is the third one this week with the same structure, and the pattern is worth naming.
A control that is not written into the procedure is not a control. The 988 crisis line had seven of HHS's own cybersecurity control areas missing from the agreement that runs it. OPM cannot separate the cost of workforce-reduction leave because there is no category for it. Here, a free database exists, the ineligibility rule exists, and nothing in between requires the one to be consulted about the other.
None of those is a scandal. All three are the same cheap, boring failure: the step is available, the step is sensible, and the step is optional.
What GAO asked for
One recommendation, on expanding the use of delinquent federal debt data in underwriting. Free data, existing rule, a line in a procedure.