COVID-19: Financial Institutions and Loan Recipients Will See Increased Congressional and Inspector General Investigations on CARES Act Funding

The economic response to the pandemic will continue to generate significant investigative scrutiny by Congress, inspectors general, and law enforcement—likely for years to come. The House Select Subcommittee on the Coronavirus Crisis (Select Subcommittee), chaired by Rep. James Clyburn (D-SC), is poised to expand its long-term investigations into key aspects of the pandemic response, including participants in CARES Act stimulus programs such as the Paycheck Protection Program (PPP), healthcare provider participants in the Provider Relief Fund (PRF), and recipients of support payments to the aviation industry under the Payroll Support Program (PSP). 

Earlier this month, the Small Business Administration Office of Inspector General (SBA OIG) published a Flash Report identifying US$692 million in duplicate loans issued by the Trump Administration under the PPP.¹ The report follows a June 2020 letter from the Select Subcommittee to the SBA OIG requesting immediate review of the Trump Administration’s management of the PPP and flagging errors by SBA that allowed for “more than a thousand duplicate loans, creating significant opportunities for fraud and potentially wasting more than $100 million in taxpayer dollars.”² During a March 25th Select Subcommittee hearing, SBA Inspector General Hannibal Ware testified that it would take up to a decade to investigate potentially fraudulent loans under the PPP, even with the 40 percent increase in staffing Congress recently provided to SBA OIG. The Select Subcommittee staff hearing memorandum references 212 open SBA OIG investigations.³

The Select Subcommittee does not appear to be slowing down, announcing a hearing on rooting out fraud in small business relief programs.⁴

Some investigations will be instigated by concerns over the businesses that received stimulus funds; others may be triggered by questions about whether the program was properly implemented by the Trump Administration. In either scenario, it is likely that a wide swath of the private sector will be touched by these investigations. Financial institutions, in particular, should expect to be the target of many of these inquiries. Recent letters issued by Rep. Clyburn demonstrate this point. While the letters were addressed to the SBA and U.S. Treasury, the letters name several financial institutions, lenders, and organizations, suggesting that more private actors will be caught in the dragnet of this (and future) investigations. Further, the SBA OIG report indicates that the agency’s management has committed “to take action to recover any improper payments” by 1 September 2021.

An important consideration for financial institutions is Congress’s ability to demand customer data. As described above, Congress has demonstrated a willingness to request (and litigate) individualized customer information from financial institutions.⁵ These requests can place financial institutions in a difficult position—navigating the demands of Congress and the interests of customers and regulators. Sharing individualized customer information with congressional investigators may also implicate a number of federal and state statutes, such as the Right to Financial Privacy Act of 1978 (RFPA). The RFPA places restrictions on how financial institutions may share customer information with the government and also prescribes specific steps the governmental authority must undertake when pursuing customer information from a financial institution. The Gramm-Leach-Bliley Act imposes additional restrictions on financial institutions and the sharing of customer information. Congress has long taken the position that the RFPA does not apply to congressional investigations, a view shared by the U.S. Court of Appeals for the Second Circuit.⁶

The takeaway for businesses, particularly financial institutions, is that the private sector has little refuge from the force and power of congressional investigations, even when asserting legitimate customer privacy claims. 
 
Companies can face significant reputational and legal risks when responding to a congressional or inspector general inquiry. Responding even to friendly requests for background information can create risks and lead to allegations of misleading Congress. Partnering with experienced congressional investigations counsel is the key to managing these risks.