Up Next: Lenders May Be the Next Government Focus for PPP Fraud

Introduction

On 24 January 2023, the Board of Governors of the Federal Reserve System (the FRB) announced it entered into a consent order (Consent Order) with a member bank imposing an approximately US$2.3 million civil money penalty against the bank for its role in processing and funding six fraudulent Paycheck Protection Program (PPP or the Program) loans, despite identifying “significant indicia of potential fraud” in the loan applications.¹ The Consent Order marks the first public action by the FRB against a PPP bank lender.² To date, government investigations and actions connected to PPP loan fraud have largely centered on borrowers, not lenders. Yet, following a December report by the House Select Subcommittee on the Coronavirus Crisis (the Select Subcommittee) that encouraged prosecutions of fraud by those who administered the Program, and a recent false claims action brought by the Department of Justice (DOJ) against a PPP lender, the FRB’s actions indicate a shifting focus from borrowers to lenders.

The Paycheck Protection Program

The PPP, established by the Coronavirus Aid, Relief, and Economic Security Act, was designed to provide small businesses with loans to pay a series of specified costs, including payroll, mortgage interest, rent, and utilities, among other things.³ Borrowers could qualify for full PPP loan forgiveness provided the borrower met specified criteria, including using loan proceeds only for eligible expenses.⁴ While funded by private lenders, PPP loans were backed by the U.S. Small Business Administration (SBA), which paid PPP lenders for the forgiven loans and any accrued interest, in addition to an origination fee.⁵

Notwithstanding the pivotal role played by banks and other lenders by processing PPP loan applications for the Program, the SBA required lenders only do the following during the application process:

1. Confirm receipt of borrower PPP application form certifications;
2. Confirm receipt of documentation demonstrating the borrower had qualifying employees;
3. Review the borrower’s average monthly payroll costs; and
4. Follow Bank Secrecy Act (BSA) requirements.⁶

For banks, credit unions, and institutions already subject to BSA requirements, lenders were required to follow only their existing BSA protocols.⁷ Existing customers did not require reverification under BSA requirements, unless reverification was otherwise required by the lender’s existing BSA compliance program.⁸

Government Action Against PPP Borrowers

The Program’s minimal documentation requirements,⁹ combined with the limited oversight from SBA and other government regulators, made PPP loans an attractive target for fraud.¹⁰ Government action against borrowers for blatantly fraudulent PPP loans was fast, with prosecutors bringing criminal charges against a myriad of borrowers less than a year after the loans were issued.¹¹ These initial actions focused largely on  individuals who submitted fraudulent PPP applications and then spent the funds for personal benefit, including on lavish items such as yachts, cars, and luxury watches.¹² These were the easy cases with the attention-grabbing headlines.

Less overt fraud has taken longer to uncover, and government officials have acknowledged that, despite the extension of the pandemic-related fraud statute of limitations from five years to 10, small-dollar cases may never be prosecuted.¹³ Kevin Chambers, former chief pandemic prosecutor at the DOJ, has stated he is “confident that [DOJ will] be using every last day of those 10 years.”¹⁴

Government Action Against PPP Lenders

The FRB’s recent settlement is a reminder to lenders that their actions during the pendency of the PPP are subject to ongoing scrutiny. Given the minimal requirements for loan approval, whether the lender followed its own BSA policies and procedures, federal BSA rules and regulations, and SBA guidance is likely to be the focus of reviews and investigations.

Notably, a staff report issued by the Select Subcommittee released on 1 December 2022, claimed that certain fintech companies charged with processing and screening PPP loans “failed to stop obvious and preventable fraud.”¹⁵ The Select Subcommittee recommended DOJ continue aggressive PPP loan investigations, with a “focus on fraud committed by individuals in positions of trust and authority related to the program,” including lenders.¹⁶

The FRB’s recent action is an example of one type of enforcement action lenders might expect. Similar to the allegations in the Select Subcommittee’s report, the FRB’s recent Consent Order states that, by processing and funding the six PPP loans in question despite “significant indicia of potential fraud” and failing to timely report the potential fraud, the bank engaged in unsafe or unsound practices.¹⁷ The FRB found that the bank’s inactions were sufficient to warrant a second-tier civil money penalty under Section 8(i)(2)(B) of the Federal Deposit Insurance Act.¹⁸ The FRB did not impose any remedial measures, but noted the bank has already undertaken measures to address its “ineffective controls and procedures.”¹⁹

In addition to potential enforcement action under Section 8(i)(2)(B) against banks, PPP lenders may face government action for BSA failures in administering PPP loans, including investigations by DOJ or the Office of the Inspector General of the SBA, actions by the Financial Crimes Enforcement Network, or audits by SBA. Another avenue for liability may be civil charges under the False Claims Act, premised on a lender receiving a PPP loan origination fee. In September 2022, another bank agreed to pay US$18,673 to resolve allegations that the lender approved a loan, and received a 5% processing fee, despite knowledge that the applicant had falsely attested that he was not facing criminal charges.²⁰

What’s Next and How to Prepare

The government has indicated PPP fraud investigations are likely to continue for many years.²¹ As investigations uncover fraudulent loans, the institutions that processed those loans may be pushed into the spotlight. Lenders should be aware that SBA’s review of guaranteed loan applications or DOJ review of fraudulent loans could evolve into reviews of the lender’s own BSA practices.

Lenders should consider the following proactive steps so they are prepared, and can remediate any lapses in procedures, in the event that regulators or investigators come calling:

• Review records for PPP loans processed and funded by the lender that remain outstanding. Consider whether there are records of red flags identified during the processing or forgiveness processes, or if additional red flags for the loan or borrower have been identified since the initial review.
• For any such loan identified, consider whether the lender appeared to follow its BSA policies and other policies and procedures in connection with the loan processing and, if not, whether any significant lapses in compliance have since been remedied.
• For any such loan identified, consider discussing with counsel whether the loan should be reported to the SBA.
• Take the opportunity to consider whether the lender’s BSA and anti-money laundering policies generally are adequate and up to date.

Lenders that receive government requests for documents with respect to specific PPP loans should be aware that regulators or investigators might start to look beyond the loan in question, particularly if multiple fraudulent loans were funded by the same lender. Lenders that receive requests, including both subpoenas and voluntary requests, for specific documentation may benefit from consultation with counsel as to whether further review of the loans, policies, or procedures should be undertaken.