Lenders have disbursed $792.65 billion in potentially forgivable loans to small businesses and nonprofits through the Paycheck Protection Program, which began in April 2020 and ended this May.1
For the program to work, especially in the spring of 2020, Congress sought to encourage a full court press by all types of lenders. Participation had to be low risk or else lenders, fresh off memories of massive post-financial crisis settlements, would likely be wary. As a result, Congress provided strong protections, including a section of the statute titled "Hold Harmless" for lenders.2
While Congress shifted much of the risk and responsibility from lenders to borrowers, are lenders truly held harmless under the program? The short answer is no.
In consultation with the U.S. Department of the Treasury, the U.S. Small Business Administration approved certain eligible financial institutions to participate in the PPP. By June 30, 2020, 5,466 lenders were participating in the program, of which 3,755, or 69%, were new to SBA lending.3
Congress permitted nonbank financial institutions to participate, including certified development companies, community development financial institutions, farm credit lenders, SBA microlenders, state-regulated lenders, and business and industrial development corporations.4
The SBA also encouraged bank and nonbank lenders that rely on financial technology, or fintechs, to participate. According to data released by the SBA, several of the largest lenders of PPP loans this year have included numerous nonbank financial institutions and fintechs such as Cross River Bank, Womply, Quicken Loans LLC, Prestamos CDFI LLC, Capital Plus Financial LLC, Harvest Small Business Finance LLC, Itria ventures LLC, BSD Capital LLC and Benworth Capital Partners LLC.5
Expectations of PPP Lenders
While protections afforded to lenders under the statute are strong, they are not absolute. First, lenders must always act in good faith to receive the protections afforded.
While the government will likely argue that this requirement always existed, it was not codified until the passage of the Economic Aid to Hard-Hit Small Businesses, Nonprofits and Venues Act on Dec. 27, 2020, when Congress amended Section 1106(h) of the Coronavirus Aid, Relief and Economic Security, or CARES, Act to incorporate an explicit good faith requirement.6
Congress made this change retroactively meaning that it "shall be effective as if included in the CARES Act."7
What good faith means in relation to a lender's participation in the PPP, however, is open to debate. Lenders with higher proportions of fraudulent loans, especially those that identified and ignored red flags, or that knowingly had limited or no fraud-mitigation procedures in place at the time of loan origination, may be prone to enforcement actions by the U.S. Department of Justice under the False Claims Act and the Financial Institutions Reform, Recovery and Enforcement Act, or FIRREA.8
Both statutes have already been used by the DOJ to pursue borrowers making alleged misrepresentations in connection with PPP loans, and each statute has a proven track record against lenders for alleged fraud during the financial crisis, as well as fraudulent loan originations backed by Federal Housing Administration insurance.
Although counterintuitive, based on early indications, much of the fraud that existed in the program came not from high-dollar loans, which were up to $10 million, but rather are concentrated in smaller-dollar loans, perhaps because they drew less attention.
For example, in a Jan. 14 report by the SBA Office of Inspector General, the OIG noted that it had identified nearly 55,000 loans totaling approximately $7 billion to potentially ineligible businesses, or approximately $127,000 per loan.9
Likewise, a recent study by the University of Texas at Austin found higher levels of data anomalies suggesting potential misrepresentations in loans made by fintech lenders, which had an average loan amount of $28,000 compared to $91,000 for traditional banks.10
All else equal, the smaller the loan amount and loss, the less likely it is that the DOJ will pursue borrowers seeking civil recovery from the alleged fraud. Rather, if concentrations of small-dollar fraud loans appear at certain lenders, it is more likely that the DOJ will pursue those lenders, seeking damages from lenders for failing to stop making such loans after they knew, or should have known, that significant problems existed.
Second, while nonbank financial institutions were allowed to participate in the PPP, the SBA required that prior to making any PPP loans, they must establish an anti-money laundering, or AML, "compliance program equivalent to that of a comparable federally regulated institution."11 In fact, following applicable Bank Secrecy Act, or BSA, requirements was one of the few requirements of lenders, along with confirming receipt of borrower certifications, confirming receipt of information to show the business was in operation as of Feb. 15, 2020, and confirming the dollar amount of the average monthly payroll costs used for the loan.
The SBA cautioned that lenders should "understand the nature and purpose of their PPP customer relationships to develop customer risk profiles" which will include a customer identification program, or CIP.12 Despite this requirement, an SBA OIG report found that more than 2,400 PPP loans may have been made to businesses that had registered tax identification numbers created after the enactment of the CARES Act, making them ineligible for loans.13
The Federal Financial Institutions Examination Council's BSA/AML Examination Manual — the guide that regulators use to assess a financial institution's compliance with BSA and AML regulations — meanwhile, requires financial institutions to:
- "[V]erify enough information to form a reasonable belief that it knows the true identity of the customer."
- "[O]btain documents showing the legal existence of the entity, such as certified articles of incorporation, [or] an unexpired government issued business license" for businesses.
- If relying on nondocumentary methods to verify the customer's information, "independently [verify] the customer's identity through the comparison of information provided by the customer with information obtained from a ... public database, or other source."
- For business accounts, obtain "information about individuals with authority or control over such accounts, including signatories, in order to verify the customer's identity."14
Financial institutions were also, in accordance with their AML obligations, required to have risk-based procedures designed to detect and report potentially suspicious activity. Those procedures typically include, but are not limited to, reviewing information submitted by the PPP applicants and comparing it to information available in the public record, performing some additional due diligence, and blocking transactions that have high indicia of fraud and/or noncompliance.
Because the existence of an AML program was a condition to participation in the program, the DOJ will likely argue that loans originated by lenders that failed to establish an adequate AML program are tainted by this failure, i.e., the loans are rendered false claims due to this threshold ineligibility.
Third, an area of potential lender liability that has not garnered much attention is post-closing servicing obligations. The SBA has made clear that, absent specific guidance, lenders must comply with typical servicing requirements applicable to the SBA's traditional 7(a) loan program.
On July 23, 2020, the SBA issued Procedural Notice No. 5000-20038, which provided that "PPP Lenders are responsible for servicing PPP loans in accordance with SBA SOP 50 57, as amended."15 On Oct. 2, 2020, the SBA issued Procedural Notice No. 5000-20057, which detailed a specific process that lenders must follow for any change in ownership occurring after loan closing, including potentially requiring borrowers to establish an escrow account with funding to match the PPP loan's outstanding balance.16
Since, as discussed above, more than two-thirds of PPP lenders are new to SBA lending, following post-closing servicing obligations, including change of ownership rules, may not have been done. The SBA will likely seek recovery from lenders for loan losses if a lender failed to follow proper servicing practices.
Potential Liability
To date, the DOJ has resolved four PPP matters pursuant to the FCA and/or FIRREA. All have involved borrowers, all have been resolved pre-loan forgiveness and all have resulted in relatively small recoveries by the DOJ of several hundred thousand dollars.17
The most recent of the four, a $287,055 resolution with Seth Bernstein, the owner of a jet charter company in Fort Lauderdale, Florida — All in Jets LLC DBA JetReady — is the first stemming from a qui tam complaint brought by a relator pursuant to the FCA.18
In contrast, the first three resolutions — brought against Slidebelts Inc., Sandeep S. Walia, M.D., and KC Investments Group Inc. — were actions initiated by the DOJ and did not involve a relator under the FCA or a declarant under FIRREA.
The jet charter company settlement also differs from the first three in that it does not allege the borrower was ineligible to obtain a loan, but rather that it spent $98,929 of its $1,173,382 in loan proceeds on expenses that were not eligible expenses under the PPP rules. According to the settlement agreement, the relator will receive $57,411, or 20%, of the recovery in the case.
While we anticipate scores of additional qui tam matters will be resolved with borrowers, it is highly likely that actions will also be filed against lenders, stemming from alleged failures of good faith, of required verifications, of appropriate servicing activities, or relating to their requisite AML programs.
Qui tam filings, which often involve insiders to a company, will be important to the generation of viable actions against lenders stemming from alleged violations of the FCA. This is so because evidence of a lender's bad faith may only be available from company auditors, compliance personnel and others involved in analyzing the lender's PPP loans as they were being originated. If lender personnel feel that their concerns were brushed aside or not adequately addressed, they will be more likely to come forward with allegations of fraud under the FCA or FIRREA.
Mitigating Risk for Lenders
Lenders would be well served to understand and mitigate their risks related to PPP loans that they originated. Specifically, PPP lenders should be proactive and:
- Consult with program experts to understand their PPP related risks and potential downstream liability;
- Consider performing fraud- and misrepresentation-focused loan reviews of their PPP portfolios;
- Perform independent BSA/AML testing, specifically focused on assessing the adequacy of the policies, procedures and controls that were in place when PPP loans were originated; and
- Remediate and report findings, consistent with relevant rules and regulations, including fraud and BSA/AML issues identified.
In addition, lenders should have adequate channels that allow company employees to report concerns internally, and then companies must address those concerns. Taking these various steps can help to reduce potential liability associated with ongoing or future qui tam actions, as well as demonstrate a lender's good faith in attempting to comply with applicable PPP laws, rules and regulations.
Co-authored by Jesse R. Morton director at Stout Risius Ross LLC.
Footnotes
2. Coronavirus Aid, Relief, and Economic Security Act, at § 1106(h).
3. https://www.sba.gov/sites/default/files/2021-01/SBA%20OIG%20Report-21-07.pdf, at 3.
4. Id.
5. https://www.sba.gov/sites/default/files/2021-06/PPP_Report_Public_210531-508.pdf, at 7.
6. Pub. L. 116-260, December 27, 2020, Section 305.
7. Id. § 305(b).
8. 31 U.S.C. § 3729, et seq.; 12 U.S.C. § 1833a.
9. https://www.sba.gov/sites/default/files/2021-01/SBA%20OIG%20Report-21-07.pdf, at 6.
10. Did FinTech Lenders Facilitate PPP Fraud? by John M. Griffin, Samuel Kruger, and Prateek Mahajan, McCombs School of Business, University of Texas at Austin, at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3906395.
12. Id.
13. https://www.sba.gov/sites/default/files/2021-01/SBA%20OIG%20Report-21-07.pdf, at 6.
14. https://bsaaml.ffiec.gov/manual/AssessingComplianceWithBSARegulatoryRequirements/01.
15. https://www.sba.gov/sites/default/files/2020-07/5000-20038-508.pdf.
16. https://www.sba.gov/sites/default/files/2020-10/5000-20057-508.pdf.
17. https://www.justice.gov/usao-edca/pr/eastern-district-california-obtains-nation-s-first-civil-settlement-fraud-cares-act; https://www.justice.gov/usao-edca/pr/bakersfield-medical-practice-agrees-resolve-false-claims-act-allegations-involving; https://www.justice.gov/usao-edva/pr/virginia-company-agrees-settle-civil-fraud-allegations-paycheck-protection-program; https://www.justice.gov/opa/pr/owner-jet-charter-company-settles-false-claims-act-allegations-regarding-misappropriation.
Originally published by Law360.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
