Small business owners aren’t the only ones eager to get their hands on Paycheck Protection Program (PPP) funds. From 9/11 to Hurricane Sandy, and now, during COVID-19, federal relief funds quickly become subject to fraud. PPP loans are no exception, yet the nature of these loans makes them particularly susceptible to both misuse and fraud. As expected, bad actors are surfacing, and financial crimes divisions of community financial institutions are struggling with the realization that loans rushed through may be fraudulent. This week, the first federal charges in connection with PPP fraud have been made. As the initial rush to secure PPP loans dies down, financial institutions now face a new set of questions: How do financial institutions handle misused, unforgiven loans and fraudulent loans? Is there a difference? What red flags should banks be on the lookout for?
Bad Actors Emerge in PPP Lending – More Expected as Forgiveness Guidance Emerges
Key Takeaways
- Like other federal relief programs, the PPP has become subject to fraud.
- The first federal charges of PPP loan fraud have been made – and they're unlikely to be the last.
- While the SBA has said lenders will be held harmless, some banks fear they will still be culpable if borrowers fail to comply with PPP criteria. Banks can take additional steps to bolster customer due diligence.
Fraud and disaster relief: A tale as old as time
The Department of Justice (DOJ) recently charged two businessmen in Rhode Island with fraudulently seeking PPP loans, the first in the country linked to the loan program. Industry officials warn it won’t be the last. In fact, they estimate fraud rates could be as high as 10% to 12% – consistent with loan fraud from other disasters.
In the case of the two men in Rhode Island, there were several red flags pointing to fraud. Their loan requests, according to court documents, were made to pay employees for a business that was not operating at the time of pandemic and had no salaried employees. In one instance, the business was not even owned by one of the borrowers.
“Thankfully we were able to stop them before taxpayers were defrauded, but today’s arrests should serve as a warning to others that the FBI and our law enforcement partners will aggressively go after bad actors like them who are utilizing the COVID-19 pandemic as an opportunity to commit fraud,” said Joseph Bonavolonta, Special Agent in Charge of the FBI’s Boston Field Office, in a DOJ press release.
Other forms of fraud include identity theft, misrepresentation, such as inflating payroll numbers, and “loan stacking,” which the OCC refers to as an applicant receiving PPP loans from multiple lenders.
Ruth’s Chris Steakhouse, Shake Shack, and the Los Angeles Lakers made headlines last month when they, along with other public companies, received the small business loan. In response, the SBA and Treasury provided additional guidance in their FAQ stating businesses must “assess their economic need for a PPP loan” and certify “in good faith” that their request is “necessary.” Furthermore, the FAQ clarifies that the loans were not intended for companies with access to equity in the market. Borrowers that received loans prior to the issuance of the latest FAQ have until May 18, 2020 (extended from May 7 and May 14) to repay the loan in full to avoid “administrative enforcement.”
While U.S. Secretary of the Treasury, Steven Mnuchin has pledged to review all PPP loans over $2 million, the SBA has stated that all loans less than $2 million will be deemed to have been made in good faith, according to the lastest FAQ published. This is welcomed news for community financial institutions.
Manage PPP loans through forgiveness
learn moreMixed messages on customer due diligence
The launch of the PPP was met with chaos and confusion. Borrowers were desperately looking to obtain loans through their lenders, and lenders were desperately searching for more information on the program. As the interim final rule states, the intent of the PPP is to provide small business relief “expeditiously.” Time is of the essence for the first-come, first-served program, but it left significantly less time for judicious Know Your Customer (KYC) and other customer due diligence. Typical stringent SBA requirements, such as collateral and personal guarantees are not required for the program to help lenders disburse loans more quickly.
The SBA has said that lenders would be held harmless for borrowers’ failure to comply with the criteria laid out for the PPP, but many lenders still fear they will still be culpable – at least in certain circumstances. Bankers still have many questions regarding the steps they should take both to prevent fraud and protect themselves from liability, even as they face pressure to issue loans quickly. Although PPP loans are guaranteed by the SBA, one thing is certain, if a financial institution does not conduct sufficient due diligence on a PPP borrower and a fraudulent loan is funded, the bank may have risk exposure and possible financial loss. Customer due diligence (CDD) steps that should be taken by the lending institution includes:
- If the loan is being made to an existing customer and the Customer Identification Program (CIP) information was previously verified, there is no need to re-verify the information.
- New customers should have full CDD performed on a risk-focused approach as outlined in the financial institution’s BSA policy
- Extensive due diligence should be conducted on all businesses and principals – if not performed at the time of funding this should be done as soon as possible
- Balance the borrower’s anticipated payroll costs with the number of actual employees – plan site visits to verify the number of employees disclosed makes sense
- PPP loans should be tracked in AML/Fraud transaction monitoring software (i.e., using a unique product code or tagging within the system)
- As with all suspicious activity monitoring, thoroughly document all due diligence steps
Financial institutions should follow all Suspicious Activity Report (SAR) requirements for fraud reporting and be sure to start the 30-day SAR clock as soon as fraud is detected. If a borrower does not comply with the PPP criteria and the loan is not forgiven, a SAR may be warranted for loans that are termed out. Financial crimes units should work closely with the lenders, enhancing training that includes PPP monitoring. It is not too late to perform CDD and transaction monitoring of these businesses – the regulators will expect it.
Stay up-to-date on the latest updates to PPP loans and guidance by visiting Abrigo's PPP Lending Resource page.
Kylee Wooten, content and media relations manager, contributed to this article.
