Skip to main content
AML/CFT BSA Rules and Regulation Customer Due Diligence Lending & Credit Risk SBA Lending

SBA Paycheck Protection Program: BSA Requirements Still Apply

Terri Luttrell, CAMS-Audit, CFCS
April 8, 2020
0 min read

Key Takeaways

  1. BSA requirements still apply to Paycheck Protection Program loans. 
  2. Provide a BSA refresher course to your lending staff. 
  3. While these loans are 100% guaranteed by the SBA, fraud is still a concern.

This post was updated on April 14, 2020.

On March 27, President Donald Trump signed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) to provide emergency assistance for those affected by the coronavirus pandemic. As part of the CARES Act, the U.S. Small Business Administration (SBA) received funding and authority to assist small businesses nationwide that have been adversely impacted by the COVID-19 emergency. This portion of the CARES Act has been fulfilled by an Interim Final Rule (the Rule) from the SBA establishing a Paycheck Protection Program (PPP) effective immediately that allows loans to small businesses for payroll purposes if they continue to pay their employees, among other requirements.   

What makes up the Interim Final Rule?

The Rule states that the SBA relief is to be administered expeditiously and expectations are that funds under the PPP be disbursed immediately. Both large and small financial institutions are scrambling to understand the new program and to obtain SBA approval if not already an SBA approved lender. In addition, institutions are determining if their onboarding processes are adequate for these loans, noting that they may be more susceptible to fraud and other illicit funding purposes since no collateral or personal guarantees are required. The usually stringent SBA requirements, including those related to personal borrower guarantees and collateral, will also be loosened for the funds to be disbursed in a timely manner.   

Institutions need more guidance around PPP loans

However, while small businesses are eager to apply and receive emergency funding to keep their employees paid and businesses open, many financial institutions have not been willing to jump into the program so quickly. Some have expressed the need for further guidance and stronger liability safe harbor language for possible fraudulent or other non-payment of loans under the PPP. In addition to fraud concerns, institutions are concerned that usual Bank Secrecy Act (BSA) requirements such as Customer Due Diligence processes are cumbersome and time-consuming, which goes against the spirit of the CARES Act’s goal of quickly disbursing funds.  

Other institutions are uncertain about participating in the PPP for non-customers. In fact, some financial institutions are only offering PPP loans to existing customers. It’s unclear whether some of those situations are due to the lenders’ desire to streamline the application process or due to strategic or other considerations.  

Stay up-to-date on the latest news surrounding the coronavirus.

learn more

How lenders can address BSA requirements with PPP loans?

However, BSA requirements are not new, and with Congress considering additional funding for the PPP, it’s worth revisiting these requirements and how lenders can address them.   

The Rule specifically requires participating lenders to be a provider that has “a formalized compliance program (and) applies the requirements under the BSA.” It further states that PPP lending participants must adhere to the following applicable BSA requirements: 

  • Existing BSA protocols to new or existing customers must be followed  
  • Customer identification program (CIP) 
  • Know your customer (KYC)  
  • Beneficial ownership (BO) - New customers only
  • Customer due diligence (CDD) 
  • Enhanced due diligence (EDD) 
  • Suspicious activity monitoring and reporting 
  • Existing customers will not need reverification unless there is an increase in customer risk profile if allowed by institution policy  

The Rule notes that entities not presently subject to BSA requirements should establish an anti-money laundering compliance program “equivalent to that of a comparable federally regulated institution” before engaging in PPP lending activities. “Alternatively, if available, entities may rely on the [customer identification program] of a federally insured depository institution or federally insured credit union with an established CIP as part of its AML program. In either instance, entities should also understand the nature and purpose of their PPP customer relationships to develop customer risk profiles.” 

BSA compliance remains crucial to protecting financial system

It is unlikely that the interim rule will lead to change for the BSA burden for most financial institutions since the requirements are critical in deterring and reporting money laundering, terror financing, and other illicit activity. In fact, the Financial Action Task Force (FATF), which is the global standard-setting agency for combating money laundering and terror financing, issued a statement on April 1 addressing COVID-19 related financial crime.  The FATF advises that criminals are taking advantage of the COVID-19 pandemic and that institutions must remain alert to illicit financial risks.   

FinCEN issued a release on April 3, 2020 reminding financial institutions that compliance with the BSA remains crucial to protecting our national security.  It also outlined its commitment to promoting the success of the CARES Act, including the need to facilitate expeditious disbursal of funds. FinCEN said in the release that eligible federally insured depository institutions and federally insured credit unions would not be required to re-verify existing customers under applicable BSA requirements for PPP loans, “unless otherwise indicated by the institution’s risk-based approach to BSA compliance.” 

The SBA and Treasury Department have also reiterated that guidance in their PPP FAQs. “Furthermore, if federally insured depository institutions and federally insured credit unions eligible to participate in the PPP program have not yet collected beneficial ownership information on existing customers, such institutions do not need to collect and verify beneficial ownership information for those customers applying for new PPP loans, unless otherwise indicated by the lender’s risk-based approach to BSA compliance,” they said. 

FinCEN clarifies Beneficial Ownership requirements around PPP loans

FinCEN, along with the SBA, issued updated FAQs on April 13, 2020 to clarify the beneficial ownership requirements for PPP under the BSA. The following beneficial ownership related clarification were issued:
  • If a PPP loan is made to an existing customer and the necessary beneficial ownership information was previously verified, you do not need to re-verify the information.
  • If beneficial ownership information has NOT been previously verified on an existing customer, they do not need to collect and verify the beneficial ownership information, unless otherwise indicated by the lender’s risk-based approach to BSA compliance. 
  • For new customers, the lender must collect beneficial ownership information on all natural persons with 20% or greater ownership in the applicant business. The required information is as follows:
    • Name
    • Title
    • Ownership %
    • TIN
    • Address
    • Date of Birth
  • If a business is a 20% or more beneficial owner of the applicant business, beneficial ownership information would be required on the entity. 
  • Beneficial ownership further verification should be made in accordance with the lender’s risk-based BSA policy.

Provide lending staff with a BSA refresher course

When considering entering the PPP as an approved lender, an institution should feel confident in their existing onboarding processes to cover any BSA requirements.  If a strong BSA program is in place and includes robust transaction monitoring, an institution should onboard these new loans with little additional BSA risk. To enhance your BSA program for this opportunity, the lending staff should receive a refresher in BSA requirements and red flags to ensure that all lines of business are on the same page.   

One solution for financial institutions looking to offer a PPP loan to a new customer or member is to offer the prospective borrower a deposit account and submit all required onboarding documentation.  The PPP loan proceeds could then be funded into the new deposit account within the same financial institution. However, the deposit account should only be offered, not required of the borrower. Your institutional policy should be clear on this not being a requirement of a PPP loan.

Potential for fraud is still a concern for institutions

Another concern for financial institutions is the potential liability if a fraudulent loan is funded or otherwise goes south. While the Rule states that the loans are 100% guaranteed by the SBA, institutions are requesting further guidance and a true safe harbor.  More detailed guidance is expected after the comment period for the interim rule. 

Community financial institutions are well-positioned from a BSA perspective to assist small businesses through this difficult time in our economy and our lives. Consumers and small businesses have long relied on community banks and credit unions and now is no different. Financial institutions that choose to jump on the PPP processes to provide timely funding will be remembered by the community when things get back to normal. 

For more information on the CARES Act and the Paycheck Protection Program, visit our resource page. Stay up-to-date with all of the changes and concerns around coronavirus and your institution on our coronavirus resource page. 

Webinar

Bold intelligence: AI’s expanding role in AML & fraud

Read More
Blog

The future of AI in banking: Preparing for CECL automation

Read More
Blog

Overcoming technology hurdles to adopt AI

Read More
About the Author

Terri Luttrell, CAMS-Audit, CFCS

Compliance and Engagement Director
Abrigo
Terri Luttrell is a seasoned AML professional and former director and AML/OFAC officer with over 20 years in the banking industry, working both in medium and large community and commercial banks ranging from $2 billion to $330 billion in asset size.

Full Bio

About Abrigo

Abrigo enables U.S. financial institutions to support their communities through technology that fights financial crime, grows loans and deposits, and optimizes risk. Abrigo's platform centralizes the institution's data, creates a digital user experience, ensures compliance, and delivers efficiency for scale and profitable growth.

Make Big Things Happen.