To help preserve small businesses during the COVID-19 pandemic, Congress authorized Paycheck Protection Program (PPP) loans as part of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). PPP loans are a forgivable variant of the Small Business Administration (SBA) 7(a) loan program. However, the fast pace of the PPP program rollout created a perfect storm for risk, given the influx of new SBA lenders, public interest in the program and in preserving small businesses, the large sum of money available for lending, and the multiple oversight functions created by the CARES Act.
In the near future, many in government, business, and advocacy groups will be second guessing lender decisions during application processing, servicing, and forgiveness. At least one advocacy group alleges matched pair testing of PPP lending practices in Washington, DC, showed discrimination.1 From a bank’s perspective, key risks of the PPP program include those related to fair lending, Bank Secrecy Act/Anti-Money Laundering (BSA/AML) requirements, operational risk, fraud, and reputational risk.
Concerns Raised Over PPP Loans
From the beginning, some observers voiced concerns about the program. These included the following:
- During the first round of originations, members of Congress and advocacy groups complained that funds were not reaching the smallest businesses, minority- and woman-owned businesses, or businesses located in low- or moderate-income and rural communities.
- A National Bureau of Economic Research working paper found the fraction of establishments receiving PPP loans in the first round of funding was “greater in areas with better employment outcomes, fewer COVID-19 related infections and deaths, and less social distancing.”2
- The SBA’s Office of the Inspector General found that the Interim Final Rules (IFRs) for implementing the PPP program did not fully meet the congressional intent of prioritizing underserved and rural markets.3
These concerns persisted during the second round, despite funding set-asides for community development financial institutions and small banks. According to press reports, the Department of Justice has issued subpoenas for several banks’ PPP records.4,5 If past financial crises are any indication, banking regulators will request similar information, as we have already started to see with the Consumer Financial
Protection Bureau (CFPB) requesting PPP data.
And although banks have prevailed thus far, several lenders are being sued over institutional overlays to the PPP program.6,7 Institution-specific underwriting overlays may have contributed to the concerns about fair access, as some lenders decided to prioritize or limit PPP lending to existing customers. In a recent survey of 48 PPP lenders, over half only processed PPP applications from current customers. Another third accepted PPP applications from all small businesses, but prioritized current customers.
PPP Operational Considerations
Many lenders imposing institutional overlays stated that their approach was driven by Know Your Customer (KYC) requirements, which had already been met for current customers. Even lenders accepting applications from any business noted that the need to conduct KYC due diligence on new customers slowed processing their applications. Others noted that the institution limited PPP loans to current customers because of constraints on their capacity to process applications.
While the CARES Act rushed to get stimulus relief to small business owners and employees, it nevertheless included the requirement for PPP lenders (both bank and non-bank lenders) to have risk-based BSA/AML programs. Depository institutions and credit unions were instructed to “continue to follow their existing BSA/AML protocols when making PPP loans.” Lenders not subject to the BSA were required to “establish
an anti-money laundering compliance program equivalent to that of a comparable federally regulated institution.”
At a minimum, absent further guidance from regulators or the Financial Crimes Enforcement Network (FinCEN), lenders should have had requirements for PPP loans that involved typical BSA/AML program elements, such as collecting, validating, and risk-assessing customer information. This includes a Customer Identification Program to verify the borrower’s identity; KYC processes to understand their businesses and
revenue streams; and recordkeeping and reporting (e.g., filing of Suspicious Activity Reports, when appropriate). If federally insured institutions had not yet collected beneficial ownership information for existing customers, they were not required to do so unless the lender’s risk-based BSA/AML compliance program indicated otherwise. If a nonbank lender did not already have a bank-caliber BSA/AML program, it would have been very difficult to stand one up quickly for the PPP program. Of note, at least three of the fraud actions brought by the Department of Justice against borrowers relied, at least in part, on information provided by banks through their BSA/AML due diligence processes.
Capacity constraints and high volumes of applications, especially during the first round of funding, caused many lenders to use staff that do not normally process SBA loans to assist in taking and processing applications. The use of employees less familiar with SBA processes and requirements increases operational risk. Operational risk is also inherent in the reported glitches in the E-Tran system used to submit applications to the SBA. In addition, there were numerous changes to application, origination, and forgiveness IFRs. The number of changes to rules increases operational risks, and risk management requires properly tracking which rule was in place for each application.
Contending with Confusion
Some of the iterations of SBA guidance were confusing. For example, normally the SBA 7(a) program includes a “credit elsewhere” test, which requires that borrowers under the SBA program be unable to access credit elsewhere. The IFRs state that lenders do not have to apply a “credit elsewhere” test to PPP applicants. However, the SBA FAQ states:
“…borrowers still must certify in good faith that their PPP loan request is necessary. Specifically, before submitting a PPP application, all borrowers should review carefully the required certification that ‘[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.’ Borrowers must make this certification in good faith, taking into account their current business activity and their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business. For example, it is unlikely that a public company with substantial market value and access to capital markets will be able to make the required certification in good faith, and such a company should be prepared to demonstrate to SBA, upon request, the basis for its certification.”
Another source of potential confusion was the expected degree of lender review. The SBA FAQ states lenders can rely on good faith borrower certifications related to the amount and use of funds, but SBA guidance also states that lenders are required to conduct a “good faith review” of some borrower representations. Similarly, borrowers are responsible for accurately calculating the amount of loan forgiveness, but lenders are expected to conduct a good faith review of the borrower’s calculations. It is unclear exactly what a good faith review entails.
Given the lack of clarity, industry participants that recall the fallout from the mortgage crisis could be forgiven for fears that lenders may be held accountable for borrower fraud or misuse of funds. Such fears were likely heightened by the SBA’s announcement that it will review all loans with amounts of $2 million or greater, and that it reserves the right to “begin a review of any PPP loan of any size at any time in
the SBA’s discretion.”8
The Cost of Getting It Wrong
Errors can be costly. The IFRs note that lenders will not receive processing fees for PPP loans if any of the following conditions apply:
- The loan is cancelled before disbursement;
- The loan is cancelled or voluntarily terminated and repaid after disbursement but before the borrower certification safe harbor date;
- The SBA has conducted a loan review and determined that the borrower was ineligible for a PPP loan; or
- The lender has failed to meet the requirements of section III.3.b of the initial PPP IFR or the document collection and retention requirements of Form 2484, the lender application form.
If the SBA determines during the course of review that a borrower was ineligible, any lender fees paid will be subject to clawback. If the SBA determines that the lender has failed to meet its obligations, the lender fees will be clawed back and the SBA may determine that the loan is ineligible for guaranty.
How to Get It Right
So, what should lenders do now? The following five steps can mitigate PPP risk:
Focus on Documentation. Document, document, document. Make sure your institution’s PPP strategy, including any institution-specific overlays, has been recorded. If you prioritized underserved and rural markets, document how you did so. Documenting your strategy, processes, and rationale now will prepare you to answer questions later.
Inspect Loan Files. Ensure loan files are accurate and complete. If the SBA selects a loan for review, the lender will be expected to provide key information within five days. This information includes the credit application (SBA Form 2483), the forgiveness application (SBA Form 3508, 3508EZ, or the lender equivalent), the executed promissory note, and the transcript of account, along with any other documents requested by the SBA. A best practice is to retain documentation to support the loan amount and the amount eligible for forgiveness, as well as Form 2483 and information to show the lender has met the requirements of section III.3.b of the initial PPP IFR. Loan files should include borrower certifications, information demonstrating the borrower had employees on February 15, 2020, confirmation of average monthly payroll costs, confirmation of forgiveness amount, and evidence of compliance with the lender’s BSA/AML program.
Ensure Data Quality. Check your data. Since the release of PPP loan information by the SBA, there have been many complaints of data inaccuracy. Lenders may want to compare the information in the SBA release to the information in their loan files and systems.
Test for Compliance. Consider testing your PPP applications to detect risks under fair lending and Community Reinvestment Act requirements. A geographic penetration, or redlining, analysis of PPP loan distribution will show whether your PPP lending helped small businesses in low- or moderate-income or majority-minority census tracts. Using proxy data or demographic data collected with the PPP credit or
forgiveness applications, test for disparities in underwriting or forgiveness outcomes on a prohibited basis.
Monitor Performance. Keep a close eye on your Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs). Monitoring KPIs such as complaint volume will provide insight into the health of your PPP lending program. Additionally, keeping track of KRIs such as number of loans in certain geographic areas and the changing regulatory requirements for forgiveness can be used to provide an early warning of issues that may arise in the future.
Look Ahead. Prepare for forgiveness applications. As borrowers prepare to file applications to have their loans forgiven, under PPP provisions, they may need guidance regarding criteria and documentation requirements. Clear and consistent communication can improve customer experience and make the forgiveness process more efficient. Make sure staff are informed of forgiveness requirements and trained on lender systems and processes.
The Takeaway
The PPP program has saved many jobs during the COVID-19 pandemic, and lenders should take pride in their role in the program’s success. Although participation in PPP has risks, a robust compliance program can manage those risks so that borrowers, banks, and communities benefit.
_____________________________________________
1 Anneliese Lederer, Sara Oros, Sterling Bone, Glenn Christensen, and Jerome Williams, “Lending Discrimination in the Paycheck Protection Program,” National Community Reinvestment Coalition.
2 Joao Granja, Christos Makridis, Constatine Yannelis, and Eric Zeick, “Did the Paycheck Protection Program
Hit the Target?”, National Bureau of Economic Research Working Paper 27095.
3 Office of Inspector General Report 20-14, “Flash Report: Small Business Administration’s Implementation of the Paycheck Protection Program Requirements.”
4 Koh Gui Qing and Pete Schroeder, “Exclusive: U. S. Justice Department subpoenas Wall Street banks for small business loans info – sources,” Reuters, May 15, 2020.
5 Paul Davis, “Justice Dept. asks United Community for PPP documents,” American Banker, June 2, 2020.
6 Robert Travisano, “No Quarter for PPP Lenders,” The National Law Review, June 8, 2020.
7 Jason B. Freeman, “PPP Lawsuits Allege Bank Favored Larger Customers, A Second Round of Funding
Likely,” Forbes.com, April 23, 2020.
8 SBA Loan Review Procedures IFR