by Jonny Frank and Ryan LaRue

The Paycheck Protection Program (PPP) inadvertently—but inevitably—puts PPP lenders between a rock and a hard place. At PPP’s inception, the government pushed lenders to make loans to stimulate the COVID-19 rocked economy. Equally inevitable and with the benefit of 20-20 hindsight, regulators, prosecutors and congressional oversight committees will ask why lenders extended loans to fraudsters. Here, we provide five practical steps lenders can take to mitigate the legal and reputational risks of extending PPP loans to borrowers who obtained loans under false pretenses or inappropriately used the funds earmarked by the government to protect jobs.

Don’t Over Rely on the Bank Secrecy Act (BSA) As a Safe Haven

The PPP allows lenders to rely on existing know-your-customer (KYC) processes when issuing the loans.[1] For current customers, lenders do not have to re-verify their information. Federally-insured depository institutions and credit unions that had not yet collected beneficial ownership information on existing customers do not have to add this information to lend PPP funds. For new customers, lenders must collect information on individuals with a 20% or greater ownership stake in the borrower.

But, lenders must still follow a risk-based approach to Bank Secrecy Act (BSA) compliance, including KYC for new customers and enhanced due diligence for high-risk customers.[2] The U.S. DOJ, O.C.C. and New York State Department of Financial Services have all brought enforcement actions against banks for BSA compliance failures related to customers’ illegal activities.

Identify High-Risk PPP Borrowers

A critical first step is to identify high-risk borrowers (HRB). Start with your existing AML risk rating model; then, tailor it to schemes already seen in recent PPP fraud cases and adjust it as new ones arise. Considerations to identify high-risk PPP borrowers include:

• • PPP borrowers already deemed high-risk;
  • Changes in beneficial ownership between existing customer records and the PPP loan application;
  • Customers with foreign operations (PPP funds may not be used to support non-U.S. employees);
  • Length of time borrower has been a customer;
  • Number of reported employees not proportional to size and type of the business;
  • PPP loan substantially larger than past loans to same entity;
  • Borrower received PPP funds, but did not, as of yet, apply for forgiveness (funds may have been used for purposes not permitted under the program);
  • Borrower applied for multiple PPP loans; and
  • Speed which new customers were on-boarded (i.e., were there any steps in the KYC processes not completed because of time constraints?).

Monitor High-Risk Borrower Transactions

Lenders should monitor the transactions of all high-risk borrowers. Transaction monitoring refers to contemporaneous monitoring of HRB individual transactions for risk indicators of a fraudulent loan application or misuse of PPP funds. Potential risk indicators include: (1) transferring PPP funds from one bank account to another; (2) using shell companies to apply for a loan; and (3) transferring funds from the borrowing entity to a shell company.

Analyze High-Risk Borrowers Transactions

Transaction analysis looks at the HRB account(s) holistically and retrospectively. If HRB transactions indicate high-risk activity, lenders should conduct further analysis to determine if there is fraudulent activity. Suggestions for further analysis include: (1) analyze how PPP funds were used to determine if they were spent on unapproved purchases; (2) conduct further inquiries if the borrower is not expected to meet the full forgiveness criteria to determine why the borrower used PPP funds for purposes that would not meet the criteria; and (3) conduct negative media searches on the borrower.

Scrutinize High-Risk Borrower Loan Forgiveness Documents

Lenders should take advantage of the 60 days allowed to review loan forgiveness documents for HRB. Scrutinize all documents, verify the accuracy of calculations and ensure supporting documentation is contemporaneous and authentic. Forgiveness applications should not be submitted to the SBA until all discrepancies are resolved. During the forgiveness process, lenders should re-consider the accuracy of the borrower’s initial PPP loan certifications, given the information learned through enhanced diligence procedures.

Conclusion

Sooner or later, prosecutors, regulators, legislators and the media will shift their focus from PPP borrowers to lenders. Lenders can mitigate legal and reputational risks by identifying high-risk borrowers, monitoring transactions for risk indicators, further analyzing high-risk borrowers’ transactions, and scrutinizing high-risk borrowers’ loan forgiveness documents.

Footnotes

[1] Paycheck Protection Program Loans, Frequently Asked Questions 18 and 25.

[2] Paycheck Protection Program Loans, Frequently Asked Questions 18. 

Jonny Frank is a partner at StoneTurn and serves as the U.S. Department of Justice (DOJ) Monitor to Deutsche Bank, DOJ Independent Auditor to a Top 5 automotive manufacturer, remediation consultant to a Northern European bank, and ethics and compliance adviser to the SEC-appointed Independent Consultant of a large public accounting firm. He was previously a Big Four partner and an AUSA for the Eastern District of New York. Ryan LaRue is a CPA and Certified Fraud Examiner at StoneTurn, where he assists and advises clients and counsel with forensic accounting, complex litigation, and compliance and monitoring matters. 

Disclaimer

The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of New York University School of Law.  PCCE makes no representations as to the accuracy, completeness and validity of any statements made on this site and will not be liable for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.