On the Front Line, Banks Must Protect U.S. Taxpayer Money from Fraud

Congress passed stimulus bills to provide emergency relief to individuals and businesses adversely impacted by the COVID-19 pandemic crisis. Banks have already exhausted the first $350 billion in loans to small businesses through the Paycheck Protection Program (“PPP”) and are working on lending an additional $320 billion. With this much money going out the proverbial door, surely a large number of frauds will follow, especially if the gate keepers — banks — don’t keep watch.

Under the PPP, eligible banks may make potentially forgivable loans to any small business that employed no more than 500 employees and paid salaries and payroll taxes prior to February 15, 2020. Banks may lend the lesser of 2.5 times a borrower’s average monthly payroll costs or the maximum of $10 million. All decisions related to a borrower’s loan forgiveness are a lender’s responsibility.

To be eligible for forgiveness, a borrower must submit documentation verifying the number of employees on payroll and that the proceeds were used for payroll and certain other covered expenses. A borrower must also certify as to the truthfulness and accuracy of its submission supporting a claim that the proceeds were used for payroll and covered expenses.

When considering making these loans, banks will have not only typical compliance obligations but also will be subject to higher scrutiny because administration of these federally funded loans is a public trust. Lenders must ensure that (1) U.S. taxpayer money is lent to legitimate small businesses and (2) that the loan forgiveness criteria under the PPP is met.

In recent notices, FINCEN and the OCC have provided certain regulatory compliance relief under the PPP. With this guidance, banks are not required to re-verify the beneficial owners of a borrower to satisfy the customer due diligence requirements for existing customers, unless a bank’s existing risk-based approach to BSA compliance necessitates it. This BSA requirement was relaxed in recognition of the challenges banks face related to the pandemic and the desire to promote the success of the PPP by allowing for the quick disbursement of funds to small businesses.

Similarly, the SBA took steps to limit banks’ potential exposure, allowing them a safe harbor if they rely on certain borrower certifications. According to the SBA Interim Rule relating to the PPP, for example, a bank is not required to conduct any verification if a borrower submits supporting documentation for its application for loan forgiveness and certifies as to the truthfulness and accuracy of its submission supporting a claim that proceeds were used for covered expenses. Such supporting documentation could include payroll reports and payroll tax filings, as well as canceled checks and payment receipts for rent and utilities.

Despite this relief, banks are still required to conduct compliance reviews, specifically a Know Your Customer (“KYC”) review for any new customers. Banks are not relieved of the obligation to conduct due diligence to ensure that a borrower is what it claims to be (in this case a small business with operations), and that they understand a borrower’s financial activities and the risks it poses. Most importantly, as part of this review, a bank must make sure that a borrower’s business existed (and thus paid salaries and payroll taxes) on or around February 15, 2020, which means that the borrower’s business was in operation before this date.

To conduct these reviews, banks will need to conduct basic internet research to find information that shows that the borrower’s business is real. An internet search on a business name, for example, should return at least a business address and possibly a website or more. A Google Earth search may show that the business has a physical location.

Banks will need to compare the information provided by a new borrower with public databases for the same reason. They should, for example, research if the borrower has registered its business with a local municipality or state. If such research results raise questions about the legitimacy of the business, further investigation is required.

The review should also include an assessment of key management personnel and beneficial owners to identify potential red flags and ensure that they are not on any prohibited lists. Banks should also have a secondary compliance review of the approved loans to ensure that these KYC reviews were undertaken.

Senior management from the business line should also have a high degree of visible oversight of these reviews to ensure they are properly conducted and that they are updated for significant issues. And of course, good record keeping of these reviews is required.

Such reviews are crucial to safeguard against fraud at the loan approval stage. If a bank fails to undertake these initial reviews, the safe harbor provided by the SBA, which allows banks to rely in good faith on the certifications made in connection with loan forgiveness, will likely not be available. In other words, if a bank fails to conduct basic due diligence on the front end regarding the existence of the business, it will face heightened regulatory exposure on the back end if an applicant turns out to be an outright fraud.

Multiple government entities will target fraud and mismanagement of the PPP. The enabling legislation provides for a Congressional Oversight Commission, a Special IG, a committee of IGs, and a House Select Committee, in addition to existing Congressional Committees, IGs, and the Justice Department. A Senate Committee has already asked the SBA IG to look at issues related to big companies receiving loans at the expense of smaller companies. The Justice Department just announced the filing of charges, the first in the nation, against two Rhode Island men for trying to defraud the program by falsely claiming to own and operate eligible businesses.

Lax procedures and ignoring red flags could do serious harm to a bank’s reputation, even if the regulations seem to allow reduced compliance efforts. Banks are playing a critical role now in keeping the U.S. economy afloat. This crisis can be an opportunity to restore the country’s trust in banks that was damaged in the financial crisis. Proper administration of these funds is critical to that goal.