With the third round of lending through the Paycheck Protection Program (“PPP”) in full swing, the Small Business Administration (“SBA”) – administrator of the PPP – has developed new guidance in consultation with the United States Department of the Treasury (“Treasury”).  The February 1, 2021 FAQs specifically address how lenders can meet some of their Bank Secrecy Act (“BSA”) obligations when issuing PPP loans.

As we previously blogged, the PPP, with its combination of size, scope and the limited time-frame for lenders to process and disburse loans pursuant to it, has created numerous compliance challenges for PPP lenders and presented significant enforcement risks, including future false claims act liability, compliance enforcement, state attorneys’ general investigations and private litigation.  At the root of those challenges and concerns is the question of how lenders can meet their anti-money laundering (“AML”) obligations under the BSA while administering a program designed to get money to as many recipients as possible as quickly as possible.

PPP Background

In a nutshell, the PPP involves two principle components: (1) the initial lending decision; and (2) evaluation for loan forgiveness.  Both of these decisions fall to participating lenders to make.  Pursuant to the Coronavirus Aid, Relief, and Economic Security (CARES) Act, borrowers must meet certain eligibility requirements, including their need for a PPP loan, anticipated use of proceeds, and historic payroll and operational criteria.  Later, for their loans to be forgiven, borrowers must demonstrate they appropriately used the proceeds and maintained certain payroll levels.

To facilitate the speedy implementation of the PPP, the CARES Act and subsequently issued SBA guidance reduced standard borrower vetting requirements and permit lenders to rely on borrower certifications for both its initial lending decision and later forgiveness eligibility determination.  SBA also issued guidance declaring that lenders who rely in good faith on borrower attestations will be held harmless for lending decisions made in reliance on those attestations.  In December 2020, the Economic Aid to Hard-Hit Businesses, Nonprofits and Venues Act (“Economic Aid Act”) was signed into law.  The Economic Aid Act authorizes the third PPP funding round and contains material changes to the PPP, particularly as to lender compliance obligations.

Principally, the Economic Aid Act authorizes further PPP funding and allows prior PPP borrowers to pursue second draw PPP loans.  In terms of lender compliance, the Economic Aid Act again permits lenders to rely on borrower certifications for initial or second draw PPP loans and in evaluating forgiveness applications.  Importantly, the Economic Aid Act contains a seemingly expanded hold harmless provision (the “Hold Harmless Provision”):

“[w]ith respect to a lender that relies on a certification or documentation described in paragraph (2) related to an initial or second draw PPP loan, an enforcement action may not be taken against the lender, and the lender shall not be subject to any penalties relating to loan origination or forgiveness of the initial or second draw PPP loan, if –

(A) the lender acts in good faith relating to loan origination or forgiveness of the initial or second draw PPP loan based on that reliance; and

(B) all other relevant Federal, State, local, and other statutory and regulatory requirements applicable to the lender are satisfied with respect to the initial or second draw PPP loan.”

Part (B) of the Hold Harmless Provision is where the rubber meets the road for lenders.  While the CARES Act, Economic Aid Act, and SBA Guidance suggest lender obligations are lessened in terms of vetting and monitoring borrowers and borrower activity, each of those sources makes clear that the lender must nevertheless meet its obligations under the BSA.  This, of course, means lenders must perform sufficient customer due diligence, their risk assessments must take into account the risk of PPP fraud and they must continue monitoring customer accounts for suspicious activity, which seemingly would include activity inconsistent with the uses of PPP funds and indicative of PPP fraud.  As we track here, fraud is a significant issue in not only the PPP, but with all COVID-related stimulus spending.

The February 1, 2021 FAQs

The Financial Crimes Enforcement Network (“FinCEN”) has left open many questions at the intersection of the CARES Act, Economic Aid Act and BSA.  The February 1, 2021 FAQs address one of those areas centering on client onboarding and customer due diligence.

At the outset, the FAQs note “[t]he U.S. government will not challenge lender PPP actions that conform to this guidance, and to the PPP Interim Final Rule and any subsequent rulemaking in effect at the time.”  With this assurance, FinCEN answers four FAQs.

Addressing whether PPP loans for existing customer constitute new accounts for FinCEN customer due diligence (“CDD”) purposes, FAQ 1 makes clear that lenders need not re-verify CDD information for existing customers.

FAQ 2 addresses the competing beneficial ownership rules applicable to lenders generally and through the CARES Act.  The FinCEN CDD Rule requires lenders to identify the identity of its legal entity customers, including the beneficial owners of any covered companies opening accounts by verifying the identity of any individual who owns 25% or more of the entity and an individual who “controls” the entity.  Collected information must include, at a minimum, the individuals’ name, date of birth, address and taxpayer ID number.

Under the PPP, lenders also are required to satisfy beneficial ownership requirements for new customers by collecting the name, title, ownership percentage of the subject company, taxpayer ID number, address, and date of birth for natural persons owning at least 20% of the PPP borrower.

First, FAQ 2 notes that if a PPP loan is being made to an existing customer, the lender is not required to collect additional beneficial ownership information and re-verify information already collected.  For new customers, the FAQ 2 confirms that information collected for PPP beneficial ownership confirmation purposes “will be deemed to satisfy applicable BSA requirements and FinCEN regulations governing  the collection of beneficial ownership information.”

FinCEN’s acknowledgement that PPP-specific rules expressly satisfy differing BSA requirements here raises an interesting and as-yet unresolved issue: Under the FinCEN CDD Rule, like with the PPP, a financial institution can rely on customer attestations concerning the beneficial owner.  Unlike the CARES and Economic Aid Acts, however, the FinCEN CDD Rule explicitly cautions that financial institutions can only rely on customer attestations provided it has no facts that would reasonably call into question the reliability of such information.  Neither the CARES or Economic Aid Acts include this vital caveat thus raising the question: Has a lender met its beneficial ownership requirements under the PPP and BSA if it fails to ensure it lacks conflicting information?

Has a lender met its beneficial ownership requirements under the PPP and BSA if it fails to ensure it lacks conflicting information?

FAQs 3 and 4 both address issues surrounding second draw PPP loans.  In FAQ 3, FinCEN clarifies that the responses to FAQs 1 and 2 both apply to second draw PPP loan applicants.  In FAQ 4, FinCEN confirms that information collected for a first draw PPP loan can be relied upon by that lender for a second draw PPP loan.  It concludes, however, with a critical caveat:

Decisions regarding the updating of customer due diligence and the verification and updating of the beneficial ownership information collected from customers should be made consistent with the guidance for both existing customers and new customers set forth in the previous April 2020 FAQs above and in this FAQ, and pursuant to the lender’s risk-based approach to Bank Secrecy Act compliance.

Accordingly, it would appear that FinCEN is acknowledging that while the PPP has relaxed certain BSA compliance obligations, lenders must nevertheless account for the PPP in its BSA/AML risk assessment and implement its AML program in light of the fraud risks presented by the PPP.

While they certainly add some clarity to PPP lenders’ compliance obligations, in some ways, the FAQs raise more difficult questions as noted above.  What they continue to make crystal clear, however, is that PPP lending, though augmented with its own rules, must be performed within and consistent with existing BSA compliance obligations.