The Small Business Administration (“SBA”) recently issued a procedural notice (the “Notice”) to “All SBA Employees and Paycheck Protection Program Lenders” setting forth “Revised SBA Paycheck Protection Platform Procedures for Addressing Hold Codes on First Draw PPP Loans and Compliance Check Error Messages on First Draw PPP Loans and Second Draw PPP Loans.”  The Notice sets forth procedures Paycheck Protection Program (“PPP”) lenders must follow in approving First or Second Draw PPP loans under the 2021 Economic Aid Act.

PPP Experience To Date

As we discussed in a recent blog post, with the third round of PPP funding currently underway, the government, through SBA and the Financial Crimes Enforcement Network (“FinCEN”), has begun taking steps to clarify lender compliance obligations in implementing the PPP.  The onus of implementing the PPP has been on the private lenders participating in the program.  The SBA reiterates this responsibility in the Notice, emphasizing, “[u]nder the CARES Act, PPP Lenders are deemed to have delegated authority to make and approve PPP loans without prior SBA review.”

While lenders have been acting with this “delegated authority” since Spring 2020, they are only now beginning to operate with answers to how it can meet their compliance obligations under the Bank Secrecy Act (“BSA”) while quickly administering the PPP according to the parameters set forth in the CARES Act and subsequent SBA guidance.  And, with a new funding round opening nearly a year after the initial rounds, the government and private sector are both grappling with sifting through and processing relevant data accumulated through the first two funding rounds.

Under the CARES Act, PPP borrowers were originally limited to obtaining a single loan.  The Economic Aid Act changed that.  In addition to opening a new round of PPP lending to new borrowers – “First Draw” borrowers – the Economic Aid Act permitted prior borrowers to pursue a loan – “second Draw” PPP borrowers.  This expansion of the PPP program introduces lenders to a new category of borrowers: those that previously applied for and either did or did not (for whatever reason) receive a PPP loan.   What does this mean for lenders from a Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) perspective?  Information.

We’ve noted before that the foundational rules of the PPP set forth in the CARES Act are, at first blush, straightforward.  Borrowers submit loan applications to lenders making a variety of eligibility certifications.  Lenders are entitled under the legislation to rely on those certifications when making lending decisions without conducting independent verification.  Lenders then submit loan and guaranty applications to SBA, which vets the applications for eligibility and, if complete, approves them creating an SBA loan number.  After receiving notice from SBA, the lender disburses funds to the borrower.  Those initial ground rules don’t apply neatly to prior applicants and borrowers returning for a second effort at obtaining a loan or additional funding through the program because both lenders and the SBA have an initial tranche of PPP-specific borrower information to process in making new lending decisions.

The Notice addresses circumstances where such borrowers after initially applying for and/or receiving a PPP loan in 2020 were later determined to be ineligible.  This is not a small problem.  It has been heavily reported that because of the sheer quantity of loans intended to be disbursed in such a short period of time during the initial PPP funding rounds, lenders and SBA found it impossible to sufficiently vet each applicant for eligibility.  Many ineligible borrowers slipped through the gaping cracks in the PPP.  The Department of Justice certainly took notice of this dynamic, bringing, to date, dozens of prosecutions against fraudulent PPP borrowers while emphasizing that these cases represent merely the smallest point of the tip of the PPP fraud iceberg.  And, on the back end, SBA is conducting its own diligence in vetting borrower forgiveness applications.  This is to say, while original PPP loans were evaluated, approved and disbursed rapidly allowing ineligible and fraudulent borrowers to obtain PPP funds, the government has had and used the subsequent ten months to evaluate the program and its participants – both borrowers and lenders.

Borrower Red Flags

Now, SBA is implementing processes to alert lenders to borrower red flags it has uncovered that they must consider and resolve prior to approving a borrower’s PPP application.  The Notice sets forth its processes and lenders’ compliance obligations.  In it, SBA outlines its post-approval eligibility and fraud detection processes.

SBA Analysis

First, addressing 2020 First Draw PPP borrowers, it explains that: “[a]fter issuance of the SBA loan number, all First Draw PPP Loans made in 2020 were individually screened by an automated tool, [which] compared First Draw PPP Loan data against publicly available information and applied eligibility and fraud detection rules to identify anomalies and/or attributes that may indicate non-compliance with eligibility requirements, fraud or abuse.”  Additionally, “after issuance of the SBA loan number, SBA performed data analytics, including reviewing information from the Department of Treasury Do Not Pay lists, and other analyses of the 2020 First Draw PPP Loan portfolio.”  These reviews and analyses generated data and information on PPP borrowers: “[t]he automated tool screening, data analysis, and other analyses resulted in the issuance of Hold Codes on certain 2020 First Draw PPP Loans.”  Those Hold Codes included:

• Disqualifying Criminal History
• Disqualifying Bankruptcy
• Potential OFAC Match
• Applicant Potentially Deceased
• Dorman Business
• Applicant Tax ID Discrepancy
• Applicant Name Discrepancy
• Disqualifying Business Formation Date
• Disqualifying Employee Number

Second, with respect to 2021 First Draw and Second Draw PPP borrowers, “before issuance of an SBA loan number, SBA is conducting front-end Compliance Checks on Lender loan guaranty applications . . . using a modified version of the automated screening tool and information from the Department of Treasury Do Not Pay lists.”  When this review detects an issue, “the Compliance Checks generate a Compliance Check Error Message.  In many cases, the Hold Codes and the Compliance Check Error Message identify the same issues.”

Lender Compliance

Hold Codes and Compliance Check Error Messages come into play for lenders in their evaluation of 2021 First Draw and Second Draw PPP loan applications.  If a 2020 PPP borrower generated a Hold Code, in the event it applies for a 2021 Second Draw loan, its application will be automatically set aside in “research status” and the Lender will be given an opportunity to resolve the Hold Code issues raised.  Similarly, if a 2021 First or Second Draw borrower generates a Compliance Check Error Message, the lender will receive notification through the application platform and the lender will have the opportunity to resolve the issue.

Having developed potential borrower red flags, SBA then places the responsibility on lenders to resolve them.  SBA provides several methods for doing so.  Principally, lenders may address the Hold Codes or Compliance Check Error Messages through a certification process.  If a lender elects this method, it must compile additional information identified as sufficient by SBA for resolving the identified issue.  For instance, a lender must obtain proof that principals do not have disqualifying criminal information, that there is no bankruptcy history, its efforts to search the OFAC lists, or other relevant ownership or corporate information, depending on the issue raised.  Having obtained proof it resolved the identified issue, the lender must then certify to SBA that:

• It “has obtained from the borrower and/or other source, and has reviewed, all information and documentation necessary to resolve the issue(s) underlying each of the Compliance Check Error Message(s) and Hold Code(s).”
• It “has resolved all Compliance Check Error Message(s) and Hold Code(s) generated on this loan guaranty application.
• “The Compliance Check Error Message(s) and Hold Code(s) have been resolved in accordance with Paycheck Protection Program guidance”
• It “will retain the information and documentation supporting this certification in its files for the period required by Paycheck Protection Program document retention requirements.”
• It “acknowledges that SBA is allowing the loan guaranty application to proceed in reliance upon this certification.”

In addition to resolving the Hold Codes or Compliance Check Error Messages, lenders must submit all obtained information when it later submits a forgiveness application or guaranty purchase request.

Second Draw PPP loan applications present another wrinkle: a borrower may have obtained its original loan – the one that generated the Hold Code – from another lender.  In those cases, the Second Draw lender must still resolve the Hold Code to continue with the Second Draw while the original lender must also resolve the Hold Code in connection with any forgiveness or guaranty purchase request in connection with the initial loan.

What Does This Mean?

This is a lot to take in.  And, with respect to borrowers that generate Hold Codes or Compliance Check Error Messages, the Notice ups lenders’ compliance ante considerably.  Lenders cannot simply rely on borrower certifications as before but must instead resolve substantive issues surrounding the borrower and make affirmative certifications to the government that it has done so.  This, in turn, places lenders squarely at risk of False Claims Act liability in the event it did not adequately address borrower issues but nevertheless submitted applications for flagged borrowers.

In compliance terms, the Notice raises several concepts lenders in their standard practice are well-acquainted with.  Lenders’ need to ensure their business side is sufficiently coordinated with compliance to catch Hold Codes and Compliance Check Error Messages and their lending practices keep up with SBA’s alerts.  Know Your Customer/Customer Due Diligence (“KYC/CDD”) practices must be updated to account for SBA-generated borrower red flags and reflect the proscribed standards for resolving them.  Also, lenders’ Section 314(b) information sharing processes also should reflect the need to coordinate with prior and subsequent lenders for Second Draw applicants to ensure both are adequately meeting their obligations with respect to lending or forgiveness decisions.

What About . . . ?

While the Notice puts a lot on the plates of lenders, it is vital to keep in mind that, by its terms, it addresses only 2021 First and Second Draw lending decisions.  What if SBA generated a Hold Code for a 2020 borrower who did not subsequently attempt to obtain a Second Draw loan but applies for forgiveness?  It stands to reason that lenders must resolve any Hold Code prior to processing forgiveness or guaranty purchase requests, even though the Notice does not explicitly say so.

Like prior PPP-related guidance, the Notice provides answers and raises questions, making clear that lenders are traversing unsettled ground.  Continued guidance is sure to be needed.