As every financial institution likely knows, last week brought the implementation of the Paycheck Protection Program (“PPP”) under the CARES Act. However, with the launch of the program by a number of financial institutions, came the first PPP class action lawsuit against a lender.  On April 7, 2020, an amended complaint was filed against one of the nation’s largest lenders (Profiles Inc. v. Bank of America Corp. et al., No. 1:20-cv-00894 (D. Md. 2020)).  The case highlights the compliance and litigation risks that exist for lenders within the program and can serve as guidance for others as they implement their program for offering PPP loans.

Profiles, Inc. (“Profile”) and other plaintiffs alleges that Bank of America (“BofA”) applied “discriminatory practices” within their PPP origination practices and “has no legal authority under the CARES Act to deny access to, restrict or otherwise impede the access of small businesses to these critically important business-saving funds.”  The SBA’s interim final rule on the PPP lays out who is eligible for the program, as well as what lenders must consider as part of loan underwriting. The guidance, however, does not speak to or give any direction regarding actions by lenders that would be prohibited under the PPP.

In support of the claim for “discriminatory practices,” Profile claims that BofA’s eligibility criteria discriminated against otherwise qualified borrowers. Profile alleges that the eligibility criteria specified by BofA unjustly placed restrictions on acess to the PPP program.  Plaintiff states that on Friday April 3rd, BofA issued the following statement of eligibility:

Small Business clients with a business lending and a business deposit relationship at Bank of America are eligible to apply for a Paycheck Protection Program through our bank. A client’s pre­existing lending relationship with us may include small business, commercial or corporate credit cards, conventional business loan or lease, business lines of credit, business auto loans, practice solutions loans, trade and asset-based loans.

Small Business owners who do not have a business lending and business deposit relationship with us should contact their current business loan provider as soon as possible, if they plan to apply for the federal Paycheck Protection Program. This is the best and fastest method for applying for federal relief, based on the U.S. Treasury requirements and guidance.

According to the Amended Complaint this language was updated on April 4 to read:

The Small Business Administration (SBA) and U.S. Treasury have released the Paycheck Protection Program guidelines. Our Small Business clients who may be eligible for financial relief can now apply online. To be eligible, you must have a Small Business lending and Small Business checking relationship with Bank of America as of February 15, 2020 or a Small Business checking account open no later than February 15, 2020 and do not have a business credit or borrowing relationship with another bank. After you have reviewed the complete Bank of America eligibility requirements below and have gathered the necessary documents, you can apply below.

Chartered and non-chartered lenders participating in the PPP process, like BofA, are defining PPP loan eligibility and refining how they will process and sequence PPP applications.  These same institutions are developing their marketing and roll-out processes in “real time” as they work to implement the program while considering the compliance risks. 

All institutions should be aware of these potential risks associated with their PPP roll-outs.  All of the institution’s processes and procedures should be governed by documented procedures which anticipate and mitigate risks such as the potential risks showcased in this lawsuit.  It is also imperative that each institution focus on their PPP processes’ compliance with its existing controls, policies, and procedures.  If not updated, it is important for each institution to monitor the compliance of its PPP initiative with its existing compliance management system (“CMS”).  An institution should not operate its PPP program in a vacuum. 

All institutions should be carefully considering and documenting their:

• Eligibility criteria for the PPP loan program;
• Marketing and customer-contact initiatives;
• Volume restrictions and how they will prioritize applicants while adhering to a first in first out approach;
• Whether the institution will impose additional underwriting criteria on applicants beyond those mandated by the SBA;
• Training of its commercial bankers to ensure clear messaging, compliant customer communications, and a unified approach to the program;
• Mechanisms to address customers seeking extremely large- or extremely low-dollar-amount PPP loans;
• Clear PPP underwriting guidelines that are subject to the same controls as the existing commercial lending portfolios (other than those relaxed by way of the SBA program—i.e., credit quality controls);
• Preservation of documents from customers and communications with the institution;
• Decisioning worksheets or other documentation of acceptance/denial;
• Vendor risk management controls, if third-party vendors are involved with the PPP loan program;
• Whether oversight and validation controls are dedicated to the PPP loan program;
• Monitoring and addressing the continuously evolving laws and regulations governing the PPP; and
• The procedures and controls in place to mitigate post-origination risks.

Steps that institutions take today can mitigate the litigation risks in the coming months—highlighted in this early lawsuit against BofA.  Each institution should expect its regulators to review their PPP loan program during upcoming examinations.  While we are expecting a somewhat “relaxed” supervisory process around this program, the actions of regulators in the wake of the Great Recessions guides our thinking.  It would be prudent to take these risks seriously and prepare to defend your program come your next exam.