While the Coronavirus Aid, Relief, and Economic Security (CARES) Act makes borrowers primarily responsible for demonstrating loan eligibility under the Small Business Administration’s Paycheck Protection Program, lenders must also ensure compliance with the act’s terms for both loan eligibility and forgiveness.
An integral component of the CARES Act stimulus package is the Paycheck Protection Program (PPP), which authorizes the Small Business Administration (SBA) to extend up to $349 billion in loans to eligible borrowers. The program is designed to incentivize small businesses to maintain employees on their payrolls by authorizing loans—100% guaranteed by the SBA—that, subject to certain limitations and requirements, may be forgiven if the money is used for payroll, rent, mortgage interest, or utilities within eight weeks of receiving the loan. For more detail, read our LawFlash on the PPP.
In implementing the CARES Act, the SBA has issued an Interim Final Rule and, in conjunction with the US Department of the Treasury, additional guidance setting forth PPP loan responsibilities and procedures for borrowers and lenders. In doing so, the SBA has been clear that to provide relief as quickly as possible, it will limit lender due diligence requirements.
For PPP loan purposes, lenders can rely on borrowers’ certifications to determine program eligibility and borrowers’ documentation in determining loan amount and loan forgiveness eligibility. As such, while lenders are required to comply with the specified lender obligations, they “will be held harmless for borrowers’ failure to comply with program criteria.”
As discussed below, the SBA has taken steps that should provide important liability protections to lenders that administer the PPP in good faith. Even with these protections, given the nature of lenders’ obligations under the PPP—both as set forth by regulation and through agency guidance—there remains risk that a lender’s failure to detect certain misrepresentations by a borrower could expose a lender to governmental civil or criminal enforcement, including under the civil False Claims Act (FCA) and the Financial Institutions Reform Regulation Enforcement Act’s (FIRREA’s) civil monetary penalty provision.
Given the PPP’s size and the scope of anticipated lending activity, the program is ripe for qui tam enforcement under the FCA, particularly by lender and borrower “insiders” claiming direct knowledge of misconduct involving borrower applications and lender underwriting. Moreover, notwithstanding that much of this lending activity will be undertaken in the unique and challenging coronavirus (COVID-19) work environment, lenders should not expect to be excused from compliance with Bank Secrecy Act (BSA)/anti-money laundering (AML) controls.
To place lenders’ obligations under the PPP in context, it is helpful to understand borrowers’ eligibility and loan forgiveness criteria as well as their application and loan forgiveness obligations, which we summarize in general terms below.
To be eligible for a PPP loan, businesses must meet certain size and other criteria, and the maximum amount of any loan is based primarily on a formula tied to the business’s aggregate payroll costs over the preceding 12 months.
A PPP loan applicant must certify to numerous criteria, including the following:
Applicants must also provide documentation “necessary to establish eligibility” such as payroll and other specified records. However, borrowers that do not have any of the specified types of documentation may provide “other supporting documentation . . . sufficient to demonstrate the qualifying payroll amount.”
In addition, applicants must disclose certain equity ownership interests in their businesses. Because the applicant is defined for certain purposes to include its equity owners, those ownership interests may need to be considered in assessing PPP eligibility. For instance, an individual business may, standing alone, be below the employee cap, but that cap may be exceeded when combined with the number of employees of its owner or parent company. For more detail, read our LawFlash on PPP affiliation rules.
The applicant also must agree to provide the lender documentation verifying the number of full-time-equivalent employees on payroll and the payroll and other covered costs for the eight-week period following loan issuance. Any PPP loan is eligible for forgiveness of the full principal and any accrued interest up to the amount paid on covered expenses, so long as at least 75% of the forgiveness amount is attributable to payroll costs. For more on qualifications for forgiveness, read our detailed LawFlash on the PPP.
Notably, the applicant form expressly states that a false certification may subject the borrower to criminal liability and penalties. For a detailed analysis of potential liability and penalties for borrowers, read this LawFlash from our Coronavirus COVID-19 Task Force.
On the lender side, the Interim Final Rule requires lenders to confirm
The SBA’s Lender Application Form requires a lender to certify that it has “complied with the applicable lender obligations,” summarized above, and that it has “obtained and reviewed the required application (including documents demonstrating qualifying payroll amounts) of the Applicant.”
Lenders also are required to follow all BSA requirements, whether by continuing to use existing BSA protocols or, if not presently subject to the BSA, establishing an AML compliance program equivalent to that of a comparable federally regulated institution. For example, the SBA notes that, where appropriate, such a program requires a customer identification program (CIP) for both individual and entity clients. With respect to PPP loans to existing clients who already have been verified under a lender’s BSA/AML program, the SBA notes that re-verification is not required “unless otherwise indicated by the institution’s risk-based approach to BSA compliance.” Furthermore, lenders, as part of its BSA/AML program are required to identify and report certain suspicious activity to the Financial Crimes Enforcement Network (FinCEN).
With respect to loan forgiveness, the SBA makes clear that lenders may rely on borrower documentation regarding eligibility for loan forgiveness.
Ultimately, these PPP obligations generally fall into three categories of lender responsibility, described in further detail below:
Lender Not Responsible
On its face, the Interim Final Rule appears to place no obligation on lenders to verify eligibility information provided by borrowers. Lender obligations in this regard are limited to confirming receipt of borrower certifications and required information, and the rule makes clear that the SBA “will allow lenders to rely on certifications of the borrower in order to determine eligibility of the borrower.”
Furthermore, in a series of Frequently Asked Questions (FAQs) published by the SBA in consultation with the Treasury Department, the SBA makes clear that lenders are not required to make an independent determination on affiliation rules for determining borrower eligibility:
It is the responsibility of the borrower to determine which entities (if any) are its affiliates and determine the employee headcount of the borrower and its affiliates. Lenders are permitted to rely on borrowers’ certifications.[1]
Thus, there does not appear to be any obligation on a lender to verify borrower eligibility certifications such as a borrower’s required certification that the current economic environment makes a PPP loan necessary and that the borrower has not received and will not obtain another PPP loan. However, as discussed below, a lender’s obligation with respect to a borrower’s certification that it was in operation on February 15, 2020 is more ambiguous.
With respect to loan forgiveness, the SBA is explicit that lenders are not responsible for the truthfulness of a borrower’s attestations about loan forgiveness eligibility. The Interim Final Rule provides that “[t]he lender does not need to conduct any verification if the borrower submits documentation supporting its request for loan forgiveness and attests that it has accurately verified the payments for eligible costs. The [SBA] will hold harmless any lender that relies on such borrower documents and attestation from a borrower.” However, as discussed below, to the extent a lender seeks to take advantage of the advance or expected forgiveness procedures, such a lender appears to lose this safe harbor.
Notwithstanding these relaxed standards, a lender will remain liable in those circumstances where it knowingly transmits false information to the SBA. For example, even if a borrower certifies otherwise, a lender may face exposure if it knows—including under the lesser scienter standards under the FCA—based on other business dealings with the borrower or otherwise that the borrower’s certifications are false. And under the CARES Act Lender Agreement, the lender also must “acknowledge that any false statements made to the [SBA] and Department of the Treasury can result in criminal prosecution . . . and imposition of civil money penalties.”
Lender Potentially Responsible
With respect to other lender obligations, despite the representation in the Interim Final Rule that lenders will be able to rely on certifications of documents provided by borrowers, the degree of lender responsibility remains unclear. For example, the Interim Final Rule does not appear to contain any lender obligation to confirm that a borrower was in operation on February 15, 2020. Subsequent guidance provided in a PPP Lender Information Fact Sheet, however, requires lenders to “verify that a borrower was in operation on February 15, 2020.” To the extent this verification is satisfied through the lender obligation to “confirm receipt of information” showing that a borrower “had employees for whom the borrower paid salaries and payroll taxes on or around February 15, 2020,” then there remains no additional responsibility on the part of the lender with respect to that certification. “Confirmation of receipt,” however, typically is not used synonymously with “verification” (and documentation showing employment “on or around” February 15, 2020 will not necessarily demonstrate operation “on February 15, 2020”), meaning that the subsequent guidance may have created ambiguity in this regard.
A lender is also required to confirm an applicant’s payroll costs by reviewing payroll documentation, and the Interim Final Rule goes on to provide a catchall description of the required documentary support, namely documentation “sufficient to demonstrate the qualifying payroll amount.” The FAQs go further to impose a duty to “perform a good faith review, in a reasonable time, of the borrower’s calculations and supporting documents.” Where the lender “identifies errors in the borrower’s calculation or material lack of substantiation in the borrower’s supporting documents,” the lender has an obligation to remedy the issue with the borrower. What exactly the “good faith review” entails—particularly given the potential volume of applications and the SBA’s stated desire to provide relief to small business expeditiously—and what constitutes a “material lack of substantiation,” however, are almost by necessity left undefined. For example, it is not clear whether a good faith review would require a comparison of documentation provided by an existing customer with information previously provided to the lender by that customer, and whether any discrepancy would constitute a “material lack of substantiation.”
Thus, failure to conduct such a good faith review and remedy any inaccuracies and shortfalls may violate a lender’s obligation to confirm the borrower’s payroll costs and call into question a lender’s certification that it has complied with its obligations and obtained and reviewed documents “demonstrating qualifying payroll amounts” of the borrower. In this regard, it should be noted that in analogous circumstances, lenders of federal insured loans have been deemed to act in a fiduciary capacity to the government and have been held to such standards in assessing FCA and FIRREA civil monetary penalties provision liability.
With respect to loan forgiveness, the Interim Final Rule allows lenders after seven weeks to request that the SBA purchase “the expected forgiveness amount of a PPP loan or pool of PPP loans.” However, while a lender is entitled fully to rely on a borrower’s attestations with respect to a forgiven loan, a request for expected forgiveness must include a lender’s assessment of what it “reasonably expects the borrower to expend on” payroll and other covered costs. The request must include a report including a “detailed narrative” explaining, among other things, the “assumptions used in determining the expected forgiveness amount, the basis for those assumptions, alternative assumptions considered, and why alternative assumptions were not used” as well as “any information obtained from the borrower since the loan was disbursed that the lender used to determine the expected forgiveness amount.”
This report to the SBA will of course require statements and calculations by the lender for which the SBA and the Interim Final Rule have not provided a safe harbor. Moreover, in these circumstances, where a borrower has not yet requested forgiveness, it is not clear that a lender has no obligation to verify the accuracy of the documentation provided by the borrower that the lender submits in support of its advance forgiveness request (that “hold harmless” provision applies only if a borrower has made a request for loan forgiveness and “attests that it has accurately verified the payments for eligible cost”).
Lender Responsible
The Interim Final Rule is explicit that lenders are required to abide by their BSA protocols (or adopt BSA protocols if not previously required to have them, which generally involves establishing a board-approved policy and designating a BSA compliance officer) in making PPP loans to new and existing customers. Thus, no matter the volume of applications from either existing or new customers, lenders must continue to comply with the BSA/AML compliance protocols, including Know Your Customer processes.
Furthermore, lenders must continue to ensure adequate monitoring for and reporting of suspicious transactions. In the context of PPP, this may include an obligation to identify a borrower’s fraudulent conduct even if the SBA does not independently require a lender to verify or attest to particular representations. For example, whether or not a lender has an obligation under PPP regulations to verify financial information provided by a buyer, where the information is inconsistent with information known to the lender, the lender may have a BSA/AML reporting obligation. Similarly, although there does not appear to be an obligation on behalf of the lender to confirm an applicant’s attestation that it has not received another PPP loan, a lender’s knowledge that an applicant has received prior PPP loans may itself trigger a reporting obligation.
As to other laws and regulations that apply to business lending, the statute and the Interim Final Rule are silent. In the absence of express provision to the contrary, lenders should assume that generally applicable business lending regulatory laws such as the Equal Credit Opportunity Act, the unfair or deceptive acts or practices (UDAP) provisions of the Federal Trade Commission Act, and, for nonbank lenders, state lending licensing laws (in those states, such as California, that license business lending) apply with equal force to PPP loans and loan applications.
In an effort to expedite the distribution of relief funds to small businesses, Congress, in enacting the CARES Act, and the SBA, in implementing it, took some important measures to limit lenders’ potential exposure, including under FCA and FIRREA, in connection with good faith lending activities in administering PPP loans, including by authorizing lenders to rely on borrower certifications in most instances. Lenders, however, do retain certain responsibilities and must certify compliance with those responsibilities in the PPP loan applications. And lenders should not expect to be insulated from liability—particularly under the FCA—where they know that a borrower’s eligibility certifications are false.
Furthermore, in connection with particular PPP loan application and forgiveness requirements, the Interim Final Rule and subsequent guidance have left somewhat vague the degree to which lenders could be held responsible for the veracity of the information submitted to the SBA. Particular care therefore may be warranted in ensuring a borrower was in operation on February 15, 2020, in conducting a “good faith review” of a borrower’s historical payroll costs, and in making any submissions supporting advance loan forgiveness.
More clearly, however, the Interim Final Rule leaves no doubt that lenders are required to follow BSA compliance procedures in processing what undoubtedly will be a considerable volume of PPP loan applications. Lenders should also carefully review PPP advertising, loan application processes, and lending decisions for UDAP and fair lending compliance.
For our clients, we have formed a multidisciplinary Coronavirus COVID-19 Task Force to help guide you through the broad scope of legal issues brought on by this public health challenge. We also have launched a resource page to help keep you on top of developments as they unfold. If you would like to receive a daily digest of all new updates to the page, please subscribe now to receive our COVID-19 alerts.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
Chicago
Megan R. Braden
Tinos Diamantatos
Houston
B. Scott McBride
John W. Petrelli
Miami
Alison Tanchyk
New York
Kelly A. Moore
Martha B. Stolley
Daniel B. Tehrani
Philadelphia
Meredith S. Auten
John C. Dodds
Lisa C. Dykstra
Rebecca J. Hillyer
Ryan P. McCarthy
Zane David Memeger
John J. Pease, III
Eric W. Sitarchuk
Washington DC
Douglas W. Baruch
Giovanna M. Cinelli
Brad Fagg
Scott A. Memmott
Kenneth J. Nunnenkamp
Jennifer M. Wollenberg
Howard J. Young
[1] An important caveat in relying on the FAQs is that, although the SBA says that lenders may rely on the guidance and the US government “will not challenge lender PPP actions that conform to this guidance,” the guidance also states that it “does not carry the force and effect of law independent of the statute and regulations on which it is based.”