As financial institutions begin issuing the unprecedented amount of Small Business Administration (“SBA”) Section 7(a) loans through the CARES Act’s Paycheck Protection Program, lenders need to be vigilant and adopt thorough recordkeeping and anti-money laundering (“AML”) compliance programs.

Congress’ unprecedented two-trillion-dollar stimulus package, the Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”), includes the “Keeping American Workers Paid and Employed Act,” which adds a new program called the “Paycheck Protection Program” (the “PPP”) to the SBA’s jurisdiction. The PPP is a $350 billion appropriation for Section 7(a) loans, a type of SBA loan. Unlike previous Section 7(a) loans, the PPP provides that certain portions of the loan may be forgiven if they are used to continue making payroll or paying rent.

Section 7(a) loans are federally guaranteed, but underwritten by private banks. The PPP is a massive increase in funding. To put things in perspective, the SBA’s 2019 Annual Report indicated that the agency made approximately seven billion dollars in SBA loans quarterly, with a portfolio of outstanding loans totaling about $120 billion. The CARES Act contemplates underwriting $350 billion in loans over the next approximately 90 days.

Congress also intends to increase the number of financial institutions that handle these loans. SBA loans have historically been issued within days of an applicant’s seeking a loan—sometimes less than one week. The stimulus program will mean billions of dollars being paid out with minimal or no due diligence, in many cases, by lenders who have no experience making SBA Section 7(a) loans. While this program grows exponentially, the regulator, the SBA, will have nearly all of its employees sequestered in their homes.

The stimulus package is plainly welcome news for the economy, but the surge in lending will no doubt cause significant regulatory growing pains. Under the Section 7(a) program, applicants typically receive their loan proceeds in less than two weeks. The SBA places heavy emphasis on quickly releasing funds to businesses. Despite this rapid turnaround, the loans still have certain due diligence requirements on financial institutions (albeit minimal).

Previous Enforcement Has Been Lax

SBA lenders are supervised by the Office of Credit Risk Management (the “OCRM”), which makes risk assessments of lenders. The OCRM has only sparingly conducted audits. For example, the Inspector General reported the following statistics on OCRM reviews of “high-risk” lenders:

The OCRM identifies lenders who were high risk through a variety of means, including analyzing the lender’s portfolio management, asset management, regulatory compliance, and risk management. These figures will no doubt increase now that the Section 7(a) program is increasing three hundred percent.

Creating an Environment of Compliance

SBA lending will increase exponentially in April. When the economy recovers, law enforcement will begin investigating this unprecedented disbursement of funds. Even one corrupt lending official can damage a financial institution’s reputation and its profitability. Therefore, the lenders need to be vigilant. The SBA Office of Inspector General has previously recommended that lenders take certain steps, including:

1. Development of sufficient management oversight of loan approvals, including the use of multiple “eyes” reviewing the underlying documents that are used in generating credit approval memoranda, at least on larger dollar loans.
2. Limits on commissions and other internal inducements that provide incentives for loan officers to concentrate on loan volume at the expense of loan quality.
3. Internal review and auditing functions to examine the reasons why a particular lending official may have an unusually high number of loans that go into early default or experience other significant problems.
4. Internal review and auditing functions to examine the reasons why a particular lending official may have a significantly higher loan volume than his/her colleagues.

As part of the emergency rulemaking that was issued on April 2, 2020, the SBA stated that banks must report suspicious activities to the Financial Crimes Enforcement Network. These reporting requirements apply to these Section 7(a) loans and must be included in a lender’s AML policies.

Loan Forgiveness is a Central Part of the Plan

As noted above, the stimulus package has a loan forgiveness program, the PPP. Borrowers who use loans proceeds to continue making payroll and paying certain operating expenses like rent will be able to seek an abatement of the loan. Under the PPP, lenders are responsible for collecting and reviewing the paperwork that the borrowers submit to obtain their loan forgiveness. Lenders then determine whether the loan should be forgiven. The CARES Act provides that enforcement action or civil penalties will not be pursued, if lenders receive the appropriate documentation.

Specifically, under Section 1106(h) of the CARES Act, lenders that receive certain documentation from borrowers will be absolved from liability or a civil enforcement action if the documentation later turns out to be false. In its April 2, 2020 regulations, the SBA stated that the banks may rely on statements from borrowers about their income.

Despite Section 1106(h), under prior regulations, the SBA is released from liability if:

• The lender has failed to comply materially with any Loan Program Requirement for 7(a) loans;
• The lender has failed to make, close, service, or liquidate a loan in a prudent manner;
• The lender’s improper action or inaction has placed SBA at risk;
• The lender has failed to disclose a material fact to SBA regarding a guaranteed loan in a timely manner;
• The lender has misrepresented a material fact to SBA regarding a guaranteed loan; and
• The lender has failed to use required SBA forms or exact electronic copies.

13 C.F.R. § 120.524(a). This regulation is broadly worded and subject to interpretation. It provides the SBA with ample opportunity to withdraw its guarantee.

Section 1106(h) of the CARES Act provides that the lenders will not be liable if the documents that they receive from a borrower turn out to be fraudulent. However, it is unclear how this provision will be interpreted if a lender ignores warning signs that the documentation that it receives may be inaccurate.

It is not too difficult to imagine a scenario where one or a handful of bank employees devise a scheme to defraud the SBA. Banks that plan to participate in this vitally important program should begin to prepare sufficient compliance programs.

The SBA Section 7(a) loans program is a key component of the stimulus package. Lenders should embrace this program, but also should be prepared to adopt a robust recordkeeping and compliance program.