Pressure exposes vulnerabilities. That concept became a fact when the federal government launched the Paycheck Protection Program (PPP), and fraud followed risk management lapses. Lenders had been pressured to quickly process a high volume of government loan applications through a program with limited oversight and eligibility criteria. The program, established by the Coronavirus Aid, Relief, and Economic Security (CARES) Act, provided a total of $934 billion in funding to companies affected by the COVID-19 pandemic. To date, government investigations have identified more than $1 billion in fraudulent PPP loans issued to about 1,000 borrowers.
The Small Business Administration (SBA) had stated that lenders could rely on the representations made by borrowers on PPP application forms and needed only to perform a “good faith review” of certain items. But good faith review wasn’t defined, creating potential risk to lenders, who still needed to comply with all regulations.
In one example of fraud, two defendants in Florida were charged with conspiracy and making false statements to a financial institution. According to the complaint, the defendants used their home IP address to submit at least 70 false and fraudulent loan applications, including for shell companies and a defunct tax-preparation company. The conspirators sought more than $5.8 million in PPP and Economic Injury Disaster Loan funds, and they misused funds by paying off a luxury vehicle, spending more than $62,000 at casinos and for other personal purposes.
That wasn’t an isolated case, said Chris Ludwig, managing director and leader of Anti-Money Laundering and Office of Foreign Assets Control at Grant Thornton. “There are many examples of people forging documents, leveraging companies that have been defunct for a couple of years, forging IRS documents and articles of association, and presenting falsified documents to the bank to claim hundreds of thousands or millions of dollars.”
Retrospective analysis of the loans has found that a lack of lender due diligence contributed to illegitimate loans. Although the PPP situation is unusual, it offers an opportunity for lenders to look thoughtfully at how lapses occurred, assess their controls and processes, and reduce risk going forward.
Where due diligence broke down
“Some of the lenders’ processes have a blatant shortcoming,” Ludwig explained. “For example, an applicant would come to the bank and say something like, ‘My company has six employees. Each is making $20,000 per month, so my payroll cost is $120,000 a month. I’ve had 12 months of losses; therefore, I’m claiming $1.5 million.’ The lender didn’t always check what kind of company would have six employees with each making $20,000 a month.” Through the anti-money laundering process, the lender should have verified the person applying for the loan and checked data points, Ludwig added. “That would have uncovered some red flags.”
Even basic information sometimes wasn’t clearly documented — or accessible. In working to uncover possible problems, one lender struggled to list which loans it distributed through the PPP, Ludwig said.
Frederick Kohm, partner in Forensic Advisory Services at Grant Thornton, said: “Fraud has been a constant theme since the inception of the program.” Fraudulent applications have put lenders in a difficult situation. Lenders have raised the problem of some applicants being disconnected with economic necessity, he explained. “Companies have taken out loans without knowing whether they were going to need the money. One corporation with a complex structure received several million dollars in PPP and other loans across several companies. Three of the five companies need help reconciling how they used the money. If the recipient is having trouble figuring out how to support that the loans were used in the right manner, that makes it more difficult for a lender to determine whether that support was viable.”
“Understand the population of PPP-related loans on your books and internally assess the risk of fraud in that population.”
What lenders can do now
Lenders can take a step back and review the applicants they’ve accepted, Kohm advised. “Understand the population of PPP-related loans on your books and internally assess the risk of fraud in that population. You can do that by considering the information that applicants provided and whether it was sufficient for a loan to be executed. If it wasn’t, what responsibility do you have to collect information that would help make the information more robust?” This process will help you get ahead of any fraud that may have taken place and demonstrate to regulators that you are serious about monitoring for red flags.
After you pinpoint information gaps and contradictions, Kohm recommended next steps: “You might find instances of fraud and submit them to authorities and the SBA. So, you’re self-reporting potential issues and loans you’ve executed on. In other instances, you may want to cross-reference against historical information. You may find applicants who are current customers and see differences in data they provided previously and now. You could ask them, ‘We don’t quite understand what you’ve submitted. Can you explain further?’”
Another place that lenders can check is their employee base, according to Kohm. “You could find issues with your own employees who worked on these loans. There could be inside arrangements where some corruptions have taken place. Right out of the gate, one lender identified employees who submitted loans [for] themselves for businesses that didn’t exist.”
To check past applications, lenders can use outside resources or set up internal committees and task forces, Kohm said. “Take people off their day-to-day job for a time and assign them to look into these types of things. These teams could be within internal audit or data analytics groups.”
“You can look at the current justice decisions to see if any of the people charged happened to be recipients of some of the funds processed by your institution.”
Ludwig added that lenders can check external information about the need for remediation. “You can look at the current justice decisions to see if any of the people charged happened to be recipients of some of the funds processed by your institution.”
Usually, the most effective response is a series of actions performed first by the loan recipient and then the lender, Kohm said. Those actions would be for lenders and recipients to discuss:
- How the loans were used
- What the company’s condition was when the loan was received
- Whether that condition changed over time
- How the company’s condition affected the use of the loans received
Conducting an assessment
An assessment of your PPP loan portfolio is a crucial way to identify, analyze and act on potential red flags. Lenders can apply the following steps to perform assessments, including:
- Questionnaires and interviews
- Distribute questionnaires to individuals in key areas such as compliance, finance and procurement.
- Interview employees in roles relevant to the scope of the audit to understand various processes and where individuals see the biggest risks in obtaining supporting documentation.
- Data analysis and transaction testing
- Review and validate completeness and accuracy of the data received.
- Perform data analytics procedures and identify transactions that align to key risk areas.
- Develop customized testing attributes to identify noncompliance with PPP.
- Report development and remediation
- Prepare a written report of findings and recommendations.
- Develop remediation plans.
- Assist in implementing remediation and performing ongoing analysis.
Through PPP, lenders took a crash course in quickly processing a huge volume of loans with vague guidance. But if they incorporate those lessons into their risk management practices and internal controls, they can likely do damage control now and handle everyday and extraordinary pressures more effectively in the future.
For more information, register to replay the webcast Examining the AML Act of 2020 and know your customer fraud within the PPP.
Our featured advisory services insights
No Results Found. Please search again using different keywords and/or filters.