As we approach the two-year anniversary of the passage of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”), the scope and costs of fraud in connection with its relief programs continues to mount.  To date, the Department of Justice has brought criminal charges against over 1,000 defendants with alleged losses exceeding $1.1 billion; seized over $1 billion in Economic Injury Disaster Loan proceeds; and initiated over 240 civil investigations into more than 1,800 individuals and entities for alleged misconduct in connection with pandemic relief loans totaling more than $6 billion.

While these figures represent an enormous amount of fraud, they likely represent the tip of the iceberg in terms of the total amount of fraudulent or otherwise improper spending that has occurred in connection  with these pandemic relief programs.  A significant amount of fraud in the Paycheck Protection Program (“PPP”) in particular has been detected  since the program’s inception.  Indeed, some studies indicate that upward of 15% of all PPP disbursements – around $125 billion – might have been improperly made or fraudulently obtained.

To date, prosecutions for PPP fraud have targeted borrowers and often involve the most brazen fraudsters.  Lenders that facilitated fraudulent borrowing have, to this point, avoided liability.  This dynamic, however, appears to be changing with increasing indications coming from the federal government that it intends to shift its enforcement efforts to complicit lenders.

Congressional Investigations.

Potential lender liability for fraudulent PPP loans has been the subject of Congressional scrutiny.  Throughout 2021, the House of Representatives Select Subcommittee on the Coronavirus Crisis, headed by Rep. James Clyburn, made several overtures to PPP lenders.

First, on March 3, 2021, Rep. Clyburn sought information from the nation’s largest lenders on their PPP lending policies and compliance efforts, including Anti-Money Laundering (“AML”) and know-your-customer (“KYC”) policies.  This request was driven by the Select Subcommittee’s dual concerns that lenders both prioritized existing customers for PPP loans over non-customers in need of PPP loans and failed to adequately implement safeguards to prevent fraudulent borrowing.

On May 28, 2021, the Select Subcommittee expanded the scope of its investigation to look at the role FinTech firms and their banking partners played in PPP lending.  Specifically, the Select Subcommittee, seizing on reports that FinTech firms originated a hugely disproportionate number of fraudulent PPP loans, sought information and documentation from some of the largest FinTech firms concerning their AML and KYC controls and compliance policies and protocols.   Further widening its probe, the Subcommittee issued an additional information request to two other large FinTech firms on November 23, 2021.

Enforcement Efforts.

While Congress took the lead into examining lender PPP practices in 2021, the Executive Branch has positioned itself to enter the fray in 2022.  At his State of the Union Address, President Biden emphasized his intent to dramatically ramp up the Department of Justice’s efforts to detect and prosecute PPP fraud  in several key ways.  First, he announced he will appoint a Chief Prosecutor to the DOJ’s COVID-19 Fraud Enforcement Task Force to lead specialized teams of prosecutors and agents to target major COVID-19 fraud schemes and pursue more sophisticated cases.  These “strike force teams” will be tasked with “connect[ing] the dots on identity theft and other complex fraud schemes committed across state lines or transnationally, as well as investigat[ing] major cases of criminal fraud in programs like the [PPP].”  Second, he called on Congress to provide additional resources to fund the “strike force teams” and also to enhance penalties for pandemic-related fraud.

Then, on March 10, 2022, the DOJ announced that Associate Deputy Attorney General Kevin Chambers will serve as Director for COVID-19 Fraud Enforcement.  Emphasizing its commitment to using “every available federal tool – including criminal, civil and administrative actions,” the DOJ explained that the “Strike Teams” that would operate under Director Chambers “will include analysts and data scientists to review data, agents to investigate the cases, and prosecutors and trial attorneys to bring charges and try the cases.”

This ramp up in enforcement efforts followed close on the heels of the first criminal prosecution of a PPP lender.  On March 1, 2022, the DOJ announced the indictment of the CEO of a non-bank PPP lender, accusing him of falsifying records in order to obtain SBA approval to participate as a lender in the PPP.  According to the Indictment, after obtaining approval to participate in the PPP, the defendant oversaw the approval of over $932 million in PPP loans, which generated over $71 million in lender fees.  On top of that, the defendant allegedly caused his own company to receive a $300,000 PPP loan through false statements concerning the number of its employees.

What’s Next?

Clearly, the federal government has moved past the low-hanging fruit stage of PPP enforcement and is now focusing on the more complex, sophisticated and difficult to detect fraud cases.  It is equally clear that the Government is now aggressively examining lender behavior in the PPP.  With lenders having earned billions of dollars in fees for administering the PPP, the Government is ramping up its efforts to determine whether those lenders fully met all  applicable obligations.  Based on the nature of the investigations into lender practices thus far, we can expect further enforcement actions to arise in at least four different contexts.

First, the Government will scrutinize non-traditional lenders to ensure they fully and accurately met all program requirements to participate in the PPP.

Second, the Government can be expected to examine borrower fraud cases to determine whether lender insiders aided or facilitated the fraud in any way.  If so, the lender itself can face liability.

Third, the Government will continue to examine whether PPP lenders adequately maintained and implemented AML and KYC procedures and otherwise met all of their obligations to detect and prevent fraud.  Appropriate compliance involves not only preventing potential fraudulent borrowing, but also requires monitoring borrower activity to detect ongoing fraud and filing suspicious activity reports where appropriate.  Any compliance failures could lead to sanctions under the Bank Secrecy Act or, if systemic, potential liability under the False Claims Act.  While no PPP lender is insulated from an enforcement action stemming from compliance failures, FinTech firms and other non-bank lenders that engaged in large scale PPP lending without robust compliance programs will continue to be the most at risk.

Fourth, the Government will continue examining PPP loan data to ensure lenders met all applicable fair lending standards.

While we are two years removed from passage of the CARES Act, we are only just entering the fraud and compliance enforcement stage in earnest.