Lender Beware Series - Part III: Criminal Exposure for Banks Participating in the CARES Act

Join us for our Lender Beware webinar on May 6. Click here for more information and to register.

Uncle Sam wants US financial institutions to help with the distribution of trillions of dollars under the CARES Act, and has provided those institutions with significant economic and other incentives to ensure that they will. But for the financial institutions who seize on these incentives—and that list includes most large banks and, in short order, a wide array of regional and small banks—there are pitfalls to being part of the distribution of these funds which could expose banks to criminal investigations and prosecutions. 

The incentives for banks to help distribute CARES Act money are undeniably substantial. For example, the Small Business Administration (SBA) guarantees that loans issued by its lending partners will be repaid, eliminating the risk of default inherent in standard loans. The CARES Act reduces the normal borrower vetting requirements for SBA loans and, in many instances, allows lenders to rely on borrower certifications, making it quicker and easier to process loans. Lenders are compensated by the SBA under a fee structure that encourages lenders to quickly process a high volume of loans. Additionally, Congress has reserved $60 billion for small- and mid-sized banks, credit unions, and community lenders to draw new participants into the program. 

The newly-established Office of the Special Inspector General for Pandemic Recovery (SIGPR) and other law enforcement agencies will be monitoring program activity closely, and it is almost certain that some lenders will face investigations and potential criminal liability arising out of their participation in CARES Act programs. 

Lessons from the Great Recession 

Recent history provides an excellent guide to the risks that banks are taking today. After the Great Recession, the federal government established the Troubled Asset Relief Program (TARP), which allowed the Department of the Treasury to purchase troubled assets from financial institutions to help stabilize their balance sheets. Although financial institutions participating in the CARES Act as lenders are in a different position from financial institutions that themselves applied for funding under TARP, the increased scrutiny that comes with participation in the CARES Act program will likely be the same.   

The TARP era saw significant investigations of financial institutions and individuals; many found themselves facing criminal liability for using false books and records when applying for TARP funding. In some cases, corporate books and records revealed fraud or misconduct unrelated to TARP itself, but which this heightened scrutiny exposed. The government also prosecuted and convicted bank customers who had defrauded financial institutions in other contexts and then later applied for TARP funding. In some cases, employees of the defrauded institutions were co-conspirators in the underlying fraud and also received prison sentences. 

One key lesson from the TARP experience is the high likelihood that all participants in CARES Act funding may be viewed under a magnifying glass, particularly financial institutions that are already subject to robust regulatory oversight. Here, as in the TARP era, law enforcement may uncover unrelated wrongdoing on the part of some program participants in the course of investigating crime, fraud, waste, and abuse related to the CARES Act. 

The CARES Act created several enforcement mechanisms to investigate and address misconduct by lenders and borrowers alike, some of which are similar to the mechanisms employed under TARP. This includes the SIGPR, which will be responsible for conducting, supervising, and coordinating "audits and investigations of the making, purchase, management, and sale of loans, loan guarantees, and other investments" under any program established under CARES Act.^[1] The scope of SIGPR's oversight extends beyond the Paycheck Protection Program (PPP) to Main Street Lending Programs and others administered under the CARES Act. If SIGPR pursues its mandate as aggressively as did the Special Inspector General for TARP, financial institutions may have their hands full. Indeed, SIGTARP ran numerous investigations that led to over 300 convictions resulting in prison sentences and to the recovery of $11 billion through the end of 2019, including $900 million last year alone. Criminal prosecutions relating to TARP included charges of fraud, obstruction of justice, and insider trading—all tools that SIGPR may leverage in referring cases to the Department of Justice (DOJ). 

Potential Criminal Conduct by Loan Applicants 

Banks arguably face the greatest exposure to criminal investigations where they are handling the distribution of CARES Act funds to existing customers. In that scenario, financial institutions may possess information that conflicts with the representations their own clients make in their CARES Act certifications. A bank that ignores that information may find itself in the crosshairs of criminal inquiries. Worse yet, history suggests that some bank employees may take bribes or kickbacks to facilitate the crimes of those seeking to defraud government programs, thereby winding up in the crosshairs themselves. 

The structure of the CARES Act program arguably does not help matters. Guidelines for underwriting or evaluating representations by borrowers are relatively relaxed, and some loan recipients may later be found to have borrowed more funds than they were entitled to receive.^[2] For example, under the PPP, borrowers can apply for loans of up to two-and-a-half-times their average monthly payroll costs, which consists of compensation for employees whose principal place of residence is in the United States.^[3] Applicants could attempt to obtain larger loans by improperly counting non-resident employees, or by misstating elements of compensation such as cash tips, for which there may be less documentation. 

Similarly, some small business loan recipients may not qualify for funding at all. In general, businesses must have 500 or fewer employees in order to be eligible for the PPP. To determine whether an entity meets this threshold, the SBA will also consider any affiliated entities, based on factors such as common ownership, management, or identity of interest. Ineligible applicants could attempt to conceal or misrepresent these affiliations in order to appear to be qualified to receive loans. 

Borrowers must certify that the loans will be used for covered expenses, i.e., payroll costs, mortgage interest payments, rent, and utilities. In addition, loans can be completely forgiven if the funds are used for covered expenses and at least 75% of the forgiven amount was used for payroll costs. At the end of the eight-week loan period, borrowers are required to verify to lenders the number of employees and the dollar amounts of covered expenses. Some applicants may attempt to defraud the program by using the loans for other purposes and then misrepresenting how those funds were used. 

In each of these cases, borrowers may be subject to criminal liability on charges including bank fraud, wire fraud, and conspiracy to defraud the United States. But so too may the lenders themselves. 

Potential Criminal Exposure for Lenders 

To the extent that the financial institutions who facilitate these loans or grants are involved in or aware of the fraudulent schemes, they may face criminal exposure. For example, any lender who accepts bribes or kickbacks to help applicants jump to the front of the line, particularly since the last round of funding ran out in a matter of weeks, will bear the risk of prosecution. Lenders also will find themselves in trouble if they make loans to customers that already owe money to the bank and encourage the customers to pay off their existing debts instead of using the funds for approved purposes. So, too, will lenders who "coach" clients and help them structure their applications in order to qualify for CARES Act funds for which they might not be eligible, as did some mortgage brokers during the subprime mortgage crisis. 

As noted above, banks also risk being exposed to liability where they possess institutional knowledge about an existing customer that conflicts with the certifications the customer makes on a CARES Act application. To some extent, lenders are allowed to rely on representations that borrowers make, but it is unclear how far that reliance extends where borrowers are existing customers of those lenders. In that context, lenders may know, or have reason to believe, that certain representations in loan applications are false, including through their ordinary Know Your Customer procedures. For example, a bank's own records might reflect an undisclosed affiliate relationship, or individual bank officers or employees may have actual knowledge about the customer's operations that differ from those represented on the application. 

The CARES Act's relaxed structure may provide an incentive for lenders to look the other way, allowing them to rely entirely on borrower representations and give out as many loans as possible. Lenders largely are not required to do the legwork to verify these representations. But where any lenders actually know or should know that such representations are false or misleading, and push the loans through anyway, it may be difficult to claim reliance on those representations to government investigators. Moreover, the knowledge possessed by individual employees could be imputed to the institution itself.   

Investigations Are Already Underway 

There is no question that investigations have begun and will grow exponentially. On April 28, Treasury Secretary Steven Mnuchin announced that SBA will conduct a "full review" of all loans over $2 million.[4] New guidance issued by the SBA requires borrowers to consider their ability to access other sources of liquidity when certifying that the loan request is "necessary" to support their ongoing operations. It also establishes a limited safe harbor for entities that received PPP funding they may not have “needed,” giving them until May 7 to repay the loans without penalty.^[5] If there was ambiguity before, there is less ambiguity now, and risk of criminal prosecution therefore increases. The risk extends to lenders as well. DOJ has confirmed it already has begun to investigate how taxpayer funds were distributed through the PPP. Assistant Attorney General Brian Benczkowski has said that prosecutors have contacted 15-20 of the largest loan processors as part of its initial review, and have already identified signs of fraud.^[6] 

While the initial inquiries appear to be focused on borrowers who may have misstated key items like their payroll costs or their number of employees, the lenders themselves are likely to be questioned whenever evidence of fraud is found. DOJ has at its disposal not only publicly-available information such as ownership of entities, the identity of affiliates, number of employees, and what public companies disclose in their 8Ks, but also the treasure-trove of information held by the IRS. And, of course, subpoena power gives the DOJ access to even more information to fold into their investigations. An additional source of information can be expected to include whistleblowers, such as disgruntled employees and even competitors to those who received CARES Act funding. 

As financial institutions know all too well, the cost of dealing with investigations can be extraordinary, both in diversion of human resources as well as out-of-pocket costs. The cost of prosecution is of course even greater. In order to avoid subjecting themselves to potential criminal liability, lenders are encouraged to be vigilant against potential misconduct—from without and from within.

[1] CARES Act § 4018(c)(1).

[2] See our prior coverage for more information about requirements for lenders under the PPP.

[3] See our prior coverage for more information about certification requirements for borrowers under the PPP.

[4] Lauren Hirsch, Small business loans above $2 million will get full audit to make sure they're valid, Mnuchin says, CNBC (April 28, 2020).

[5] Paycheck Protection Program Loans Frequently Asked Questions.

[6] Tom Schoenberg and Christian Berthelsen, Justice Department Sees Early Fraud Signs in SBA Loan Flurry, Bloomberg (April 30, 2020).