SBA’s Oversight of Non-Bank Lenders and Third-Party Service Providers Associated with PPP Loans — SBA-OIG Report 25-04

Record facts

Full text

U.S. SMALL BUSINESS ADMINISTRATION 
OFFICE OF INSPECTOR GENERAL 
SBA’s Oversight of Non-Bank Lenders 
and Third-Party Service Providers 
Associated with PPP Loans 
Evaluation Report 
Report 25-04 
November 13, 2024 

 
 
Make a Difference 
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s 
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the 
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor), 
Washington, DC 20416. In accordance with the Inspector General Act of 1978, codified as 
amended at 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s personally 
identifying information is mandatory, absent express consent by the complainant authorizing the 
release of such information. 
NOTICE: 
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, 
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities 
identified in this report have the opportunity to submit a written response for the purpose of 
clarifying or providing additional context as it relates to any specific reference contained herein. 
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date. 
We request that any comments be no longer than two pages, Section 508 compliant, and free 
from any proprietary or otherwise sensitive information. The comments may be appended to 
this report and posted on our public website. 
 

 
 
U.S. Small Business Administration 
Office of Inspector General 
EXECUTIVE SUMMARY 
SBA’s Oversight of Non-Bank Lenders and Third-Party Service 
Providers Associated with PPP Loans (Report 25-04) 
What OIG Reviewed 
The Coronavirus Aid, Relief, and Economic 
Security (CARES) Act established the Paycheck 
Protection Program (PPP), an $813.7 billion 
program that provided forgivable loans to 
eligible borrowers. 
Over 5,300 lenders, including bank and non-
bank lenders, participated in the PPP. The 
primary distinction between the two is that non-
bank lenders are not federally regulated. Both 
were allowed to partner with third-party service 
providers to assist in the PPP loan process. 
Our objective was to assess the U.S. Small 
Business Administration’s (SBA) oversight of 
non-bank lenders, including financial technology 
(fintech), and third-party service providers in the 
PPP. 
What OIG Found 
Opportunities exist for SBA to enhance its 
oversight of non-bank lenders, including 
fintechs, and service providers to promote 
program integrity and reduce financial loss. SBA 
had processes in place to approve non-bank 
lenders to become PPP lenders; however, it 
performed limited oversight of these lenders 
and was unaware of the extent of service 
providers’ participation in the PPP. 
SBA established a comprehensive plan to 
conduct risk-based reviews of lender PPP 
operations, which included non-bank lenders. 
However, SBA did not execute the plan, rather it 
focused its oversight on loan forgiveness and 
guaranty purchases. 
Executive and legislative actions led SBA to 
reduce or eliminate barriers for PPP borrowers, 
resulting in a significant increase in loans being 
made by non-bank lenders, including fintechs. 
Additionally, hold harmless provisions protected 
lenders from consequences if the lender 
complied with applicable legal requirements. 
Reduced controls and limited oversight 
increased the risk of fraud. 
We found non-bank PPP lenders made  
$14.2 billion in suspected fraudulent loans at a 
rate more than five times higher than loans 
made by traditional bank lenders. Over  
$6.1 billion of the $14.2 billion in suspected 
fraudulent non-bank PPP loans, or nearly  
43 percent, were made by lenders categorized 
as fintechs and other State Regulated Finance 
Companies. Additionally, loans involving service 
providers had a suspected fraud rate more than 
three times higher than loans made without a 
service provider. Given SBA’s expanding loan 
portfolio and increasing reliance on non-bank 
lenders, including fintechs, in other loan 
programs and increasing lender reliance on 
fintech service providers, effective oversight is 
vital to ensuring program integrity and 
mitigating fraud risk and financial loss. 
What OIG Recommended 
We made six recommendations for SBA to 
strengthen oversight of non-bank lenders and 
service providers. 
Agency Response 
SBA management agreed with 
recommendations 1, 3, 4, 5, and 6; and partially 
agreed with recommendation 2. Management’s 
existing and planned actions satisfy the intent of 
our recommendations.

OFFICE OF INSPECTOR GENERAL 
U.S. SMALL BUSINESS ADMINISTRATION 
MEMORANDUM 
 
Date: 
November 13, 2024 
To: 
Isabella Casillas Guzman 
Administrator 
From: 
Hannibal “Mike” Ware 
Inspector General 
Subject: 
Evaluation of SBA’s Oversight of Non-Bank Lenders and Third-Party Service Providers 
Associated with PPP Loans (Report 25-04) 
This report presents the results of our review SBA’s Oversight of Non-Bank Lenders and Third-
Party Service Providers Associated with PPP Loans. We considered management’s comments on 
the draft of this report when preparing the final report. SBA management agreed with five of six 
recommendations and partially agreed with one recommendation. 
We appreciate the cooperation and courtesies provided by your staff. If you have any questions 
or need additional information, please contact me or Andrea Deadwyler, Assistant Inspector 
General for Audits, at (202) 205-6586. 
cc: 
Dilawar Syed, Deputy Administrator 
 
Arthur Plews, Chief of Staff 
 
Isabelle James, Deputy Chief of Staff 
 
Therese Meers, General Counsel, Office of General Counsel 
 
Kathryn Frost, Associate Administrator, Office of Capital Access 
 
John Miller, Deputy Associate Administrator, Office of Capital Access 
 
Peter Meyers, Senior Advisor, Office of Capital Access 
 
Katherine Aaby, Associate Administrator and Chief Financial Officer, Office of  
 
 
Performance, Planning, and the Chief Financial Officer 
 
Deborah Chen, Deputy Chief Financial Officer, Office of Performance, Planning, and the  
 
 
Chief Financial Officer 
 
Walter B. Hill Jr., Chief Risk Officer, Office of Performance, Planning, and the Chief  
 
 
Financial Officer 
 
Michael Simmons, Attorney Advisor, Office of General Counsel 
 
Tonia Butler, Director, Office of Internal Controls 
 
Anna Maria Calcagno, Director, Office of Program Performance, Analysis, and Evaluation 
 

 
i 
Contents 
Introduction .................................................................................................................................... 1 
Background ............................................................................................................................... 1 
Oversight Responsibilities ................................................................................................... 3 
Objective ................................................................................................................................... 4 
Results ............................................................................................................................................. 4 
Finding 1: Oversight of Non-Bank PPP Lenders ......................................................................... 4 
Recommendations .................................................................................................................... 7 
Finding 2: Oversight of Third-Party Service Providers ............................................................... 7 
Lender Service Provider Oversight ...................................................................................... 8 
Recommendations .................................................................................................................. 10 
Other Matter: SBA Guidance on Service Provider Oversight .................................................. 11 
Recommendation .................................................................................................................... 11 
Evaluation of Agency Response ..................................................................................................... 11 
Summary of Actions Necessary to Close the Recommendations ............................................ 12 
Tables 
1  PPP Loans by SBA Lender Category ................................................................................. 2 
2  Non-Bank Lender Loans Identified in SBA OIG Fraud Landscape .................................... 5 
3  Suspected Fraudulent Loans With/Without a Service Provider ...................................... 8 
Figures 
1  Suspected Fraudulent Loans by Lender Type and Fiscal Year ......................................... 6 
Appendices 
1  Scope and Methodology .............................................................................................. 1-1 
2  Agency Response ......................................................................................................... 2-1 
 

 
1 
Introduction 
This report presents the results of our evaluation of the U.S. Small Business Administration’s 
(SBA) oversight of non-bank lenders and third-party service providers (service providers) in the 
Paycheck Protection Program (PPP). 
Background 
The President signed the Coronavirus Aid, Relief, and Economic Security (CARES) Act into law on 
March 27, 2020. Section 1102 of the CARES Act provided $349 billion to create the PPP under 
Section 7(a) of the Small Business Act. The PPP provided fully guaranteed SBA loans for certain 
eligible borrowers that could be forgiven if loan proceeds were used as required by law. Eligible 
expenses included payroll, rent, utility payments, and other covered operations expenditures. 
Subsequent acts provided additional funding for the PPP, increasing total program funding to 
$813.7 billion. The PPP closed for applications on May 31, 2021, after more than 5,300 lenders 
approved a combined 11.8 million loans, totaling $799.8 billion.1 
SBA broadly categorizes lenders as either bank or non-bank. Generally, non-bank lenders 1) are 
not supervised by federal regulators such as the Federal Deposit Insurance Corporation, Office of 
the Comptroller of the Currency, or Federal Reserve System; 2) have no depository relationships 
with their clients; and 3) have less lending experience than traditional banks. However, other 
federal agencies may sometimes oversee non-bank lenders. For example, SBA oversees non-
bank Small Business Lending Companies. 
Many banks and non-bank lenders rely on different types of financial technology (fintech) to gain 
efficiency while processing loans. Fintech is a term commonly used to describe certain lenders 
and service providers that rely heavily on financial technology in the processing of loans, 
including some that participated in the PPP. For this report, we consider fintech lenders to be a 
subset of certain non-bank lenders in line with SBA’s categorization and public reporting of State 
Regulated Finance Companies as “Fintechs (and other State Regulated Companies),” according 
to SBA’s PPP approvals report.  These entities are distinct from other categories of banks and 
non-bank lenders that rely heavily on fintech companies as service providers in order to process 
loans. Overall, non-bank lenders, including fintechs, combined to make 2.96 million PPP loans 
totaling $61.1 billion (see Table 1). 
 
1 SBA Office of Capital Access, Paycheck Protection Program Report Approvals through May 31, 2021, (2021). 

 
2 
Table 1: PPP Loans by SBA Lender Category2 
SBA Lender 
Category 
SBA Lender Type 
Number of PPP 
Lenders 
Number of PPP 
Loans 
Dollar Value of PPP 
Loans 
Lender 
Bank 
4,092 
8,108,425 
$713,967,849,185 
Lender 
Credit Unions 
962 
373,548 
$15,430,746,571 
Lender 
Savings and Loans 
82 
29,620 
$2,129,296,186 
Lender Subtotal 
5,136 
8,511,593 
$731,527,891,942 
Non-bank Lender 
Farm Credit Service 
Lenders 
54 
51,801 
$2,289,901,825 
Non-bank Lender 
Fintechs and other State 
Regulated Finance 
Companies (SRFC) 
47 
1,322,679 
$25,063,603,975 
Non-bank Lender 
Microlenders 
36 
489,866 
$7,934,584,154 
Non-bank Lender 
Certified Development 
Company (CDC) 
24 
24,347 
$826,071,773 
Non-bank Lender 
Small Business Lending 
Company (SBLC) 
14 
826,837 
$20,499,692,302 
Non-bank Lender 
Certified Development 
Financial Institutions 
(CDFI) 
10 
241,187 
$4,456,742,328 
Non-bank Lender 
Business and Industrial 
Development Company 
(BIDCO) 
1 
43 
$1,089,324 
Non-bank Lender Subtotal 
186 
2,956,760 
$61,071,685,681 
Total 
— 
5,322 
11,468,353 
$792,599,577,623 
Source: SBA OIG analysis of non-cancelled PPP loan data 
All existing SBA 7(a) lenders were authorized under the statute to make PPP loans. During the 
pandemic, SBA encouraged other bank and non-bank lenders that were not SBA 7(a) lenders at 
the time, including fintechs, to apply for approval to make PPP loans to increase the scope of PPP 
lending operations and the speed with which loans could be disbursed. SBA collaborated with 
the U.S. Department of the Treasury to admit new non-bank lenders into the program through a 
formal application and review process. Accordingly, the role of non-bank lenders in the PPP 
surged throughout the program. The PPP data shows that seven high-volume non-bank lenders 
 
2 Data presents PPP loans that have not been fully canceled, which is different from the number of loans 
SBA guaranteed. 

 
3 
relying on service providers that used financial technology combined approved more than  
2.4 million loans, or more than 18,000 loans per day, at a speed of five seconds per loan in 2021, 
after having made fewer than 22,000 PPP loans in 2020. 
SBA has also increased its reliance on non-bank lenders in its traditional SBA loan programs, such 
as the 7(a) loan program. For example, SBA converted all Community Advantage pilot program 
lenders to Community Advantage Small Business Lending Companies and expanded Small 
Business Lending Company licenses from 14 to 17, despite some of these lenders having a 
significantly higher suspected fraud rate on the PPP loans they made. While these are actions 
that SBA has already taken to expand access to capital, lenders and the service providers are also 
increasing their reliance on fintech, making regulation and oversight of fintech in SBA programs 
vital. 
Both bank and non-bank PPP lenders were allowed to partner with service providers to assist in 
the PPP loan process, which can include fintech companies. Service providers can perform a 
variety of services in either the loan origination or forgiveness process including performing 
lender functions — such as determining eligibility — and providing technology and referral 
services. A service provider that assists a lender with lender functions in originating, disbursing, 
or servicing SBA loans is known as a lender service provider (LSP). For this type of service 
provider, SBA requires lenders to submit for acceptance an LSP agreement that meets all SBA 
requirements and denotes the lender’s responsibility to exercise due diligence and perform 
prudent oversight of their LSP. 
Although the PPP provided immediate relief to many American businesses, some bad actors took 
advantage of the program to fraudulently claim funds. In June 2023, we reported SBA lenders 
disbursed an estimated $64 billion in suspected fraudulent PPP loans.3 
Oversight Responsibilities 
PPP loans are authorized under Section 7(a) of the Small Business Act and subject to SBA’s 
oversight as stated in its standard operating procedures.4 These procedures require SBA to 
effectively manage program risk. SBA’s Office of Credit Risk Management (OCRM) oversees the 
risk associated with SBA lenders’ 7(a) lending and enforces loan program requirements to 
manage risk of individual lenders as well as the aggregate risk of SBA’s loan portfolio. OCRM’s 
oversight role includes, but is not limited to, portfolio assessment and risk-based reviews.  
 
3 SBA OIG, 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, (June 27, 2023). 
4 SBA, Standard Operating Procedure (SOP) 50 10 6, Lender and Development Company Loan Programs, (October 1, 
2020); SOP 50 53 (2), Supervision and Enforcement, (January 1, 2021). 

 
4 
SBA-Supervised Lenders — such as Small Business Lending Companies — are also subject to SBA-
Supervised Lenders Safety and Soundness Examinations and Quarterly Condition and 
Certification of Capital Compliance Reviews. 
Objective 
Our objective was to assess SBA’s oversight of non-bank lenders, including fintech lenders, and 
third-party service providers in the PPP.  
Results 
Opportunities exist for SBA to enhance its oversight and guidance for non-bank lenders and 
service providers, particularly lender service providers, to promote program integrity and reduce 
financial loss. SBA, in collaboration with Treasury, had processes for non-bank lenders (including 
fintech lenders) to obtain approval to become PPP lenders, but performed limited oversight of 
these entities after approval and could have better assessed the risk of allowing them to 
continue to operate in the program. We found non-bank lenders, including fintechs, made  
$14.2 billion in suspected fraudulent loans at a rate more than five times higher than loans made 
by traditional bank lenders. We also found the rate of suspected fraudulent loans made by 
lenders using service providers was more than three times higher than the rate of loans 
processed by lenders that did not use a service provider. 
Finding 1: Oversight of Non-Bank PPP Lenders 
SBA’s oversight of non-bank PPP lenders was the same as for bank lenders (i.e., federally 
regulated) in that it focused on loan forgiveness and guaranty purchase. This oversight was not 
sufficient to ensure program integrity and mitigate fraud risk and financial loss. Given SBA’s 
expanding 7(a) loan portfolio and increasing reliance on non-bank lenders in not only the PPP 
but also other loan programs, considerable opportunities exist for the agency to strengthen its 
oversight of these entities. 
As the PPP loan portfolio expanded, OCRM established a comprehensive plan to oversee all PPP 
lenders, which included performing risk-based reviews. However, OCRM did not execute this 
plan. Instead, it conducted limited oversight of all PPP lenders, including non-bank lenders, and 
did not perform risk-based reviews of any lenders’ PPP operations during the program. 

 
5 
OCRM’s initial oversight plan included compliance, testing, monitoring, risk-based reviews, 
increased supervision, and enforcement based on the type of PPP lender. However, SBA limited 
its oversight to screening loans to identify fraud and ensure compliance with eligibility 
requirements and analytical reviews of monthly PPP lender performance, PPP portfolio 
information by lender, and lenders with a high volume of customer complaints. This limited 
oversight adversely impacted program integrity and increased the risk of fraud and financial loss. 
Our analysis found that, overall, non-bank lenders combined to make approximately 715,000 
suspected fraudulent loans totaling $14.2 billion, representing a suspected fraud rate of  
24.63 percent for non-bank lenders (see Table 2), compared to 4.3 percent for traditional 
lenders. Of the suspected fraudulent PPP loans made by non-bank lenders, over 300,000, or  
42 percent, totaling over $6.1 billion of the $14.2 billion (43 percent), were made by fintech or 
other State Regulated Finance Companies. 
Table 2: Non-Bank Lender Loans Identified in SBA OIG Fraud Landscape 
Lender Type 
PPP Loans Made 
PPP Loans in 
Fraud Landscape 
Percentage of 
Loans in Fraud 
Landscape 
Value of Fraud 
Landscape Loans 
Fintechs and 
other SRFC 
1,322,679 
300,774 
22.74% 
$6,168,791,877 
SBLC 
826,837 
213,592 
25.83% 
$4,415,470,130 
Microlenders 
489,866 
117,415 
23.97% 
$2,036,540,466 
CDFI 
241,187 
81,428 
33.76% 
$1,526,426,843 
CDC 
24,347 
2,212 
9.09% 
$47,519,918 
BIDCO 
43 
0 
0% 
$0 
Total 
2,904,959 
715,421 
24.63% 
$14,194,749,234 
Source: SBA OIG analysis of PPP loan data 
Further, the percentage of PPP loans processed by non-bank lenders increased significantly from 
6.5 percent in fiscal year (FY) 2020 to 41.5 percent in FY 2021. With that, the percentage of 
suspected fraudulent loans made by non-bank lenders increased to 24.9 percent in FY 2021. 
Banks, on the other hand, processed 58.5 percent of PPP loans in FY 2021 compared to  
93.6 percent in FY 2020, with an estimated fraud rate of 5.4 percent in FY 2021 (see Figure 1). 
 
 

 
6 
Figure 1: Suspected Fraudulent Loans by Lender Type and Fiscal Year 
 
Source: OIG analysis of PPP data 
SBA provided the same PPP oversight of non-bank lenders as it did for bank (i.e., federally 
regulated) lenders that generally focused on reviewing individual loan forgiveness and guaranty 
purchase requests. SBA did not tailor its oversight approach to consider lender portfolio risks 
such as the regulatory (e.g., compliance with the Bank Secrecy Act and Know Your Customer 
requirements) and control environment of non-banks and online institutions with few or no 
physical locations, despite indications of elevated fraud risk involving these types of lenders. 
Lenders sometimes directly reported to and discussed with SBA elevated fraud risks, particularly 
regarding loans made to certain borrowers who used IRS Form 1040, Schedule C. 
According to SBA, it limited oversight of PPP lenders, including non-bank lenders, because of the 
significant hold harmless provisions in the CARES Act and Economic Aid Act, which protected 
lenders from consequences related to a borrower’s failure to comply with program criteria if the 
lender acted in good faith and complied with applicable legal requirements. Further, in March 
2021, SBA, in consultation with Treasury, issued an interim final rule that allowed self-employed 
individuals, independent contractors, and sole proprietors who filed an IRS Form 1040, Schedule 
C, to calculate their maximum loan amount using gross income rather than net income. This 
change reduced barriers to accessing the PPP for sole proprietors, independent contractors, and 
self-employed individuals, resulting in a significant increase in loans, the majority being made by 
non-bank lenders. 

 
7 
SBA’s responsibility to effectively manage program risk as mentioned in its standard operating 
procedures5 is also mandated by the U.S. Government Accountability Office, which states that 
managers should identify, analyze, and respond to risks related to achieving their objectives, 
including the potential for fraud. Managers’ responsibilities include using risk factors to identify 
fraud risk and effectively mitigating risk through their response. 
After the PPP closed for applications, SBA initiated targeted reviews of lenders with identified 
issues to assess their Bank Secrecy Act/Know Your Customer program structure and compliance 
with PPP requirements. Consequently, the lenders agreed to temporarily halt their delegated 
authority and increase their PPP reporting. 
Effective oversight for all SBA loan programs is necessary to promote program integrity and to 
mitigate fraud risk and financial loss. 
Recommendations 
To improve SBA’s oversight of non-bank lenders, we recommend the Administrator direct the 
Associate Administrator for the Office of Capital Access to: 
Recommendation 1: Ensure that future application review processes for non-bank PPP lenders 
(including fintechs) requesting to participate in traditional SBA loan programs include conducting 
reviews of the lender’s compliance with PPP requirements. 
Recommendation 2: Enhance existing risk-based oversight plans to ensure adequate oversight of 
high-risk non-bank lenders, including fintechs. 
Finding 2: Oversight of Third-Party Service Providers 
SBA and lenders could improve oversight of service providers, including lender service providers, 
to mitigate fraud risk and financial loss. SBA has policies for how lenders should manage service 
providers in its traditional 7(a) loan program and lenders participating in the PPP were expected 
to adhere to the policies. However, SBA was unaware of the extent of service providers’ 
participation in the program and the related risks. SBA’s limited oversight of lenders increased 
the risk of fraud and financial loss. 
 
5 SBA, SOP 50 10 6, Lender and Development Company Loan Programs, (October 1, 2020); SOP 50 53 (2), 
Supervision and Enforcement, (January 1, 2021). 

 
8 
While lenders bear full responsibility for their loan operations, we found that loans made using 
service providers had a higher likelihood of being fraudulent. Our analysis revealed that, overall, 
lenders using service providers had a 16.2 percent suspected fraudulent loan rate, which was 
three times higher than the 4.9 percent rate for lenders that did not use a service provider (see 
Table 3). 
Table 3: Suspected Fraudulent Loans With/Without a Service Provider 
Data Type 
Total Number of PPP Loans 
Total Number of 
Suspected 
Fraudulent Loans 
Percentage of 
Suspected Fraudulent 
Loans 
Loans With a Service 
Provider 
4,576,366 
743,613 
16.2% 
Loans Without a Service 
Provider 
6,891,901 
337,676 
4.9% 
Total 
11,468,267 
1,081,289 
— 
Source: SBA OIG analysis of PPP loan data 
Lender Service Provider Oversight 
A service provider that performs lender functions in originating, disbursing, or servicing SBA 
loans is known as a lender service provider (LSP). Lenders contract with LSPs for many reasons, 
including insufficient resources or inexperience. Given the risks associated with lenders relying 
on LSPs, SBA developed several requirements that lenders must adhere to, which include 
maintaining the ultimate responsibility for ensuring loan quality and compliance with SBA 
requirements and submitting and obtaining SBA’s acceptance for all LSP agreements. However, 
we found SBA was unaware of the extent of LSP participation in the PPP and the related risk 
because it did not implement sufficient controls to ensure lenders obtained acceptance for LSP 
agreements, as required. 
PPP lenders were subject to the same SBA oversight as traditional 7(a) loans, including 
requirements for lenders partnering with LSPs.6 SBA requires lenders partnering with an LSP to 
submit for acceptance a lender service provider agreement that meets all SBA requirements and 
to exercise due diligence and perform prudent oversight of their LSPs. 
 
6 SBA, SOP 50 10 6, Lender and Development Company Loan Programs, (October 1, 2020). 

 
9 
We found SBA did not implement sufficient upfront system access controls or perform planned 
risk-based reviews to ensure lender compliance with program requirements. Specifically, SBA 
relied on lenders to perform due diligence of their service providers and submit LSP agreements 
for acceptance, as necessary. We found that 18 of the 20 lenders we reviewed did not have an 
accepted LSP agreement outlining the relationship with their service provider. Based on our 
understanding of the services provided and discussions with SBA officials, many of these service 
providers likely were LSPs and should have had a required LSP agreement to ensure the lender’s 
relationship with their service provider complied with SBA requirements. 
While SBA expected PPP lenders to follow SBA requirements for managing LSPs, including those 
in their standard operating procedures, SBA’s primary method of communicating PPP guidance 
to lenders, the Interim Final Rules and Frequently Asked Questions, did not clearly reference this 
responsibility. For example, this guidance did not reference lenders’ use of service providers or 
explicitly state that lenders were to follow SBA requirements for managing service providers. 
To determine whether there was an SBA accepted LSP agreement in place, we identified 20 
lenders that had partnered with service providers to make at least 25,000 loans. While our scope 
of work did not include reviewing the specific services provided in each of these relationships, 
there were indications the service providers were involved with originating, disbursing, or 
servicing loans, which suggests an LSP agreement would likely have been required, 
substantiating SBA officials indicated perspective that they likely were LSPs. Some of the 
relationships involved service providers that identified themselves as providing only technology 
services or a platform to lenders, but who SBA suspected of having a more substantial role in the 
lending process. Regardless, the lender is responsible for complying with applicable banking 
regulations and SBA requirements. 
For example, in one instance a lender and service provider partnered to make a significant 
number of PPP loans. The lender initially submitted an LSP agreement detailing the relationship 
with the service provider, which included functions that likely met the definition of an LSP. SBA 
did not accept the agreement because it did not contain all requirements outlined in SBA’s 
policy.7 However, SBA did not inform the lender that they had rejected the agreement until late 
May 2021, as the PPP closed. We identified over 100,000 loans made by the lender and service 
provider, totaling $1.8 billion, as suspected fraudulent. 
SBA did not use key system access controls typically used in its traditional loan programs to 
ensure only LSPs with accepted agreements could submit PPP loan applications to SBA. 
Generally, SBA reviews a lender’s relationship with service providers during risk-based reviews of 
 
7 SBA, SOP 50 10 6, Lender and Development Company Loan Programs, (October 1, 2020). 

 
10 
lenders but may also review a lender’s compliance with LSP agreements separately.Error! 
Bookmark not defined. SBA did not perform risk-based reviews of lender PPP operations during 
the program or perform detailed reviews of lenders’ compliance with LSP agreement submission 
and third-party monitoring requirements. SBA also did not review PPP lenders compliance with 
accepted LSP agreements outside of risk-based reviews, which created a lack of awareness and 
oversight of service provider relationships. 
After the PPP closed for applications, SBA took administrative action to prevent service providers 
with identified issues from participating in its loan programs. 
As evidenced by our analysis, loans made using service providers had a higher likelihood of being 
identified as suspected fraudulent. Effective oversight for all SBA loan programs is necessary to 
promote program integrity, mitigate fraud risk and financial loss, and ensure only accepted 
service providers participate and benefit from future SBA economic stimulus programs. 
Recommendations 
To address SBA’s limited oversight of service providers, we recommend the Administrator direct 
the Associate Administrator for the Office of Capital Access to: 
Recommendation 3: Ensure internal controls designed to restrict access to only lender service 
providers with accepted agreements to submit loan applications remain in place to promote 
program integrity in all lending programs. 
Recommendation 4: Improve monitoring of lender/service provider relationships to better 
determine the extent of services being performed by service providers to ensure compliance 
with SBA requirements. 
Recommendation 5: Reinforce existing guidance to lenders on reporting lender service provider 
relationships to SBA to ensure only accepted lender service providers are participating in and 
benefiting from SBA programs. 
 
 

 
11 
Other Matter: SBA Guidance on Service Provider Oversight 
Based on our review of existing SBA guidance to lenders regarding their oversight of lender 
service providers, we noted opportunities exist for SBA to enhance its guidance to mitigate risks 
associated with lender service providers and align with guidance issued by other federal agencies 
in 2023. Specifically, other agencies (e.g., Federal Deposit Insurance Corporation, Office of the 
Comptroller of the Currency, Federal Reserve System) collaborated to develop interagency 
guidance to lenders related to managing risks associated with third-party relationships in 
administering loans. The interagency guidance includes topics such as how a lender should 
conduct due diligence, lender’s consideration of third party’s risk management, and prior 
experience providing the services. SBA updating its existing lender service provider guidance to 
align with the interagency guidance could help ensure that lenders better understand and 
mitigate risks associated with lender service providers. 
Recommendation 
To enhance SBA’s guidance to lenders regarding oversight of service providers, we recommend 
the Administrator direct the Associate Administrator for the Office of Capital Access to: 
Recommendation 6: Update guidance on lender requirements for managing risks associated 
with lender service provider relationships to align with 2023 Interagency Guidance. 
Evaluation of Agency Response 
SBA management provided formal comments to the draft report, which we considered when 
preparing this final report. Management agreed with recommendations 1, 3, 4, 5, and 6; and 
partially agreed with recommendation 2. Management’s planned actions are sufficient to resolve 
our recommendations. We also noted that, for several of the recommendations, the managers 
stated they have already implemented the recommended actions; however, during our review, 
management did not provide specific evidence of these processes and procedures. Management 
will need to provide evidence that these actions are fully implemented for us to close the 
recommendations. Finally, in subsequent correspondence, management stated the targeted 
final action date for all recommendations is June 30, 2025. See Appendix 2 for management’s 
comments in their entirety. 
 
 

 
12 
Summary of Actions Necessary to Close the Recommendations 
The following section summarizes the status of our recommendations and the actions necessary 
to close them. 
Recommendation 1 
Ensure that future application review processes for non-bank PPP lenders (including fintechs) 
requesting to participate in traditional SBA loan programs include conducting reviews of the 
lender’s compliance with PPP requirements. 
Status: Resolved 
SBA management agreed with the recommendation, stating they have a process in place to 
confirm a PPP lender’s compliance with PPP requirements. The SBA Office of Capital Access has a 
history of assessing the entity’s participation in other business loan programs. For the PPP, the 
assessment includes the entity’s 1) Net Approvals; 2) Paid-in-Full/Forgiven; Charge-Offs; 3) 
Outstanding Loans with Open Fraud Holds; and 4) Outstanding Loans without Open Fraud Holds. 
Further, effective August 2023, policy established that SBA reserves the right to deny any 
applicant from becoming a Non-Federally Regulated Lender or Small Business Lending Company 
at its sole discretion. 
This recommendation can be closed when SBA provides evidence it implemented a review 
process for PPP lenders requesting to participate in traditional SBA loan programs that includes 
conducting reviews of the lender’s compliance with PPP requirements. 
Recommendation 2 
Enhance existing risk-based oversight plans to ensure adequate oversight of high-risk non-bank 
lenders, including fintechs. 
Status: Resolved 
SBA management partially agreed with the recommendation, stating they perform lender 
oversight using a process of continuous improvement and closely monitor all SBA Supervised 
Lenders. Management further stated the Office of Capital Access has a history of continuously 
improving risk management based on changes in the program and industry, which includes 
advances in technology, increased staffing for the Office of Credit Risk Management (OCRM), 
and modifications to the scopes used for risk-based reviews. OCRM determines the review scope 
based on the risk such as rapid portfolio growth, agent usage, and portfolio performance. 

 
13 
In addition, managers stated they have recently redeveloped the Lender Risk Rating System to 
improve the accuracy and transparency of the rating. Further, OCRM now conducts at least one 
risk-based review per fiscal year of lenders with SBA share dollars greater than $10 million and 
with an elevated risk profile. 
As stated in the report, we found SBA did not perform risk-based reviews of non-bank PPP 
lenders, including fintechs. Moving forward, SBA should ensure it conducts adequate oversight 
of non-bank lenders across all loan programs to ensure program integrity and mitigate financial 
loss. 
This recommendation can be closed when SBA provides evidence of enhanced risk-based 
oversight plans to ensure adequate oversight of high-risk non-bank lenders, including fintechs. 
Recommendation 3 
Ensure internal controls designed to restrict access to only lender service providers with 
accepted agreements to submit loan applications remain in place to promote program integrity 
in all lending programs. 
Status: Resolved 
Management agreed with our recommendation and stated that controls are in place to restrict 
an LSP’s access to SBA’s Capital Access Financial System on a lender’s behalf unless there is an 
active LSP agreement in place. 
As stated in the report, SBA did not use existing key access controls typically used in its 
traditional loan programs during the PPP to ensure LSPs had an accepted agreement prior to 
submitting PPP loan applications to SBA. We found that 18 of the 20 lenders we reviewed were 
able to submit applications without an accepted LSP agreement. Moving forward, SBA should 
ensure its controls to restrict LSP access to its loan systems remain in place across all loan 
programs to promote program integrity, mitigate fraud risk and financial loss, and ensure only 
accepted service providers participate in and benefit from future SBA economic stimulus 
programs. 
This recommendation can be closed when SBA provides evidence that the internal controls 
designed to restrict access to only lender service providers with accepted agreements are 
currently in effect and working as intended. 
 
 

 
14 
Recommendation 4 
Improve monitoring of lender/service provider relationships to better determine the extent of 
services being performed by service providers to ensure compliance with SBA requirements. 
Status: Resolved 
Managers agreed with our recommendation and stated they have a long-standing risk-based 
review process that requires subject lenders to disclose third-party activities in the origination, 
servicing, and liquidation of 7(a) loans. SBA indicated that supporting documentation was 
provided to SBA OIG in May 2024. SBA’s reviews also include a specific questionnaire related to a 
lender’s use of an LSP. In addition, SBA indicated that in January 2024, it made changes to its LSP 
agreement review/acceptance process for lenders to have a better understanding of their 
responsibilities of SBA program requirements when using LSPs. 
While SBA provided documentation related to its risk-based review process and LSP 
questionnaire, as noted in the report, it did not perform risk-based reviews of lender PPP 
operations or perform detailed reviews of lenders’ compliance with LSP agreement submission 
during the PPP. Regarding the change made in January 2024, an OCRM official indicated during 
our review that this new process was in beta testing for 180 days and, therefore, was not fully 
implemented. 
This recommendation can be closed when management provides evidence of improved 
monitoring of lender/service provider relationships to better determine the extent of services 
being performed by service providers to ensure compliance with SBA requirements. This should 
include evidence related to the beta process being fully implemented and evidence of completed 
reviews of lenders use of a service providers during the risk-based review process. 
Recommendation 5 
Reinforce existing guidance to lenders on reporting lender service provider relationships to SBA 
to ensure only accepted lender service providers are participating in and benefiting from SBA 
programs. 
Status: Resolved 
Managers agreed with our recommendation and stated that they provide ongoing guidance to 
lenders regarding their reporting of LSP relationships and submission of LSP agreements for SBA 
review and acceptance during industry conferences and conference calls. 

 
15 
This recommendation can be closed when management provides evidence of actions taken to 
reinforce existing guidance to lenders. 
Recommendation 6 
Update guidance on lender requirements for managing risks associated with lender service 
provider relationships to align with 2023 Interagency Guidance. 
Status: Resolved 
Managers agreed with our recommendation, stating that they updated guidance incorporating 
the Interagency Guidance in January 2024. The guidance was previously reviewed with 
applicable parts confirmed to be in the LSP questionnaire (or subsequently added) and the 
Interagency Guidance was incorporated into the revised LSP agreement review process. 
As stated in the report, during our evaluation, the 2023 Interagency Guidance was not 
incorporated into SBA’s policies. An OCRM official indicated in May 2024 that they had reviewed 
the Interagency Guidance and were evaluating the overall changes necessary to fully integrate it 
into their policies. Additionally, the official indicated that new LSP agreement review process was 
in beta testing for 180 days and, therefore, was not fully implemented. 
This recommendation can be closed when management provides evidence that guidance on 
lender requirements for managing risks associated with lender service provider relationships has 
been updated to align with 2023 Interagency Guidance. This should include evidence of 
appropriate revisions to the LSP agreement review process and the LSP questionnaire. 
 

 
1-1 
Appendix 1: Scope and Methodology 
This report presents the results of our evaluation of the U.S. Small Business Administration’s 
(SBA) process for overseeing non-bank lenders, including fintechs, in the Paycheck Protection 
Program (PPP). SBA’s Office of Inspector General (OIG) conducted this evaluation to assess SBA’s 
ability to mitigate fraud risks associated with PPP loans made by non-bank lenders and identify 
fraud risks of PPP loans associated with these entities. Our scope of work included PPP loans 
processed between April 2020–May 2021 that have submitted forgiveness applications. 
To answer our objective, we reviewed pertinent federal, departmental, and SBA-specific 
regulations, policies, procedures, and guidance related to non-bank lender and third-party 
service provider participation in PPP. We interviewed SBA personnel from various offices in the 
Office of Capital Access, including the Office of Credit Risk Management, and the Office of 
Performance and Systems Management to gain an understanding of related processes, 
procedures, and system controls. 
We analyzed PPP loan data to determine the number of lenders that participated in the 
program. Using SBA lender data that included SBA’s categorization of lenders (i.e., lender or non-
bank lender), we then determined the number and dollar amount of loans made by lenders 
categorized as non-bank lenders. We excluded Farm Credit Service Lenders from our analysis 
because they are categorized as non-bank lenders by SBA but are regulated by another federal 
agency. 
To determine the number and value of suspected fraudulent loans made by non-bank lenders, 
we matched loans made by non-bank lenders to loans identified as suspected fraudulent in SBA 
OIG’s white paper COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09, June 
2023). The methodology for identifying suspected fraudulent loans in OIG’s fraud landscape 
report included the analysis of data obtained through subpoenas from certain lenders and third-
party service providers. Results of suspected fraudulent loans in this report do not include loans 
identified using subpoenaed data. 
We also analyzed PPP loan data to determine if data indicated the use of a service provider to 
facilitate a loan and if so, the associated rate of suspected fraudulent loans. Additionally, we 
analyzed lenders that partnered with a service provider to make 25,000 or more loans to 
determine if lender service provider (LSP) agreements were in place by reviewing SBA’s list of 
accepted LSP agreements during the program. We did not contact lenders or service providers to 
obtain agreements that were not submitted to SBA for review. 

 
1-2 
We conducted this evaluation in accordance with the Council of the Inspectors General on 
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. These standards 
require that we adequately plan and perform the evaluation to obtain sufficient and appropriate 
evidence to provide a reasonable basis for our findings and conclusions based on our objective. 
We believe that the evidence provides a reasonable basis for our conclusions based on our 
objective. 
Use of Computer-Processed Data 
We relied on PPP data from SBA’s electronic loan application system (E-Tran). We found data on 
the number and value of PPP loans to be reliable for our analysis of loans made by different 
lender types and analysis of loans suspected of fraud. We used the same data to analyze loans 
made using third-party service providers, which relied on a specific data field to identify the use 
of a third-party service provider. We found the field was often blank or listed the lender in the 
field. This field also could not be traced back to source documentation to determine if 
information in the field was accurate. Despite the likelihood of the data being incomplete or 
inaccurate we used it for analysis as it was the most complete data available. 
Prior Audit Coverage 
The following lists SBA OIG’s previous audit coverage related to the objective of this report: 
Report Number 
Report Title 
Report Date 
23-09 
COVID-19 Pandemic EIDL and PPP Loan Fraud 
Landscape 
June 27, 2023 
22-09 
SBA’s Paycheck Protection Program Loan Review 
Processes 
February 28, 2022 
 
 
 

 
2-1 
Appendix 2: Agency Response 
U.S. Small Business Administration 
Response to Report 

U.S. SMALL BUSINESS ADMINISTRATION 
WASHINGTON, DC 20416 
To: 
Hannibal “Mike” Ware 
Inspector General 
U.S. Small Business Administration 
From: 
Susan Streich, Director 
Office of Credit Risk Management 
Office of Capital Access 
Date: 
November 4, 2024 
Subject: 
Response to OIG Draft Report 23007 – “SBA's Oversight of Non-Bank Lenders 
and Third-Party Service Providers Associated with PPP Loans.” 
We appreciate the role the Office of Inspector General (OIG) plays in working with management 
in ensuring that our programs are effectively managed, and for the feedback provided in this 
draft report. We offer the following comments to the draft and recommendations: 
Recommendation 1 – Ensure that future application review processes for non-bank PPP lenders 
(including Fintechs) requesting to participate in traditional SBA loan programs include 
conducting reviews of the lender’s compliance with PPP requirements. 
SBA Response: SBA agrees and already has a process already in place to confirm a PPP 
lender’s compliance with PPP requirements. 
• The Office of Capital Access has a history of assessing the entity’s participation in other 
business loan programs. Pertaining to PPP, the assessment includes the entity’s (1) Net 
Approvals; (2) Paid-in-Full/Forgiven; Charge-Offs; (3) Outstanding Loans with Open 
Fraud Holds; and (4) Outstanding Loans without Open Fraud Holds. 
• If there are risks not captured in the above referenced data points, SBA SOP 50 56 1 
(Effective August 1, 2023) established that SBA reserves the right to deny any applicant 
from becoming a NFRL or SBLC in its sole discretion.  Examples of reasons to deny an 
applicant include historical performance measures (such as default, purchase and loss 
rate), and other performance data or program integrity concerns associated with the lender 
or its senior management team. For the 504 Loan Program, SOP 50 56 1 does not explicitly 
state that an application can be denied by SBA in its sole discretion; however, there is  no 

prohibition against using an applicant’s activities in other business loan programs, such as 
PPP, as a reason for decline (and there is no appeal process for a final decision of decline). 
 
Recommendation 2 – Enhance existing risk-based oversight plans to ensure adequate oversight 
of high-risk non-bank lenders, including Fintechs. 
 
SBA Response: SBA partially agrees and performs lender oversight utilizing a process of 
continuous improvement.  All SBA Supervised Lenders are closely monitored, not just those 
determined to be high-risk. 
 
• The Office of Capital Access has a history of continuously improving risk management 
based on changes in the program and industry, which includes advances in technology, 
increased staffing for the Office of Credit Risk Management, and modifications to the 
scopes used for Risk-Based Reviews.  
  
◦ Examples of technology improvements include  
■ E-Tran’s risk mitigation framework that was implemented on August 1, 
2023 and Lender Match’s screening enhancements.  
■ The Lender Risk Rating System was redeveloped to (i) improve the 
accuracy of the SBA Lender Risk Rating (LRR); (ii) ensure model 
reliability across economic conditions; (iii) increase transparency and 
usability to the SBA Lender; (iv) incorporate the latest SBA performance 
data; and (v) evaluate new variables that can provide additional insight into 
SBA Lender and portfolio risk. 
■ Changes to the Lender Portal, notably an increase in the number of 
individuals within an entity that can access the data. 
◦ OCM Staffing 
■ The most recent HR Roster reflects 39 full time employees (with at least 
one new hire scheduled to start later this month). 
◦ Risk-Based Reviews 
■ For Lender’s with SBA Share Dollars Greater than $10.0 million with an 
elevated risk profile, OCRM currently conducts at least one Risk-Based 
Review per fiscal year. The review scope is determined based on the risk 
(e.g., rapid portfolio growth, Agent usage, portfolio performance, etc.). 
 
  
Recommendation 3 – Ensure internal controls designed to restrict access to only lender service 
providers with accepted agreements to submit loan applications remain in place to promote 
program integrity in all lending programs. 
 
SBA Response: SBA agrees and already has these controls in place.  
 
• The controls are in place as Lender Service Providers (LSPs) cannot access SBA’s Capital 
Access Financial System (CAFS) on a Lender’s behalf unless the Partner Information 
Management System (PIMS) reflects an active LSP agreement between the Lender and 
LSP. 

 
 
Recommendation 4 – Improve monitoring of lender/service provider relationships to better 
determine the extent of services being performed by service providers to ensure compliance with 
SBA requirements. 
 
SBA Response: SBA agrees and has a process already in place to monitor the services 
performed by LSPs for lender participants. 
 
• OCRM has a long-standing Risk-Based Review process that requires the subject lender to 
disclose third-party activities in the origination, servicing, and liquidation of 7(a) loans in 
addition to specific questions about Lender Service Provider Agreements. This is done 
through both a series of questions that is part of the “Notification and Needs List” that is 
used to start a review and the “Lender Service Provider Questionnaire” which is build into 
the “Notification and Needs List.” 
◦ Supporting documentation was provided to SBA OIG via email on May 17, 2024. 
• In addition to the long-standing practices, in January 2024, enhancements were made to 
the LSP agreement review/acceptance process to ensure Lender accountability and 
understanding of the requirements, along with the risk, associated with engaging a Lender 
Service Provider. 
 
Recommendation 5 – Reinforce existing guidance to lenders on reporting lender service 
provider relationships to SBA to ensure only accepted lender service providers are participating 
and benefiting from SBA programs. 
 
SBA Response: SBA agrees and provides ongoing guidance to lenders regarding their reporting 
of LSP relationships and submission of LSP agreements for SBA review/acceptance. 
 
• This has been done through in-person presentations at various industry conferences and 
conference calls.  
◦ A specific example would be that the guidance was incorporated into a presentation 
led by OCRM titled “Vendor Management in 7(a) Lending” that given at the 
Southeastern Small Business Lender’s Conference in March 2024.  
• This is also reinformed by the “Notification and Needs List” as well as Risk-Based Review 
Reports that provide actions the Lender must take based on information collected during a 
risk-based review (e.g., submit an LSP agreement to SBA for review; notify SBA that an 
LSP agreement has been terminated, etc.).   
 
Recommendation 6 – Update guidance on lender requirements for managing risks associated 
with lender service provider relationships to align with 2023 Interagency Guidance. 
 
SBA Response: SBA agrees, and effective January of 2024 updated the guidance incorporating 
the Interagency Guidance.  
 

• The guidance was previously reviewed with applicable parts confirmed to be in the LSP 
Questionnaire (or subsequently added) and the Interagency Guidance was incorporated 
into the revisions to LSP Agreement reviews starting January 2024.

File and source

File

25-04-non-bank-lenders-oversight.pdf

Size

815,803 bytes

SHA-256

d4542cc770165d277706cb0419954a18dde853c19e5f6e639b235c0de4eac7e3

Our copy

25-04-non-bank-lenders-oversight.pdf

Original

www.oversight.gov