Full text
S B A I N S P E C T O R G E N E R A L M A N A G E M E N T A L E
SBA Inspector General
Management Alert
Paycheck Protection Program Loan
Recipients on the Department of
Treasury’s Do Not Pay List
REPORT 21-06| January 11, 2021
Office of Inspector General
U.S. Small Business Administration
MEMORANDUM
Date:
TO:
FROM:
SUBJECT:
January 11, 2021
Jovita Carranza
Administrator
Hannibal “Mike” Ware /S/
Inspector General
Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do
Not Pay List
The Office of Inspector General (OIG) is issuing this Management Alert to bring to your attention
serious concerns about improper payments to lenders for potentially ineligible recipients of loans
under SBA’s Paycheck Protection Program (PPP) in response to the Coronavirus Disease 2019
(COVID-19) pandemic. This issue requires immediate attention and action.
Due to complaints of fraud received by the OIG, we collaborated with the U.S. Department of the
Treasury (Treasury) Do Not Pay (DNP) Business Center, which identified high-risk transactions
related to financial assistance to small businesses for the COVID-19 pandemic. Our review of
Treasury’s analysis showed approximately $3.6 billion in PPP loans to potentially ineligible
recipients.
Expedited management action could reduce or prevent the potential for loss in terms of the risk of
improper payments to lenders for amounts ineligible for forgiveness as well as any fees. OIG
communicated summary results to SBA management, who requested Treasury’s results and have
systemically put a “hold” flag on loans identified by the DNP team to ensure the loan applications are
properly reviewed before processing for forgiveness or any further disbursements. Additionally, SBA
management contacted the DNP Business Center and discussed the matching parameters to ensure
that DNP’s results were consistent with PPP eligibility provisions. Consequently, DNP’s results were
revised and are represented in this memorandum.
Background
Treasury’s DNP Working System is the source of centralized data and analytic services that verifies
eligibility and helps agencies identify and prevent the fraud, waste, and abuse associated with
improper payments. Treasury’s system is designated by the Office of Management and Budget (OMB)
and mandated by the Payment Integrity Information Act of 2019 dated January3, 2020 (See Appendix
I.) The Treasury DNP system gives agencies a higher degree of certainty that a payee is legitimate and
eligible before making an award or payment.
The law requires agencies to evaluate fraud risks and use a risk-based approach to design and
implement financial and administrative controls to counter identified fraud risks. The law reinforces
the requirement for agencies to review prepayment and pre-award procedures. Agencies are also
2
required to thoroughly review available databases with relevant information to determine program
or award eligibility and prevent improper payments before the release of any federal funds. At a
minimum and before issuing any payment or award, agencies must review certain databases to verify
eligibility of the payment and award.
The law also requires agencies to review and identify programs susceptible to significant improper
payments, report on the amount and causes of improper payments, and develop plans for reducing
improper payments. An improper payment is any federal government payment made to an ineligible
recipient or for an ineligible good or service, duplicate payment, or payment for goods or services not
received (except for such payment authorized by law).
The President signed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) on March
27, 2020, and the Paycheck Protection Program and Health Care Enhancement Act on April 24, 2020.
The laws authorize up to $659 billion for the PPP to provide small businesses with the resources they
needed to maintain their payroll, hire back employees who may have been laid off, and cover
applicable overhead during the pandemic.
The CARES Act requires eligible borrowers to make a good faith certification that
•
the loan is necessary due to the uncertainty of current economic conditions caused by
COVID-19;
•
they will use the funds to retain workers and maintain payroll, lease, and utility
payments; and
•
they are not receiving duplicate funds for the same uses from another SBA program.
The CARES Act also provides eligible recipients forgiveness of indebtedness on a covered PPP loan in
an amount equal to the sum of certain costs and payments made during the covered period.
Borrowers apply to lenders for forgiveness on PPP loans. However, SBA may refuse guarantee for any
portion of a loan ineligible for forgiveness.
OIG’s preliminary review and investigative findings have identified concerns with internal controls
and red flag indicators of fraud in the PPP. OIG has already initiated a robust plan to oversee SBA’s
response to COVID-19. Our investigative staff has also begun hundreds of investigations into
suspected PPP fraud.
Role of DNP in SBA’s Initial COVID-19 PPP Response
Querying PPP borrower identifiers to data maintained in the DNP portal can identify potentially
ineligible loan applicants. SBA OIG provided PPP loan data to Treasury’s DNP team that used SBA
business rules for PPP eligibility to analyze the data. As of August 8, 2020, after cancellations, SBA had
approved 5.2 million PPP loans totaling $525 billion. To be eligible to receive federal assistance such
as a PPP loan, a business must not have any current federal debarments or suspensions. Additionally,
a borrower must not have delinquent federal loans or have defaulted on any federal loans to receive
federal financial assistance.
Loans to Ineligible Recipients
Treasury’s DNP analysis found:
•
Of the $525 billion in total approved PPP loans, 57,473, or 1.1 percent, matched a DNP data
source record, indicating loan ineligibility. The 57,473 matched loans totaled
approximately $3.6 billion; $280 million was undisbursed as of August 8, 2020. (See Table
1).
•
Just 10 of the 3,403 loan servicing location identifications accounted for 49 percent of the
matched loans and 28 percent of the total matched loan value.
3
Matched Loan
Matched
Matched
Current Loan
Loans
Matched Current
Match Type
Loans
Amount (s)
(%)
Loan Amount (%)
Exact TIN*and Name
35,936
$1,915,166,634.67
62.53%
53.36%
Exact TIN
14,574
$1,067,742,615.47
25.36%
29.75%
Exact TIN and Non-Exact
Name
3,916
$435,615,342.22
6.81%
12.14%
Exact TIN and Name, Exact
TIN and Non-Exact Name
1,578
$101,613,230.29
2.75%
2.83%
Exact TIN, Exact TIN and
Name
1,243
$61,122,130.96
2.16%
1.70%
Exact TIN, Exact TIN and
Non-Exact Name
160
$5,164,220.81
0.28%
0.14%
Exact TIN, Exact TIN and
Name, Exact TIN and Non-
Exact Name
66
$2,968,124.75
0.11%
0.08%
Total
57,473
$3,589,392,299.17
To determine if PPP loans were made to eligible loan recipients, the Treasury team merged the data
tables OIG supplied, extracted all loan applications that were fully cancelled, and matched PPP
borrower identifiers to data in the DNP portal. The DNP portal accesses multiple federal data sources
required by law and includes
•
Treasury Offset Program (TOP Debt Check)
•
Credit Alert Interactive Verification Reporting System (CAIVRS)
•
System for Award Management (SAM Exclusion),
•
Social Security Administration’s Death Master File (DMF),
•
American InfoSource (AIS Obituary and AIS Probate),
•
Department of Defense and the Department of State records of deceased persons (See
Appendix II)
Each data source offers different levels of “match strength,” contingent on the data elements included
in the data source. Treasury’s DNP portal identifies three types of match strength: conclusive,
probable, and possible. Data sources with conclusive matches provide the optimal matching results.
Conclusive matches represent a 100 percent match in a federal data source(s) to a recipient’s
personal identifiers and are least likely to yield a false positive result.
Conclusive matches compare data elements, including name and
•
Taxpayer Identification Number (TIN)
•
Employer Identification Number
•
Data Universal Numbering System
•
Social Security Number
•
Address
Treasury’s analysis matched 38,823, or 67.6 percent, of the 57,473 loans by “Exact TIN plus Name,”
and the matches were deemed conclusive.
Table 1. Numbers of Matched Loans by Match Types (Distinct Loans)
*TIN stands for Taxpayer Identification Number
We be
lieve the identified PPP loans were made to potentially ineligible r ecipients because SBA and its
lenders relied on applicants’ self-certification for P PP loan eligibility. For example, applicants were
4
required to certify that the business did not have any current federal debarments or suspensions and
the borrower(s) did not have delinquent federal loans or have defaulted on any federal loans.
Conclusion
SBA should take immediate action to limit improper payments by strengthening existing controls and
implementing additional internal controls to address improper payments, especially through the
utilization of existing resources.
Treasury’s analysis of potentially ineligible recipients demonstrates the importance of front-end
controls and careful review by SBA of the loans identified. Our preliminary review of Treasury’s
analytical summaries indicates SBA should reassess controls to ensure only eligible recipients
obtained PPP loans and prevent improper payments, as required by the law. To prevent improper
payments, SBA will need to implement strong controls to ensure that loans to ineligible recipients are
not forgiven and any undisbursed funds are not released to borrowers.
Recommendations
To establish more effective oversight controls related to the PPP for COVID-19 pandemic relief, we
recommend that the Administrator direct the Associate Administrator for the Office of Capital Access
to:
1) Promptly identify PPP loans that have not been fully disbursed and follow-up with the
lenders to stop $280 million in potential improper loan disbursements.
2) Strengthen SBA controls to ensure that loans to ineligible recipients are not forgiven.
3) Review prepayment and pre-award procedures and work with Treasury to formulate
a technical approach to use Treasury’s DNP portal to determine loan applicant
eligibility and prevent improper payments before the release of any federal funds.
Analysis of Agency Comments
SBA leadership provided formal comments to this Management Alert, included in Appendix III. In the
comments, the agency states, “Prior to the Management Alert, SBA developed systems to screen
potential borrowers against the Treasury Department's Do Not Pay List. These efforts were underway
as a part of the loan review process before OIG issued the Management Alert.”
However, we believe this response does not acknowledge the importance of and need for the
recommended actions. In August 2020, after completing our fieldwork, we briefed agency managers
on the significance of the DNP audit results and the immediate need to put systematic screening
mechanisms in place. During the briefing, we emphasized that SBA should engage with Treasury’s
DNP program promptly and begin taking steps to establish screening processes.
After the briefing, agency managers requested--and we provided--the preliminary results of the
Treasury DNP data analysis. We expected SBA managers would begin implementing the necessary
screening protocols shortly after reviewing the analysis we provided.
However, SBA management later used the analysis results only to highlight potential PPP loan
exceptions through use of “hold” flags in the Capital Access Financial System—alerts that indicate the
need for further review of potential improper payments. We also understand that the agency plans to
use that information in loan forgiveness reviews. We agree it is appropriate for the agency to use our
DNP analysis for the loan forgiveness process.
However, management’s assertion that “SBA developed systems to screen potential borrowers
against the Treasury Department's Do Not Pay List” before our alert does not match OIG’s or
5
Treasury’s understanding of the timeline of events. Management’s comments indicate preventative
controls have already been put in place. But our understanding from Treasury is that portal access to
DNP is being established for two users, and batch processing capability for high-volume activity is still
under development. Batch processing to the DNP portal will be critical for SBA to implement OIG
recommendations without slowing PPP loan processing.
Management did not specifically address our individual recommendations in its response. However,
the statement that “efforts are underway” suggests that management agrees with our
recommendations. We will continue to work with SBA management to resolve the recommendations.
The following summary clarifies the necessary remediation actions to close our recommendations:
1) Promptly identify PPP loans that have not been fully disbursed and follow-up with the
lenders to stop $280 million in potential improper loan disbursements. This
recommendation can be closed when management provides documentation indicating all
undisbursed PPP loans identified as potential improper payments have been reviewed and
processed.
2) Strengthen SBA controls to ensure that loans to ineligible recipients are not forgiven.
This recommendation can be closed when the agency develops policy and establishes staff
guidance to prevent approvals of loan forgiveness if the recipient was ineligible for a PPP loan
under federal criteria.
3) Review prepayment and preaward procedures and work with Treasury to formulate a
technical approach to use Treasury’s DNP portal to determine loan applicant eligibility
and prevent improper payment of any federal funds. This recommendation can be closed
when the agency provides evidence that functioning controls are in place to compare PPP
applicant data against DNP portal data to prevent ineligible applicants from receiving federal
assistance.
We prepared this Management Alert in alignment with OIG’s quality control standards and the
Council of Inspectors General for Integrity and Efficiency’s (CIGIE) Quality Standards for federal
Offices of Inspector General, which require that we conduct our work with integrity, objectivity, and
independence. In connection with this Management Alert, we reviewed Treasury’s results and related
documentation and interviewed Treasury representatives.
If you have any questions, please contact me or Andrea Deadwyler, Assistant Inspector General for
Audits, at (202) 205-6586.
cc:
William Manger, Chief of Staff and Associate Administrator, Office of Capital Access
Christopher Gray, Deputy Chief of Staff
John A. Miller, Deputy Associate Administrator, Office of Capital Access
Steve Kucharski, Director, Office of Performance and Systems Management
Jihoon Kim, Director, Office of Financial Program Operations
Brittany Biles, General Counsel
Martin Conrey, Attorney Advisor, Legislation and Appropriation
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management
Tami Perriello, Chief Financial Officer and Policy Advisor to the Administrator
6
Appendix I. Data Sources Mandated by Law and Used in Treasury’s PPP
Analysis
Treasury matched PPP borrower identifiers to data maintained in the following data sources:
Treasury Offset Program (TOP Debt Check)
•
TOP Debt Check is a data extract or subset of data contained in the TOP delinquent debtor
database. It was created for the Treasury DNP system to help agencies fulfill the obligation to
deny federal loans, loan insurance, and loan guarantees to people who are delinquent on
federal nontax debts and child support obligations (if allowed by agency statute and
regulations).
•
DNP receives weekly TOP Debt Check updates.
Credit Alert Interactive Verification Reporting System (CAIVRS)
•
A shared database of defaulted federal debtors, CAIVRS enables processors of applications for
federal credit benefits to identify individuals who are in default or have had claims paid on
direct or guaranteed federal loans or are delinquent on other debts owed to federal agencies.
Treasury DNP receives CAIVRS data from the following agencies:
o U.S. Department of Justice
o U.S. Department of Agriculture
o U.S. Department of Veterans Affairs (Database not open to states)
o U.S. Department of Housing and Urban Development
o Small Business Administration
•
The entire CAIVRS database is refreshed each time any agency source forwards an update.
The agency sources update data at various times throughout the month.
System for Award Management (SAM Exclusion)
•
SAM Exclusion records contain the data for all active exclusion records entered by the federal
government identifying those parties excluded from receiving federal contracts, certain
subcontracts, and federal financial and nonfinancial assistance and benefits.
•
Treasury DNP receives daily SAM updates.
Death Master File (DMF)
•
The DMF from the Social Security Administration (SSA) is a data source that contains more
than 94 million records. The file is built from internal SSA records of deceased persons
possessing social security numbers and whose deaths were reported to the SSA.
•
DNP uses the public DMF but does not have access to the full DMF. Legislation such as the
Social Security Act precludes the sharing of the full DMF with agencies that do not pay
benefits.
•
DNP receives a weekly update to the public DMF and full refresh every quarter.
American InfoSource (AIS Obituary and AIS Probate)
•
AIS is a commercial global financial services company that provides obituary and probate
death data. AIS death data includes information about deceased individuals from all 50 states.
AIS gathers information from probate court records and published obituaries. Obituaries are
gathered by AIS from more than 3,000 funeral homes and thousands of newspapers. Probate
records are collected from county courts.
•
DNP receives weekly updates of all AIS data.
7
Department of Defense (DOD)
•
DOD death data provides information about confirmed or presumed deaths of United States
military members while abroad and at home.
•
DNP receives an update to DOD data the first week of every month.
Department of State (DOS)
•
DOS death data provides information about confirmed or presumed deaths of United States
citizens while abroad. Data is provided by DOS’s Bureau of Consular Affairs and originates
from the American Citizen Services System.
•
DNP receives an update to DOS data on the 11th of each month.
Table 2 summarizes Treasury’s matched loans by the DNP data source(s).
Table 2. Matched Loans by DNP Matched Data Source(s)
Match Source
Matched
Loans
Approved
Amount ($)
Current Amount
($)
Undisbursed
Amount ($)
TOP Debt Check
37,316
$1,565,193,095.40
$1,554,269,548.20
$196,605,444.84
CAIVRS (TIN Only)
16,043
$1,145,296,385.40
$1,136,997,092.00
$74,077,133.31
SAM Exclusion
958
$73,627,495.19
$73,684,412.26
$5,478,728.36
AIS Obituary
4,258
$826,654,548.31
$825,395,032.02
$12,609,669.41
DMF
938
$178,314,957.36
$179,104,890.06
$2,771,773.16
AIS Probate
228
$49,916,171.00
$49,588,488.24
$32,500.00
Dept. of State
20
$2,720,320.50
$2,720,320.50
$0.00
Note: The count of matched loans will not equal the $57,473 loan total seen in Table 1, “Numbers of Matched Loans by
Match Types (Distinct Loans),” because some loans matched multiple data sources. If the same loan matched to multiple
sources, its amount is included in the totals for each matched source.
8
Appendix II. Treasury’s Analytic Explanations
PPP Loan Universe
The SBA Office of the Inspector General provided the data to DNP by on August 11, 2020. The data
files represent the universe of SBA PPP loans at the time of data extraction on August 8, 2020.
There is a difference of less than 0.1 percent between the total value and total count of loans screened
by DNP compared to reported figures from SBA.1 This difference could be attributed to the date and
time the file was extracted by SBA for analysis. The SBA analysis was produced using finalized data
through August 8, 2020. The file DNP received was extracted before the final updates but before the
close of business on August 8, 2020.
Data Cleansing and Standardization Process
Treasury DNP discovered special characters (non-ASCII) in the SBA data. These characters caused an
issue with the DNP data loading process and required cleansing before the data could be loaded. After
the non-ASCII characters were removed from the files, the data loaded successfully. Because some
characters were removed from the analyzed fields, the matching strategy was changed from exact
TIN and name matches to exact TIN and nonexact name using similarity scoring, as follows.
Jaro-Winkler: Calculates the edit distance between two strings, giving a more favorable rating to
strings that begin with the same character.
Levenshtein: Calculates the edit distance between two strings. Each difference is counted to provide
the score.
Spedis: Computes the cost of converting one text string to another. Each operation is assigned a cost,
the cost is summed up at the end of the string comparison to produce a score.
Spedis-SoundEx: Each string is converted into a SoundEx value based on the sound certain letter
combinations may create. The SoundEx string is then run through the Spedis similarity function.
To assist in the name matching process, name fields in the SBA data were standardized using the
same standardization process used to standardize the name fields in the DNP data sources.
Findings Analysis
Loans with a status of "Fully Cancelled" were removed from data, because they included duplicate
loan applications and loans that were not approved.
A loan record may have multiple matches because all loan records have multiple TIN and name fields.
The borrower's TIN is used in conjunction with the borrower's name and the borrower's business
name. The principal's TIN is used in conjunction with the principal's name. There is also a possibility
that a TIN and name match could be present in multiple data sources.
Loans matched to the CAIVRS data source are TIN only matches. CAIVRS does not have name
information.
DNP Data Source Dictionary of Variables
DNP Match Source: Name of the data source in which a loan had an “Exact TIN” (CAIVRS only),
“Exact TIN and Name,” or “Exact TIN and Nonexact Name” match.
1 Small Business Administration, “Additional Program Information: Summary of Cumulative Paycheck Protection Program
data as of 11:59 PM EDT, Aug 8, 2020.” at https://www.sba.gov/funding-programs/loans/coronavirus-relief-
options/paycheck-protection-program. Accessed by DNP on August 20, 2020.
9
Match Type: Matches were produced by “Exact TIN” (CAIVRS only), “Exact TIN and Name,” or “Exact
TIN and Nonexact Name.”
Matching Field: All matches are matched using the exact TIN. This field identifies which name field
contained the name that matched a DNP data source. In the case of CAIVRS, this field identifies the
matching TIN field. The defined values are as follows:
•
Borrower TIN and Borrower Name equal Borrower TIN and Borrower Name match
•
Borrower TIN and Business Name equal Borrower TIN and Borrower Business Name
match
•
Principal TIN & Principal Name equal Principal TIN and Principal Name match
•
Borrower TIN equals Borrower TIN only match (CAIVRS)
•
Borrower Business TIN equals Borrower TIN only match (CAIVRS)
•
Principal TIN equals Principal TIN only match (CAIVRS)
CAIVRS Reporting Agency: The name of the agency whose CAIVRS feed contained the matched
record.
Name from DNP Match Source: The name as listed from the DNP matched data source.
Record Effective Date: The date the matched record became active in the DNP data source.
Record End Date: The date the record became inactive in the DNP data source. Inactive records may
indicate the entity is no longer on a particular list or that the record was replaced with an updated
record when information changed. In this case, there may be a match to both the INACTIVE and
ACTIVE records.
Record Status: Identifies if the record was ACTIVE or INACTIVE at the time of the analysis.
Date of Death: The date reported in the DNP death data sources as the date when an individual
passed away.
DNP Data Source List Status Code: A brief description of why an entity is listed on a DNP data
source.
10
Appendix III. Management’s Comments
SBA’s Response to the Alert
U.S. Small Business Administration
Washington, D.C. 20416
OFFICE OF THE ADMINISTRATOR
January 4, 2021
The Honorable Hannibal "Mike" Ware
Inspector General
U.S. Small Business Administration
409 3rd Street, SW
Washington, DC 20416
Dear Inspector General Ware:
I write in response to the Office of lnspector General's ("OIG") November 30, 2020 Management
Alert on Paycheck Protection Program (PPP) loan recipients on the Department of Treasury's Do
Not Pay list.
Prior to the Management Alert, SBA developed systems to screen potential borrowers against the
Treasury Department's Do Not Pay List. These efforts were underway as a part of the loan review
process before OIG issued the Management Alert. In addition, when SBA resumes PPP lending
pursuant to the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act, every
new PPP loan application submitted to SBA for processing by a lender will be searched against the
Treasury Department's Do Not Pay list.
SBA is working to protect taxpayer dollars and ensure that the Paycheck Protection
Program benefits only eligible borrowers. I would be happy to further discuss our response
regarding the Do Not Pay list and to provide further assistance to your office.
Sincerely,
/s/
Jovita Carranza
Administrator
11