Duplicate Loans Made Under the Paycheck Protection Program

Source document: Duplicate Loans Made Under the Paycheck Protection Program; document type: OIG audit report.

Full text

FLASH REPORT
DUPLICATE LOANS MADE UNDER THE PAYCHECK
PROTECTION PROGRAM
REPORT NUMBER 21-09 | MARCH 15, 2021
S B A
I N S P E C T O R
G E N E R A L

          EXECUTIVE SUMMARY

DUPLICATE LOANS MADE UNDER THE
PAYCHECK PROTECTION PROGRAM
Report 21-
09

March 15,
2021
Why We Did This
This analysis was initiated in response to a House
of Representatives Select Subcommittee on the
Coronavirus Crisis request that we review
duplicate loans made under the Paycheck
Protection Program (PPP) related to a vulnerability
in the Small Business Administration’s (SBA) loan
processing system.
The Coronavirus Aid, Relief, and Economic Security
(CARES) Act was signed into law by the President
on March 27, 2020 to provide economic relief to
small businesses. Section 1102 of the CARES Act
established the PPP with $349 billion to provide
fully guaranteed loans under section 7(a) of the
Small Business Act. These loans can be used to
cover payroll, rent, utility payments, and other
limited uses. On April 24, 2020, the President
signed the Paycheck Protection Program and
Health Care Enhancement Act to provide an
additional $310 billion to the PPP. As of August 8,
2020, when the PPP closed, lenders had approved
5.2 million PPP loans, totaling about $525 billion.
What We Reviewed
To conduct our analysis, we reviewed PPP
regulations and the Paycheck Protection Program
and Health Care Enhancement Act, in addition to
guidance published in SBA’s PPP Interim Final
Rules and PPP Frequently Asked Questions. We
also analyzed PPP loan data to identify whether
lenders disbursed more than one PPP loan to the
same borrower. Our objective was to determine
whether SBA had sufficient controls to detect and
prevent duplicate loans and address vulnerabilities
under the PPP.
What We Found
We determined SBA did not always have sufficient
controls in place to detect and prevent duplicate
PPP loans. As a result, lenders made more than one
PPP loan disbursement to 4,260 borrowers with
the same tax identification number and borrowers
with the same business name and address. These
disbursements totaled about $692 million for PPP
loans approved from April 3 through August 9,
2020.
In May 2020, SBA identified issues in which the
method for processing PPP loans did not detect all
duplicate loan applications which led to duplicate
loan numbers. According to SBA, the reasons for
this were 1) a computer script used to detect
duplicates stopped working, 2) lenders submitted
PPP applications using employer identification
number or social security number interchangeably,
and 3) borrowers applied for PPP loans with more
than one lender.
Throughout the PPP, SBA continued to identify
additional factors that led to duplicate loan
numbers. SBA then worked with lenders and
implemented controls to address these issues.
However, SBA stated it turned off controls for its
electronic loan application system which also led to
duplicate loan numbers. SBA also stated it would
rely on loan reviews to identify and resolve
duplicate
disbursements.
Although
SBA
continuously implemented controls, there were
still duplicate loans approved through the close of
the PPP in August 2020.
OIG Recommendations
We recommended in part that SBA 1) review
identified potential duplicate disbursements for
eligibility and take action to recover any improper
payments, 2) review controls related to all PPP
loan reviews to ensure that duplicate loans are not
forgiven and not subject to an SBA guaranty, as
appropriate, 3) strengthen E-Tran controls for
future PPP-type programs to ensure the controls
align with program requirements and are active at
all times, and 4) strengthen controls and guidance
for lenders to ensure lenders meet program
requirements for future PPP type programs.
Agency Response
SBA agreed with the report finding and all
recommendations. Management plans to review
and resolve duplicate loans by recovering
improper
payments
and
preventing
loan
forgiveness on ineligible loans. Management also
plans to enhance controls to ensure they align with
program requirements and are functioning at all
times.

Office of Inspector General

U.S. Small Business Administration

DATE:
March 15, 2021

TO:

Tami Perriello
Acting Administrator
Chief Financial Officer

FROM:
Hannibal “Mike” Ware /S/
Inspector General

SUBJECT:
Duplicate Loans Made Under the Paycheck Protection Program

This report presents the results of our analysis of duplicate loans made under the Paycheck
Protection Program (PPP). We initiated this review based on a request from the House of
Representatives Select Subcommittee on the Coronavirus Crisis to review duplicate loans made
under the PPP related to a vulnerability in the Small Business Administration’s (SBA) loan
processing system. Our objective was to determine whether SBA has sufficient controls to detect
and prevent duplicate loans and address vulnerabilities in the PPP. Specifically, we addressed
congressional questions regarding system vulnerability, scope of the problem, and actions taken by
SBA to address the problem. We considered management’s comments on the draft of this report
when preparing the final report. Management agreed with the finding and all recommendations.
We appreciate the courtesy and cooperation extended to us during this review. If you have any
questions, please contact me or Andrea Deadwyler, Assistant Inspector General for Audits, at (202)
205-6586.
cc:  Patrick Kelley, Associate Administrator, Office of Capital Access
Steve Kong, Acting Chief of Staff
John Miller, Deputy Associate Administrator, Office of Capital Access
Peggy Hamilton, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Martin Conrey, Attorney Advisor, Office of General Counsel
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management
Tonia Butler, Director, Office of Internal Controls

1
Background
The Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law by the
President on March 27, 2020 to provide economic relief to small businesses. Section 1102 of the
CARES Act established the PPP with $349 billion to provide guaranteed loans under section 7(a) of
the Small Business Act. These loans can be used to cover payroll, rent, utility payments, and other
limited uses. On April 24, 2020, the President signed the Paycheck Protection Program and Health
Care Enhancement Act to provide an additional $310 billion to the PPP. As of August 8, 2020, when
the PPP closed, lenders had approved 5.2 million PPP loans, totaling about $525 billion with a
reported $134 billion remaining in the program. Before the PPP, SBA’s largest single year in 7(a)
lending volume was about $25.4 billion, in fiscal year 2017.
Under the CARES Act, SBA delegated authority to lenders to make and approve PPP loans. About
5,460 lenders participated in the PPP. To approve PPP loans, lenders confirmed 1) receipt of
borrower certifications in the PPP Borrower Application, 2) receipt of information demonstrating
that a borrower had employees for whom the borrower paid salaries and payroll taxes, and 3) the
dollar amount of average monthly payroll costs for the preceding calendar year by reviewing the
payroll documentation submitted with the borrower's application. Once those steps were
completed, the lender submitted application information to SBA electronically to obtain an SBA
loan number. These submissions were processed through various web applications, data file
transfers, or by bulk loan processing used to accommodate 5,000 or more applications from one
lender. According to SBA, bulk loan processing was developed to address a backlog of PPP
applications created when the initial $349 billion of funding was exhausted. Bulk loan processing
was used for the first and only time to process at least 724,224 PPP loans valued at about $55
billion.
The next step involved the lender notifying SBA of the PPP loan disbursement. This process
included 1) completion of SBA Form 1502 containing loan status information, 2) submission of the
form electronically to the Fiscal Transfer Agent, and 3) the Fiscal Transfer Agent providing the data
to SBA. The Fiscal Transfer Agent is a third party responsible for obtaining loan account updates
and payment information on SBA’s behalf. That final transfer of data to SBA documents the
disbursement of loan funds from the lender to the borrower. If the data shows a borrower received
more than one loan disbursement, that indicates there was a duplicate disbursement.
On May 19, 2020, SBA Office of Capital Access notified SBA Office of Inspector General (OIG) that it
identified an issue in which the method for processing PPP loans did not always detect duplicate
loan applications. This issue, which was identified on May 1, 2020, resulted in more than one loan
number being issued for the same borrower.
Requirements
According to the CARES Act, eligible PPP loan applicants shall make a good faith certification that
they do not have an application pending for a loan of the same purpose and duplicative of an
amount applied for or received under the program. In addition, during the period beginning
February 15, 2020 and ending December 31, 2020, eligible recipients certify they have not received
loan funds for the same purpose and duplicative of amounts applied for or received under a PPP
loan.1 Regulation also states that the lender must make a one-time full disbursement of the PPP
loan.2 In addition, borrowers cannot apply for more than one PPP loan or receive more than one
PPP loan.3 Furthermore, the PPP Borrower Application Form states applicants must certify that

1 CARES Act, Section 1102 (a)(2) referencing new subpart 36(G), March 27, 2020.
2 Interim Final Rule – Requirements-Disbursements, May 4, 2020.
3 Interim Final Rule – Paycheck Protection Program, April 15, 2020.

2
they have not and will not receive another loan under the PPP. In the PPP Lender Application Form,
the lender must also acknowledge receipt of the borrower certification.
To receive loan forgiveness, borrowers must complete and submit the PPP Loan Forgiveness
Application to their lender. The lender will review the application and make a decision regarding
loan forgiveness. The lender has 60 days from receipt of a completed application to issue a decision
to SBA. If the lender determines that the borrower is entitled to forgiveness of some or all of the
amount applied for under the PPP, the lender must request payment from SBA at the time the
lender issues its decision to SBA. SBA will, subject to any agency review of the loan or loan
application, remit the appropriate forgiveness amount to the lender no later than 90 days after
issuing its decision to SBA.4
Results
SBA did not always have sufficient controls in place to detect and prevent duplicate PPP loans.
Specifically, as discovered and reported by SBA officials, the methods for processing PPP loans were
not sufficient to detect and prevent duplicate loan applications, which resulted in more than one
loan number for the same borrower. In addition, we found that SBA’s efforts to remedy the
duplicate loan numbers did not fully address the vulnerability because duplicate disbursements
occurred until the end of the program on August 8, 2020. We also found SBA primarily focused on
duplicate loans numbers and not duplicate loan disbursements.
Based on our review of PPP loan data as of August 31, 2020, we found that lenders made more than
one PPP disbursement to 4,260 borrowers, which totaled about $692 million and involved 8,731
PPP loans.
SBA Identified Duplicate Loan Numbers
On May 19, 2020, SBA Office of Capital Access notified SBA Office of Inspector General (OIG) that its
PPP loan processing method did not detect all duplicate loan applications. This issue, which was
identified on May 1, 2020, resulted in about 40,000 duplicate loan numbers being issued to about
20,000 borrowers.
According to SBA, one reason for this issue was an error that occurred during the one-time use of
bulk loan processing. Since this process was used only to address the backlog of PPP applications,
SBA did not plan to use it again and took note of lessons learned if needed in the future. When SBA
processed PPP loans under this method, loan information was compared to applications that were
already processed. This comparison was done using a computer script to identify duplicate
applications which were then rejected. The script stopped working for 14 hours before SBA became
aware of it on May 1, 2020. SBA stated it was successful in correcting the script to ensure it worked
properly. However, after SBA corrected the script, the agency did not go back and review loan
applications for duplicates processed during that 14-hour period.
SBA stated another cause for the duplicate loan numbers involved the submission of PPP loans
through SBA electronic loan application system (E-Tran). E-Tran was set up to detect if a tax
identification number (TIN), which can refer to an employee identification number (EIN) or social
security number (SSN), had already been processed. However, E-Tran failed to detect if an
application with an SSN and another application with an EIN was submitted by the same borrower.
SBA contacted lenders to resolve the duplicate loan numbers and initiated a change in E-Tran to
restrict the use of an SSN and EIN interchangeably. Lastly, according to SBA, another cause for
duplicate loan numbers involved borrowers applying for PPP loans with more than one lender.

4 Interim Final Rule – Requirements-Loan Forgiveness, June 1, 2020.

3
SBA’s Efforts to Address Duplicate Loan Numbers
SBA officials stated that as of August 4, 2020, it identified 40,209 duplicate loan numbers. This
included 5,377 duplicates related to the script error and 34,832 duplicate loan numbers related to
the TIN issue, both described above. However, according to SBA, not all 40,209 duplicate loan
numbers resulted in a disbursement. According to SBA, it contacted lenders to resolve duplicate
loan numbers and further instructed them to recover any funds that should not have been
disbursed. SBA indicated it had three employees assigned to work with lenders on resolution in
addition to 75 employees assigned to contact borrowers. For lender resolution, SBA indicated it
sent policy reminders and detailed instructions on how to make corrections or cancel loans. SBA
also coordinated with lenders that made loans to the same borrower to facilitate a resolution.
According to SBA, there were some unresponsive borrowers. As of September 9, 2020, SBA stated
there were 1,894 duplicate loan numbers from 945 borrowers left to be resolved. However, the
1,894 duplicate loan numbers left to be resolved were likely from the 40,209 duplicate loan
numbers that SBA identified in May 2020. We requested but did not receive clarification regarding
SBA’s methodology to identify the duplicate loan numbers and how SBA then resolved these loans.
As of December 1, 2020, SBA did not provide sufficient information to substantiate their actions to
resolve the duplicate loan numbers and prevent duplicate loan disbursements. Therefore, SBA
could not provide assurances that it resolved the duplicate loan numbers and prevented duplicate
loan disbursements.
According to SBA, as TIN related issues arose, they implemented additional controls to resolve
duplicate loan numbers. These controls included automated E-Tran reviews of the borrowers’ PPP
loan application information entered into the system by lenders, resulting in E-Tran error codes
when discrepancies were identified. See Table 1 for the controls that SBA implemented from May
through August 2020.

4
Table 1: SBA Implemented Controls
Date
Implemented Control
May 3, 2020
 E-Tran error code 237: stops reinstated loans that can result in a duplicate scenario
 Expanded the duplicate validation to check against loans that passed validation
May 8, 2020
 No longer allowed certain small businesses to use an SSN in place of an EIN. Lenders
can only enter an SSN for certain small businesses. According to SBA, the certain
small businesses included sole proprietors, limited liability companies, and self-
employed small business owners.
May 14, 2020
 E-Tran error code 259: primary borrower TIN (EIN or SSN) does not match the
acceptable TIN types for that business entity. For example, SSNs are matched with
independent contractors.
May 22, 2020
 E-Tran error code 4216: primary borrower’s EIN matches the principle's SSN on the
same loan
June 9, 2020
 E-Tran error code 258: a new PPP loan number matches an approved PPP loan
number with a different TIN
 Added research status category for lenders to easily show duplicates for resolution.
According to SBA, the PPP loans labeled “research” are either true duplicates or
EIN/SSN masking duplicates.
 True duplicates are a result of a borrower having multiple PPP loans with valid
data with different lenders.
 EIN/SSN masking duplicates are duplicate PPP loans that result from lenders
using the same nine digits for one borrower as an EIN and a TIN.
 E-Tran error code 544: research status. Even though SBA indicated it created the
research status for any situations requiring a second look by the lenders, SBA only
used it for duplicate loans.
 Changing the primary borrower does not result in a duplicate TIN
July 14, 2020
 Code improvements to increase PPP processing speed, improves duplicate detection
August 2020
 Code rewritten to improve detection of duplicate PPP loans
Source: OIG Analysis
In addition, according to SBA, it updated E-Tran controls to better match PPP requirements. For
example, the processing method disallowed duplicate primary borrower businesses. In another
example, SBA also established error code 3069 to indicate PPP loans that were not fully disbursed.
Further, SBA established error code 541 for invalid TINs and error code 542 for duplicate TINs.
Lastly, controls that were in place for the 7(a) loan program that did not apply to PPP were
removed. SBA officials estimated their efforts prevented 685,529 duplicate loan numbers.
Overall, SBA stated it resolved 38,315, or 95%, of the 40,209 duplicate PPP loan numbers it
identified in May 2020 and prevented an additional 685,529 duplicate loan numbers from
occurring. Although we requested the information, SBA did not always provide sufficient support to
substantiate their stated results. Therefore, SBA could not provide assurances that it resolved
38,315 duplicate loan numbers and fully addressed the vulnerability. The OIG recognizes that
duplicate loan numbers increased the risk for duplicate disbursements. As such, we analyzed SBA’s
PPP loan data as of August 31, 2020 for duplicate disbursements.

5
OIG Identified Duplicate Disbursements
Based on our review of loan data, we found that as of August 31, 2020, lenders made more than one
PPP disbursement to 4,260 borrowers, including 2,689 borrowers with the same TIN and 1,571
borrowers with the same business name and address. These potential duplicate disbursements
totaled about $692 million and involved 8,731 PPP loans approved from April 3 through August 9,
2020.
For the 4,260 borrowers, we identified a total of 1,464 lenders that made one or more PPP loan
disbursement, which may include both borrowers with the same TIN and borrowers with the same
business name and address. In some instances, some borrowers received more than two
disbursements.
SBA’s Interim Final Rule states that the lender must make a one-time full disbursement of the PPP
loan. Although there may be some legitimate reasons for individual occurrences of the same TIN or
borrower receiving more than one disbursement, multiple occurrences could indicate a potential
for improper duplicate disbursement. Legitimate individual occurrences could include PPP loan
increases for partner compensation or include franchisees using the same corporate name and
address.
Duplicate Disbursements Made to the Same Tax Identification Number
Lenders disbursed funds for more than one PPP loan to 2,689 borrowers with the same TIN. These
potential duplicate disbursements totaled about $329 million and involved 5,382 loans. Of the
2,689 borrowers, 2,685 received two disbursements while the remaining four borrowers received
three disbursements.
In addition, 2,613, or 97%, of the 2,689 borrowers had 5,230 loans totaling about $323 million in
disbursements made by different lenders. The remaining 76 borrowers had duplicate
disbursements made by the same lender.
Duplicate Disbursements Made to the Same Business Name and Address
Lenders disbursed funds for more than one PPP loan to 1,571 borrowers with the same business
name and address. These potential duplicate disbursements totaled about $364 million and
involved 3,349 loans. In addition, 1,470 of the 1,571 borrowers received two disbursements. The
remaining 101 borrowers received three or more disbursements, including one borrower who
received 17 disbursements totaling about $1.3 million.
Comparison of OIG Identified Duplicate Loan Disbursements and SBA’s Identified Duplicate
Loan Numbers
We compared the duplicate disbursements for the borrowers with the same TIN and borrowers
with the same business name and street address to the list of duplicate loan numbers identified by
SBA. We found that 2,225 of the 5,382 loans from our TIN disbursements analysis was included in
SBA’s list of loan numbers. Of those 2,225, which totaled about $163 million, the information
provided by SBA indicated 1,909 were resolved. However, we did not validate SBA’s resolved loan
numbers because although we requested, SBA did not provide sufficient documentation to
substantiate they resolved the duplicate loan numbers.
In addition, we compared our disbursement analysis for business name and address to SBA’s list of
duplicate loan numbers. We found that 29 of the 3,349 loans from our business name and address
disbursement analysis were included in SBA’s list of loan numbers. Of those 29, which totaled about
$2.4 million, the information provided by SBA indicated 27 were resolved. However, we did not
validate SBA’s resolved loan numbers because the agency did not provide the supporting
documentation as requested. Further, because the 2,254 loans, which totaled over $165 million,

6
were also identified in both comparative analyses and had disbursements, SBA will need to assess
whether the disbursements identified as duplicates were eligible and proper. This is imperative
because SBA had to implement numerous controls throughout the program to resolve issues
related to duplicates loan numbers.
According to SBA, as of July 2020, at least 32 borrowers returned the funds from the second PPP
loan to the lender. At least 154 borrowers have not returned duplicate PPP disbursements.
However, SBA did not provide the related dollar amount or share any loan specific information. In
addition, loans related to the 186 borrowers with multiple PPP loans did not account for the full
scope of the duplicates that we or SBA identified under the program. As a result, there is no
assurance that SBA identified and ensured lenders recovered all duplicate PPP disbursements.
Analysis of SBA’s Controls to Address Duplicate Loan Numbers
We found that SBA’s efforts did not eliminate duplicate disbursements before the PPP closed on
August 8, 2020. Specifically, based on our data analysis, we found that SBA approved 1,184, or 22%,
of the 5,382 loans after it initially implemented controls in May 2020 to prevent duplicate loan
numbers.
We analyzed PPP loan data by approval date and identified the number of loans related to duplicate
disbursements by month for the borrowers with the same TIN. See Table 2 for approved PPP loans
by month for borrowers with the same TIN and the related duplicate disbursements.
Table 2: Duplicate Approved Paycheck Protection Program Loans
and Disbursements
Approval Month
No. of Loans Approved
Disbursement Amount
April
2,392
$228,053,985
May
1,806
$71,693,874
June
1,115
$27,349,989
July
22
$658,530
August
47
$921,907
Total
5,382
$328,678,285
Source: OIG Analysis
According to SBA, it was an ongoing effort to address duplicate PPP loan numbers. In addition to
issues with E-Tran, computer script malfunction, and borrowers applying with more than one
lender, SBA also identified the following factors that attributed to the duplicate loan numbers:
•
Lenders provided incorrectly formatted data.
•
Lenders provided bad data.
•
Lenders did not identify borrowers requesting multiple loans before the lenders
uploaded the loans for bulk processing.
•
Lenders submitted old applications without communicating with the borrower to
confirm that the borrower was still interested in the loan.
•
Lenders submitted the same loan through multiple platforms such as Capital Access
Financial System (CAFS), Lender Gateway, and bulk upload.
•
New lenders were not familiar with the requirements to perform their own due
diligence when processing loans.
•
SBA did not follow a software development procedure to address the backlog of PPP
applications due to time constraints.

7
Also, according to SBA, they temporarily turned off controls designed to prevent duplicate loan
numbers between June 23 and June 30, 2020 to work with lenders to resolve the already identified
duplicate loan numbers. However, during this eight-day period, lenders continued to make new PPP
loans so duplicates that would have likely been prevented were not, which caused additional
duplicate loan numbers to occur.
Lastly, SBA’s initial focus was on preventing duplicate PPP loan numbers and not on identifying
duplicate PPP disbursements. SBA officials stated they will rely on the loan review process and, as
applicable, the loan forgiveness review process to identify and resolve duplicate disbursements.
According to SBA, the loan review process applies to all loans regardless of the dollar value and if a
lender approved and submitted the borrower’s forgiveness application. The loan forgiveness
review process occurs only if the lender approved and submitted the borrower’s forgiveness
application. Both review processes occur after the lender already disbursed the loan funds to the
borrower and before SBA disburses the forgiveness funds to the lender with the taxpayer
committed PPP funds.
According to SBA, because borrowers are only allowed one PPP loan, duplicate disbursements will
be identified as a part of the loan review for eligibility. SBA will accomplish this by using an
automated tool to review all PPP loans to test for compliance with program requirements and flag
those loans that require additional scrutiny. If loans are flagged by the tool for issues related to
identity, eligibility, or fraud, they will receive a manual review. PPP loans may also be selected for
manual review through sample selection as part of SBA’s quality assurance process. In addition, all
PPP loans $2 million and above will receive a manual review. On October 2, 2020, SBA began
approving PPP forgiveness applications and remitting forgiveness payments to PPP lenders. We
were not able to determine the exact steps SBA will take to identify and resolve duplicate
disbursements because the agency has not provided sufficient supporting documentation for its
loan review processes as requested. Therefore, SBA could not provide assurances that it will be able
to resolve duplicate disbursements.
Establishing strong controls to prevent improper or duplicate disbursements from occurring during
initial loan processing is more effective than attempting to identify and resolve improper
disbursements in the loan review phase. SBA’s efforts should focus on safeguarding funds up front,
as it is more prudent and effective to prevent a loan from occurring than attempting to recover
funds after the loan has been disbursed.
Exploiting the Program
According to SBA officials, the agency was not aware of any borrowers intentionally exploiting the
initial E-Tran vulnerability related to using SSNs as EINs or vice versa to obtain a duplicate
disbursement. SBA further stated that since borrowers do not access E-Tran to enter or edit loan
information, it is unlikely borrowers would be aware of the vulnerability to commit fraud.
We agree with SBA that only lenders have access to E-Tran to enter or edit the borrower’s loan
information and it is unlikely that borrowers accessed E-Tran to exploit the initial vulnerabilities.
However, it is important to note that borrowers are exploiting the program. For example, as of
November 20, 2020, the OIG has pursued multiple PPP criminal fraud cases related to duplicate
loans made to the same business. Additionally, external agencies have ongoing cases involving
businesses with duplicate PPP loans.
Conclusion
Loans given to ineligible borrower’s place taxpayer funds at risk of financial loss and delayed the
amount of available critical capital needed for eligible businesses to withstand the effects of the
pandemic during the first round of PPP funding. Our assessment of duplicate disbursements was
based on SBA’s loan data as of August 31, 2020. To fully determine if the disbursements resulted in
PPP loans to ineligible borrowers, SBA must conduct loan reviews and take immediate action to

8
address potential improper PPP loan disbursements. This is because sufficient controls were not
implemented up front to prevent improper loans from occurring. It is more prudent and effective to
safeguard funds up front, when capital is still in the lenders’ control, than attempting to recover
funds after disbursement. Since SBA did not sufficiently implement upfront controls, SBA should
strengthen its existing controls and implement additional internal controls to ensure the integrity
of the PPP and that only eligible borrowers receive loans for the proper amount. SBA must balance
maintaining sufficient controls while also providing needed funds to eligible borrowers during
pandemic recovery.
Recommendations
We recommend the Administrator direct the Associate Administrator for the Office of Capital
Access to:
1. Review the OIG identified potential duplicate disbursements for eligibility and take action to
recover any improper payments as applicable.
2. Review SBA controls related to all PPP loan reviews to ensure that duplicate loans are not
forgiven and not subject to an SBA guaranty, as appropriate.
3. Strengthen E-Tran controls for future PPP type programs, which includes keeping E-Tran
controls that align with program requirements on at all times.
4. Review the issues that SBA identified involving the actions of lenders, such as providing
incorrectly formatted data and submitting the same application through multiple platforms,
and determine how to strengthen controls and guidance as appropriate to ensure lenders
meet program requirements for future PPP type programs.

9
Analysis of Agency Response
SBA management provided formal comments to the draft report, which are included in their
entirety in Appendix II. Management agreed with the finding and all recommendations, and its
proposed actions will resolve all the recommendations. Management provided the implementation
dates for all recommendations in separate correspondence. We considered management’s
comments when preparing this final report.
Summary of Actions Necessary to Close the Recommendations
The following details the status of our recommendations and the actions necessary to close them.
Recommendation 1
Review the OIG identified potential duplicate disbursements for eligibility and take action to
recover any improper payments as applicable.
Status: Resolved
SBA management agreed with this recommendation, stating that loans related to the OIG identified
potential duplicate disbursements will be flagged for forgiveness and loan reviews. Once flagged,
lenders must follow established procedures to resolve the flagged loans. In addition, various offices
within SBA will coordinate to recoup any improper payment of funds as applicable. Management
plans to complete final action on this recommendation by September 1, 2021. This
recommendation can be closed when SBA provides evidence that they reviewed the identified
potential duplicate disbursements and took necessary actions to recover improper payments, as
appropriate.
Recommendation 2
Review SBA controls related to all PPP loan reviews to ensure that duplicate loans are not forgiven
and not subject to an SBA guaranty, as appropriate.
Status: Resolved
SBA management agreed with this recommendation and stated that it implemented a process to
resolve flagged loans which require additional review. Once flagged, lenders must follow
established procedures to resolve the flagged loans. Also, in follow-up correspondence,
management stated it will use its loan review plan to address this recommendation. The loan
review plan states each PPP loan is subject to an automated screening process which includes steps
to identify borrowers with multiple PPP loans and applications. Management plans to complete
final action on this recommendation by September 1, 2021. This recommendation can be closed
when SBA provides evidence that duplicate PPP loans have been flagged, reviewed, and
appropriately resolved regarding eligibility for loan forgiveness and guaranty payments.
Recommendation 3
Strengthen E-Tran controls for future PPP type programs, which includes keeping E-Tran controls
that align with program requirements on at all times.
Status: Resolved
SBA management agreed with this recommendation, stating it implemented enhancements to the
existing platform involving PPP loan origination and they no longer use bulk loan processing. This
enhancement includes performing data edits and validations that are done prior to the loans
entering SBA’s loan processing system. These changes allow E-Tran to operate as a backend process

10
to maintain existing controls. Management plans to complete final action on this recommendation
by September 1, 2021. This recommendation can be closed when SBA provides evidence that the
platform enhancements have been implemented, they align with program requirements, and
controls are functioning at all times.
Recommendation 4
Review the issues that SBA identified involving the actions of lenders, such as providing incorrectly
formatted data and submitting the same application through multiple platforms, and determine
how to strengthen controls and guidance as appropriate to ensure lenders meet program
requirements for future PPP type programs.
Status: Resolved
SBA management agreed with this recommendation, stating they implemented enhancements to
the existing platform involving PPP loan origination and no longer use bulk loan processing. This
enhancement includes performing data edits and validations that are done prior to the loans being
entered into the SBA loan processing system. These changes allow E-Tran to operate as a backend
process to maintain existing controls. This will also resolve the issue of submitting applications
through multiple platforms and will help ensure lenders meet program requirements. Management
plans to complete final action on this recommendation by September 1, 2021. This
recommendation can be closed when SBA provides evidence that the platform enhancements have
been implemented and are effective to mitigate the risk of lenders submitting incorrectly formatted
data, same applications through multiple platforms, and to ensure lenders met program
requirements.

11
Appendix I: Objective, Scope, and Methodology
This report presents the results of our analysis of duplicate loans made under the PPP. Our
objective was to determine whether SBA has sufficient controls to detect and prevent duplicate
loans and address vulnerabilities under the PPP.
To accomplish our objective, we reviewed Section 1102 of the CARES Act, SBA’s PPP Interim Final
Rules, SBA’s PPP Frequently Asked Questions, SBA’s PPP Borrower Application, SBA’s PPP Lender
Application, as well as lender approved and disbursed PPP loans as of August 31, 2020. We
interviewed officials from SBA Office of Capital Access and SBA Office of Performance and Systems
Management to address our objective and any congressional questions. In addition, we identified
controls implemented by SBA and other activities performed by the agency to address duplicate
loan numbers. We did not validate statements made by SBA or supporting documentation provided
by SBA related to those statements. This is because our review methodology did not include
contacting lenders and borrowers or reviewing loan file information, such as loan applications and
related supporting documentation. For example, we did not validate the controls that SBA
implemented from May to August 2020 to address duplicate loan numbers.
We obtained and analyzed PPP loan data from SBA’s CAFS to identify whether lenders approved
and disbursed duplicate PPP loans to the same borrower. We identified PPP loans that had the
same TIN, an active loan status, and a disbursement amount. In addition, we identified PPP loans
that had the same business name and address, an active loan status, and a disbursement amount.
Our assessment of duplicate disbursements relied primarily on the PPP loan data and did not
include a review of loan documents. Further, we compared the duplicate disbursements we
identified for borrowers with the same TIN and borrowers with the same business name and street
address to the list of duplicate loan numbers identified by SBA. We did not interview lenders or
borrowers nor did we review loan documents. Also, we did not validate the list of duplicate loan
numbers that SBA identified because the agency did not provide supporting documentation
explaining the methodology that was used to identify duplicate PPP loan numbers.
We conducted this assessment in accordance with the Council of the Inspectors General on Integrity
and Efficiency’s Quality Standards for Inspection and Evaluation. Those standards require that we
adequately plan and perform the evaluation to obtain sufficient and appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our objective. We believe that
the evidence provides a reasonable basis for our conclusions based on our objective.
Use of Computer-Processed Data
We relied on data from SBA’s CAFS to conduct our analysis and assessed the reliability of that data.
Specifically, we performed limited testing on the data extracts by comparing daily totals for the
number of loans and related total daily dollar amount to the daily totals in E-Tran loan activity
reports. We found that the difference was less than 1%. We also performed limited testing on the
data extract through July 31, 2020 to SBA reported total number of loans and related dollar amount
for that same period; we found the difference was under 1.5%. In addition, we performed limited
completeness testing on the data extracts for both data sets, TIN, and borrower name and address.
As a result, we believe the data is sufficiently reliable to support our conclusions. We did not
validate the accuracy of the data extracts nor assess the reliability of E-Tran loan activity reports
because doing so would involve reviewing lender loan files and would be outside the scope of our
review.

12
Appendix II: Management Comments
SBA RESPONSE TO FLASH REPORT

13
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416

TO:

Hannibal “Mike” Ware, Inspector General

The Office of Inspector General (OIG)
THRU:
John A. Miller

Acting Associate Administrator, Office of Capital Access
FROM:
Steve Kucharski

Director, Office of Performance and Systems Management
SUBJECT:
Response to OIG Draft Report entitled “Duplicate Loans Made Under the
Paycheck Protection Program”
DATE:
March 01, 2021

Thank you for providing the Office of Capital Access the opportunity to respond to OIG’s Draft
Report entitled, “Duplicate Loans Made Under the Paycheck Protection Program (Project
Number 20018), dated January 27, 2021. The OIG’s audit objective for this draft report was to
determine whether SBA has sufficient controls to detect and prevent duplicate loans and address
vulnerabilities in the Paycheck Protection Program (PPP).
The Office of Capital Access (OCA) has the following comments with respect to the OIG
recommendations:
OIG Recommendation 1 – Review the OIG identified potential duplicate disbursements for
eligibility and take action to recover any improper payments as applicable.
SBA Agrees - OCA will include the following recommended actions.
SBA OCA the Office of Performance and Systems Management (OPSM) will assist the Office of
Credit Risk Management (OCRM) and the Office of Financial Program Operations (OFPO) to
prepare their actions to recoup any improper payment of funds, as applicable. OPSM will assist
with providing contact information to assist with collection on identified and verified PPP
duplicate disbursements.
OIG Recommendation 2 – Review SBA controls related to all PPP loan reviews to ensure that
duplicate loans are not forgiven and not subject to an SBA guaranty, as appropriate.
SBA Agrees - OCA will include the following recommended actions.
The PPP duplicate loans on the OIG list will have a “hold” code placed in the system. The loans
will be flagged for forgiveness and loan review. The process for resolving Compliance Error

14
Checks and Hold Codes is in SBA Procedural Notice 5000-20092, “Revised SBA Paycheck
Protection Platform Procedures for Addressing Hold Codes on First Draw PPP Loans and
Compliance Check Error Messages on First Draw PPP Loans and Second Draw PPP Loans”
OIG Recommendation 3 – Strengthen E-Tran controls for future PPP type programs, which
includes keeping E-Tran controls that align with program requirements on at all times.
SBA Agrees - OCA will include the following recommended actions.
This recommendation has already been satisfied with this workstream transitioned to Summit
involving PPP loan origination. ETRAN is now the backend batch process for loan origination
which allows OCA to maintain the controls.
In addition, SBA OCA OPSM is not allowing bulk or real-time loan processing. By eliminating
bulk or real-time loan processing all loans will be reviewed against existing controls/validations
currently in place, prior to receiving a loan number.
OIG Recommendation 4 – Review the issues that SBA identified involving the actions of
lenders, such as providing incorrectly formatted data and submitting the same application
through multiple platforms and determine how to strengthen controls and guidance as
appropriate to ensure lenders meet program requirements for future PPP type programs.
SBA Agrees - OCA will include the following recommended actions.
This recommendation has already been satisfied with this workstream transitioned to Summit
involving PPP loan origination. ETRAN is now the backend batch process for loan origination
which allows OCA to maintain the controls.
In addition, SBA OCA OPSM is not allowing bulk or real-time loan processing. By eliminating
bulk or real-time loan processing all loans will be reviewed against existing controls/validations
currently in place, prior to receiving a loan number.
Thank you for giving OCA the opportunity to comment on OIG’s draft report, “Duplicate Loans
Made Under the Paycheck Protection Program” (Project 20018) and for taking OCA’s comments
into consideration.
Addendum to Memorandum - Response to Draft Report entitled, “Duplicate Loans Made
Under the Paycheck Protection Program”
Technical Comment:
 Page 2, paragraph 1 –
•
“OIG list”, is the list of potential PPP duplicates the OIG provided in this report.

File and source

File

21-09-duplicate-ppp-loans.pdf

Size

705,505 bytes

SHA-256

2cdb4e48540087466ebf21904f59952da073d68fe1b5f8e68c6ac98c23d98e67

Our copy

21-09-duplicate-ppp-loans.pdf

Original

www.sba.gov