Full text
Pandemic Response
Accountability Committee
SMALL BUSINESS
ADMINISTRATION
PAYCHECK
PROTECTION
PROGRAM
PHASE III FRAUD
CONTROLS
January 21, 2022
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
2
Introduction
1 Due to the limited scope evaluation, the PRAC did not review the RRF controls or assess their effectiveness. A document provided
by the SBA on the RRF controls shows some overlap with some of the PPP Phase III controls, but they were not completely similar. For
example, the SBA verified tax return data for RRF applicants. According to the SBA, it expanded the Phase III antifraud controls for the
RRF to address control weaknesses in the first phase of PPP and leveraged other technology systems and platforms.
The Pandemic Response Accountability
Committee (PRAC) is responsible for conducting
oversight of pandemic-related funds and
preventing and detecting fraud. We conducted
this project — in coordination with the Small
Business Administration (SBA) Office of
Inspector General (OIG) and the Office of
Management and Budget (OMB) — to examine
antifraud controls used by the SBA in its
Restaurant Revitalization Fund (RRF) to prevent
the types of fraud that the SBA experienced
with the Paycheck Protection Program (PPP).
The American Rescue Plan Act of 2021
established the RRF to provide $28.6 billion in
funding to help restaurants and other eligible
businesses keep their doors open. This program
provided restaurants with funding equal to
their pandemic-related revenue loss up to $10
million per business and no more than $5
million per physical location. Recipients are not
required to repay the funding so long as funds
are used for eligible uses no later than March
11, 2023.
The SBA implemented controls to the PPP in
three phases. Phase I and II controls were
applied to loans processed in 2020. Phase
III controls were applied to loans processed
after January 11, 2021. Phase III controls were
designed to address significant fraud identified
in the earlier phases of the program and some
were later used by the SBA in the RRF program.
To gain insight into the effectiveness of these
controls, we initiated a limited scope evaluation
on April 29, 2021, to examine whether Phase
III PPP controls would have likely detected the
fraud identified in PPP criminal cases.1 This
report includes a discussion of the SBA’s PPP
controls and an evaluation of whether any
fraud risks remain that would require additional
controls to prevent or detect the earlier fraud
found in PPP criminal cases. See Appendix A
for details on the scope and methodology. The
PRAC conducted this evaluation in accordance
with the Quality Standards for Inspection
and Evaluation issued by the Council of the
Inspectors General on Integrity and Efficiency
(CIGIE).
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
3
Background
2 For example, at least 60 percent of the loan amount must be for payroll expenses and the remaining balance on mortgage interest,
rent, utilities, and other eligible expenses.
On March 27, 2020, the President signed the
Coronavirus Aid, Relief and Economic Security
(CARES) Act to provide immediate economic
and health care assistance to individuals,
families, and businesses affected by the
coronavirus (COVID-19) pandemic. Among other
relief measures, the CARES Act created the PPP
to support small businesses. Amid the urgency
to help adversely affected small businesses, the
SBA launched the program a week later with
limited safeguards.
PPP loans, which were made by private lenders
but fully guaranteed by the SBA, paid up to
eight weeks of payroll costs, including benefits
and other operating expenses to certain
eligible businesses, individuals, and non-profit
organizations. PPP loans are fully forgivable
(they do not have to be repaid) if certain
conditions are met.2
Among other things, eligible small businesses
had to be in operation on February 15, 2020,
attest to the accuracy of their self-reported
business information (such as their number of
employees and payroll costs) and certify that
they comply with a range of program terms (e.g.,
they had no disqualifying criminal histories,
they would use funds only for eligible business-
related expenses, and they were not debarred
from working with the federal government).
Demand for PPP loans led to the program
being reauthorized several times after its initial
launch in April 2020. As shown in Figure 1,
the $800 billion PPP ran intermittently in two
rounds from April 2020 to May 2021.
Figure 1. Timeline of Key PPP Origination and Extension Events
Source: PRAC’s analysis of COVID-19 legislation and SBA documents related to PPP
The PPP loan program is similar to the SBA’s
Express Loan Program and Preferred Lender
Program where underwriting is performed
by the SBA’s delegated lenders. Provisions
of the CARES Act and the SBA’s program
rules also waived or streamlined many of the
traditional requirements that lenders use to vet
borrowers. The CARES Act, for example, waived
requirements for lenders to conduct credit
checks on applicants and did not hold lenders
responsible for approving borrowers who did
not comply with program criteria if lenders
PPP Phase I and Phase II controls in effect
PPP Phase III
controls implemented
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Jan
Feb
Mar
Apr
May
2021
2020
CARES Act is passed
$349 billion
PPP Enhancement Act
$310 billion
Consolidated Appropriations Act
$147.5 billion
American
Rescue Plan
$7.25 billion
SBA PPP Program Round 1
$525 billion in approved loans
SBA PPP Program Round 2
$278 billion in approved loans
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
4
performed a “good-faith” review of borrowers’
eligible loan amount and need for the loan.
The SBA also allowed lenders to rely on
borrowers’ self-certifications to assess their PPP
eligibility, while requiring only a limited review of
borrowers’ underlying documentation.
The SBA, in conjunction with the U.S.
Department of the Treasury, approved a
nationwide network of more than 5,000
lenders, including about 800 new lenders,
to review PPP applications, assess borrowers’
eligibility, and decide on the suitability of
making a loan under delegated authority. PPP
lenders reviewed loans quickly, disbursing
more than 1.7 million loans totaling nearly
$343.3 billion in just 14 days after the SBA
launched the program. According to the SBA,
it “…processed 14 years’ worth of loans in the
first 14 days of the PPP program and reached
the smallest businesses with an average loan of
$101,000.”
The result of limited initial safeguards and
the rapid review of loan applications led to a
rash of improper payments and indications of
widespread fraud. The SBA effectively adopted
a “pay and chase” approach, using fraud
detection only after funds had been disbursed.
The SBA later added additional safeguards,
including proactive measures to identify fraud
before lenders approved a loan.
To put the alleged fraud in perspective, from
May 2020 to March 2021, the Government
Accountability Office (GAO) reported that the
Department of Justice (DOJ) publicly announced
charges, including bank fraud, wire fraud,
money laundering, or identity theft charges, in
134 fraud-related cases associated with PPP
loans. In January 2021, the SBA OIG reported
that nearly 55,000 PPP loans worth $7 billion
went to potentially ineligible businesses or
fraudulent recipients.
3 See Appendix C for more information on the PPP criminal cases that PRAC analyzed.
The PRAC analyzed 66 PPP fraud-related
criminal cases identified from public DOJ media
releases and obtained documentation from
the SBA and the Treasury relevant to SBA’s
antifraud controls and processes. See Appendix
C for details on the 66 PPP fraud cases, and
related information. The PRAC also analyzed
fraud risks identified by the SBA and its
oversight entities and fraud reports made to the
federal investigative community.3
The PPP fraud-related cases frequently involved
multiple fraud types used within a broader
scheme. Common fraud found in the schemes
included:
Misrepresenting Self-Certified Borrower
Information –100% of the cases the PRAC
reviewed included one or more false statements
on PPP loan applications that would have made
the applicant ineligible. Examples of false
statements included:
• misrepresenting the entity type (e.g. sole
proprietor, independent contractor)
• business address
• percentage ownership of business
• average monthly payroll and number of
employees
• number of employees
• whether the business was in operation on
February 15, 2020
• the use of funds
Submitting fake documents – 91% of the
cases included creating, forging, or altering
documents such as tax forms, payroll
information, and bank statements to support
PPP loan applications.
Submitting multiple fraudulent applications to
same or multiple lenders – 86% of the cases
included applicants who applied for multiple
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
5
PPP loans using different business names or
other false information to one or more lenders.
This also included applicants who circumvented
PPP program or cross-program eligibility
requirements (e.g., using a PPP and Economic
Injury Disaster Loan (EIDL) to get loans from
multiple SBA programs for the same purpose).
Creating fictious business and/or operating
history – 53% of the cases included applicants
who fabricated one or more businesses to make
it look like they were a legitimate business and
had been operating before February 15, 2020.
Stealing the identity of someone else (living
or deceased) and/or creating synthetic
identities –21% of the cases included
applicants who stole personal information of
4 Microfund loan companies offer fast cash (under $50,000) to small businesses simple and quick within a quick turnaround (e.g., 24
hours) using automated platforms. For example, WebBank funds through PayPal.
5 FinTechs, brought on as a new type of SBA lender for PPP only, opened the door for many borrowers who did not want to apply for a
PPP loan through traditional banks and focused on digital lending through automated online platforms to process loans quickly. Fin
Techs have fewer regulations than federal lenders such as banks that are more regulated.
individuals known or unknown to them without
the identified victim being aware. This also
includes applicants who combined fabricated
credentials, e.g., social security numbers (SSNs)
with accompanying false Personally Identifiable
Information (PII), where the implied identity is
not associated with a real person.
The fraud found in the 66 PPP criminal cases
involved traditional banks, non-banks and/
or non-insured lenders, including Microfund
loan companies4 and FinTechs.5 The top
lenders in the reviewed cases were: Celtic Bank
Corporation (24%), Cross River Bank (21%),
Bank of America (20%), Customers Bank (15%),
Kabbage (15%), WebBank (8%), and Harvest
Small Business (8%).
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
6
The SBA’s Phase III Controls Still Allow Some of the Same PPP
Fraud Schemes to Go Undetected
6 Due to the investigation process, there is a lag before criminal cases can be publicized.
The effectiveness of the design and
implementation of fraud controls in any program
is dependent on the control environment in
which they will operate. For example, the fraud
controls for EIDL (a direct lending program)
will not be the same for PPP (a third-party
lending program). The key in designing and
implementing controls is managing and
mitigating fraud risks. SBA Inspector General
Hannibal “Mike” Ware testified on January 12,
2022, that he “believe(s) that SBA’s programs
have more integrity in them than they did at
the onset...[however], fraudsters are going to
do what fraudsters do, so there will be a risk
of fraud to any program. [The OIG’s] role is to
make sure that the risk of fraud is mitigated to
the lowest level possible.” When asked about
fraud controls, Inspector General Ware testified,
“I’ve advocated from the very beginning that
certain controls need to be in place before any
program is started. I said that before PPP was
rolled out, before COVID EIDL was rolled out.”
In 2020, the PPP and EIDL programs were
designed to expeditiously distribute funds, and
most of the fraud and eligibility controls in PPP
were not designed to occur at loan initiation but
at loan forgiveness.
The SBA added additional upfront controls
to screen all 2021 PPP loans in advance of
a lender’s loan origination and the SBA’s
issuance of a loan number. However, as
Inspector General Ware testified on January 12,
2022, “I still think we’re going to see where the
rubber meets the road on a lot of these that
don’t come back for loan forgiveness, because
the numbers are large.”
Despite the SBA adding up-front antifraud
controls in 2021, which were designed to
mitigate some of the earlier fraud, the controls
would not have likely detected some of the PPP
fraud found in 2020 criminal cases. Residual
fraud risks remain, allowing some of the same
fraud schemes to go undetected today.6 For
example, in August 2021 the DOJ announced
a fraud scheme where a District of Columbia
resident allegedly filed at least 13 fraudulent
PPP loan applications and one EIDL application
from July 2020 to July 2021 in the name
of his company using doctored tax returns.
The criminal complaint alleges the individual
fraudulently obtained more than $2.3 million
PPP and EIDL funds and, before being caught
by law enforcement, had attempted to steal
more than $17 million in PPP and EIDL funds.
In another case, in December 2021 the
DOJ announced a fraud scheme where two
individuals from New York tried to fraudulently
obtain approximately $7.5 million in PPP and
EIDL funds. From August 2020 through October
2021, these individuals applied for numerous
PPP and EIDL loans, and falsely represented
that they operated several companies,
used stolen identities of third parties, and
submitted fake tax documents. The individuals
successfully obtained more than $1 million as
result of the scheme.
Additionally, although the SBA indicated it had
designed the RRF program to address PPP
control weaknesses identified in 2020, fraud-
related cases are beginning to surface in the
RRF program. For example, on December 15,
2021, the DOJ announced a fraud scheme
where an individual after being rejected
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
7
by SBA for several fraudulent EIDL loan
applications, submitted three RRF applications
in May 2021 for restaurants allegedly located
Sarasota, Miami, and Daytona Beach, Florida.
Like the fraudulent EIDL applications, the
RRF applications contained false business
information and use of personal residence as
the business mailing address on all of three
applications. The RRF applications generated
$8M in payouts.
A key underlying factor contributing to the
control gaps in the SBA’s antifraud controls
is the lack of a formal fraud risk assessment
during the design and implementation of the
Phase III controls. A fraud risk assessment
helps agencies combat fraud in a strategic,
7 A borrower can apply for PPP forgiveness once all loan proceeds for which the borrower is requesting forgiveness have been used.
Borrowers can apply for forgiveness any time up to the maturity date of the loan. If borrowers do not apply for forgiveness within 10
months after the last day of the covered period, then PPP loan payments are no longer deferred, and borrowers will begin making loan
payments to their PPP lender.
risk-based way and provides a foundation or
framework for designing and implementing
controls to prevent, detect, and respond to
fraud. Having a sound foundation in place
can help agencies respond to and prepare for
known and emerging risks, such as a pandemic
or other emergency crisis.
Although the PPP ended on May 31, 2021,
existing borrowers may apply for loan
forgiveness. Consideration of the control
gaps discussed below may help mitigate
fraud and improper payments during the loan
forgiveness process, and in other SBA existing
loan programs (e.g., EIDL), as well as future
programs.7
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
8
SBA’s 2021 PPP Safeguards
8 The BSA is primarily concerned with preventing money laundering, although it has been amended over the years by legislation such
as the Patriot Act, which expanded its scope to include terrorist financing activities.
As mentioned earlier, the SBA launched the
PPP with limited safeguards (see Appendix
B for a complete list of SBA’s Phases I and II
controls and loan review process). The SBA
added additional upfront controls to screen all
2021 PPP loans in advance of a lender’s loan
origination and the SBA’s issuance of a loan
number.
Figure 2: SBA Processing of PPP Loans with 2021 Phase III Controls
Source: PRAC analysis of SBA documentation of 2021 Phase III controls and review process.
Below is a complete list of the SBA’s 2021 PPP
antifraud controls used in Phase III, beginning
in January 2021:
Approved PPP Lender List – The SBA had the
ability to block lenders it deemed as posing
a heightened risk from approving PPP loans.
Under the CARES Act, the SBA automatically
approved lenders to make PPP loans if they
were already approved for the 7(a) loan
program. The CARES Act also permitted the
SBA and the Treasury to approve the use of
additional qualified lenders to process, close,
disburse, and service PPP loans. The screening
process, among other conditions, entailed
verifying lenders’ attestation that they would
apply Bank Secrecy Act (BSA) requirements
in making PPP loans.8 Additionally, the SBA
required that entities not presently subject to
the requirements of the BSA, prior to engaging
in PPP lending activities, including making
loans to either new or existing customers
Lender disburses
loan to business
Applicant
applies with
self-certified
information
Lender reviews
applications
(applies KYC/BSA)
Lenders use new PPP
platform with 89 checks
for real-time data errors
or suspect information
SBA screens loans with
12 fraud detection rules
in E-TRAN. Performs one
final duplication check*
*Not all applications were
subject to all 12 rules
SBA issues loan
number
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
9
who are eligible under PPP, establish an Anti-
Money Laundering (AML) compliance program
equivalent to that of a comparable federally
regulated institution.9
In early 2021, reforms were made to the
PPP to ensure small businesses and non-
profits in underserved communities could
access loans. This included expanding PPP
lending at Community Development Financial
Institutions (CDFIs), credit unions, Farm Credit
System institutions, and other depository or
non-depository lenders that met the same
criteria such as Microfund loan companies and
FinTechs.10
Know Your Customer (KYC) Rules – Among
other rules, the BSA requires federally regulated
lenders to deliver on two KYC requirements:
a Customer Identification Program (CIP) and
Customer Due Diligence (CDD). For example,
the SBA required PPP lenders to verify the
identity of the borrower and the business by
confirming the taxpayer identification number
(TIN), legal name of the business, and the
business address.
The SBA told us the more rigorously that PPP
lenders applied KYC requirements, the more
likely that individual loan fraud issues, like
identity theft, would be identified.
Review of Loans Equal to or Over $2 Million –
The SBA used a Loan Necessity Questionnaire
to review all loans of $2 million or more to
9 At a minimum, an AML compliance program must be in writing and must include appropriate risk-based procedures for conducting
customer due diligence including, but not limited to, developing a customer risk profile; and conducting ongoing monitoring to detect
and report suspicious transactions and on a risk basis to maintain and update customer information including identifying and verifying
beneficial owners.
10 According to a December 2021 fraud risk assessment conducted by the SBA’s contractor, Kabbage—a Fintech business lender—pro
cessed more fraudulent loans and was second only after Bank of America in approving loans. Mostly, these loans went to fake farms
listed under people whose identities had been stolen.
11 An API enables companies to open-up their applications’ data and functionality to external third-party developers, business partners,
and internal departments within their companies. This allows services and products to communicate with each other and leverage each
other’s data and functionality through a documented interface. The PRAC did not review or assess third-party systems or datasets that
PPP lenders used to verify borrower loan information.
assess the borrower’s good-faith certification
that the current economic condition made their
loan request necessary.
Portal Controls – The SBA rolled out a new PPP
loan origination platform in 2021, embedding
89 digital application checks via an Application
Programming Interface (API)11 to notify lenders
in real-time through a common data interface
of data errors or suspect information (via
compliance error messages or hold codes)
as they entered borrowers’ certifications and
details from the SBA borrower application form
into the new loan submission platform.
Lenders also could submit loans to the SBA
for processing through a User Interface (UI).
According to the SBA, the API and UI used the
exact same logic, controls, and enforcement
methods regarding how error messages or
other methods operate. The SBA also permitted
lenders to use their own on-line systems and an
electronic form they created to collect the same
information and certification as in the SBA
borrower application. In these cases, the SBA
told the PRAC that lenders would need to send
the loan application through the UI.
E-TRAN (SBA’s loan system of record)/12
Front-End Compliance Checks – Beginning
in 2021, the SBA conducted one last fraud
check to identify any duplicate and/or potential
suspicious loans prior to disbursement
and issuance of a loan number in its
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
10
E-TRAN system.12 The agency ran all PPP
loan applications through E-TRAN for loan
decisioning, but not all loans were subject
to the full set of 12 front-end checks.13 For
example, individuals who applied under certain
business entity types were not screened against
four rules: “Inactive Business,” “Mismatch of
TIN,” Mismatch of Entity Name,” and “Entity
in Operation after February 15, 2020.” As a
compensating control, the agency also received
alerts from the SBA OIG regarding certain
borrowers under investigation, which would
then stop the application from being processed.
In November 2021, the SBA independent
auditor reported material weaknesses in
12 SBA told the PRAC that its E-TRAN system included alerts and suspicious EINs from investigative cases on SBA’s EIDL loans. Such
information could be used to cross-check PPP loan applicant data.
13 All 2021 loans were checked against 9 rules: “Criminal Record,” “Bankruptcy,” “OFAC,” “Potential Decedent Application,” “Mismatch
of Entity,” “Large number of Employees at Residential Business Address,” and three datasets from Treasury’s DNP lists.
internal controls over the approval of 2021
PPP loans. For example, as of September 30,
2021, the auditor reported that over 27,000
PPP loans by third-party lenders worth $488
million were flagged by management because
they did not conform with the CARES Act and
related legislation. Additionally, the report
stated that the SBA did not ensure the 2021
loan applications met select program eligibility
criteria. The SBA did not verify all validation
checks available from its automated screening
process and did not perform a sufficient review
of loan applications it flagged to ensure that
lenders followed established procedures.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
11
PPP Fraud and Control Gaps
Although the SBA added additional controls in
2021, the following section shows how these
controls would not have prevented the most
common fraud schemes that were found in the
66 PPP criminal cases (in which all loans were
issued in 2020).
1. Falsifying Documents and/or
Misrepresenting Borrower Self-Certifications
These two fraud types were the most prevalent
in the criminal cases. As previously mentioned,
in 91% of the reviewed cases applicants
created, forged, or altered supporting
documentation (e.g., IRS forms, payroll
information, and bank statements). In 100%
of cases, applicants misrepresented self-
certifications on their PPP application.
The loan origination process was heavily
reliant on lenders to verify the authenticity
and accuracy of borrower information and
as discussed earlier, required only a limited
review of underlying documentation. We found
that several of the earlier PPP fraud would
likely only be caught by this control. In cases
where lenders failed to apply proper customer
due diligence, even with the SBA’s additional
program safeguards in place, fraudulent
applications including fake documents
and borrower misrepresentations could be
approved.
Would SBA’s Phase III Controls Have Likely
Detected this Fraud?
Apart from relying on PPP lenders to conduct
due diligence to collect sufficient borrower
information and verify self-certifications, the
SBA did not have a specific control to detect
fake documents. The agency was largely
dependent on the borrower’s application having
a different anomaly, which could then trigger
a hold code or compliance error, which could
then result in a manual review by the SBA or the
lender to resolve where such fake documents
may be uncovered. To detect borrower
misrepresentations, the SBA’s controls included
In a case from the Northern District of Texas,
an individual submitted 15 fraudulent PPP
applications to eight different lenders in his
name and others over the course of four
months in 2020. The fraudulent applications
included 11 businesses, five of which
were created after February 15, 2020—an
ineligibility for the PPP. The individual had
previously been charged with two felonies,
both of which were pending—another PPP
ineligibility. In the fraudulent PPP applications,
the individual submitted false tax documents
and bank statements claiming the businesses
had numerous employees and hundreds of
thousands in payroll expenses. In actuality,
the businesses did not have any employees
or pay any wages. Additionally, the individual
listed other people as the entities’ authorized
representatives without the knowledge of such
individuals. The individual received more than
$17 million in PPP loans.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
12
E-TRAN system checks, such as the Treasury Do
Not Pay system14 and LexisNexis (a service that
enables review of legal documents).
Control gaps:
Finding instances of fake documents and/
or borrower misrepresentations in the PPP
application process relies on incorporating
technology systems and due diligence in
the loan origination process. For example,
automating a control in the PPP Platform to
independently verify borrower tax information
may have addressed some of the fraud and
related schemes. To do this, the SBA needed
access to IRS tax information to verify payroll
expenses, entity type, payroll calculations,
eligible loan value amount, business operating
date, and corporate and/or affiliation
structures.
Although the IRS is prohibited by law from
sharing this information, the SBA can obtain
such data through a borrower consent form
(Form 4506-T). In fact, in April 2021, the SBA
began collecting tax return transcripts to
improve eligibility determinations in its EIDL
program. The SBA incorporated up-front controls
and validation flags in the application intake
tier of its EIDL platform. This now allows SBA to
confirm when the business went into operation,
entity type, eligible loan value amount, and
revenue/cost of goods sold.15 Although the PPP
loan application period ended, the SBA could
14 The Department of the Treasury’s Do Not Pay (DNP) Business Center enables federal agencies to check multiple data sources to
verify a recipient’s eligibility to receive federal payments. The SBA OIG used the DNP service and found that 57,473 PPP loans worth
$3.6 billion were issued to potentially ineligible recipients.
15 The PRAC did not verify or assess the design or implementation of the up-front controls.
16 The fraud cases reviewed involved borrowers who laundered or transferred PPP loan proceeds between various bank accounts at
different financial institutions, including accounts in Pakistan, and used the funds for personal gain such as luxury purchases (e.g.,
Lamborghini, gambling excursions) or investments (e.g., stock, cryptocurrency account).
17 In 2021, lenders made the decision to leave certain loans as “Active Undisbursed” to prevent an applicant from being able to apply
at another lender. If the lender cancelled a loan that they determined to be fraudulent, the applicant would have been able to apply at
another lender. “Active Undisbursed” is the status initially assigned to the loan guaranty at approval time. The guaranty is approved but
the lender has not reported that the loan has been disbursed. Lenders do not receive their processing fees until they report the loan
has been fully disbursed.
18 According to the Interim Final Rule (IFR), “The lender must make a one-time, full disbursement of the PPP loan within ten calendar
days of loan approval; for the purposes of this rule, a loan is considered approved when the loan is assigned a loan number by SBA.”
still request this information as borrowers apply
for PPP loan forgiveness.
Additionally, finding instances of applicants
misusing or diverting loan proceeds for
ineligible expenses requires due diligence at the
front-end to avoid a costly and inefficient “pay
and chase” pattern. In 80% of the 66 fraud-
related cases reviewed, applicants misused or
laundered the funds for ineligible expenses.16
Based on our review of the criminal cases,
we identified several instances where
lenders detected or froze the funds before
disbursement.17 Apart from relying on lenders to
conduct due diligence at loan origination and/
or receiving a referral from the SBA OIG or other
alerts, the SBA did not have a specific antifraud
control to detect misuse of funds and to help
identify potentially suspicious transactions prior
to disbursing loan proceeds.18
Below are examples of mitigating controls
to address the vulnerability of PPP payment
integrity issues relevant to misuse and diversion
of funds.
The SBA had the ability to review loan history or
previous flags to deter and detect fraud through
public screening tools (e.g. the DNP system
and LexisNexis) to validate business data prior
to approving the loan. However, absent the
collection of IRS tax data, conducting real-
time sampling of loan applications to detect
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
13
and deter improper payments prior to the
disbursement of funds could have served as an
effective control to hold lenders accountable
to complying with the SBA’s loan servicing
requirements.
The SBA also did not implement antifraud
controls in the PPP loan origination process
to lock bank account changes after lender
verification and track and share potentially
fraudulent applicants in real-time across
lenders as an early warning system of
possible sources or patterns of larger fraud
schemes. Also, the SBA did not run a credit
check on applicants before disbursing the
funds. Although the CARES Act waived this
requirement, the SBA may have been able to
get an exception to this for new lenders or high-
risk lenders.
2. Submitting Multiple Fraudulent
Applications to the Same or Multiple Lenders
In 86% of the criminal cases, applicants
submitted multiple applications to the same
or multiple lenders. In some instances,
applications contained the same borrower
information in multiple applications; and
other applications used different business
names, phone numbers, addresses, or other
information.
Applicants engaged in submitting multiple
fraudulent applications were also generally
involved in large, complex organized fraud
schemes, often in combination with other
individuals, and sometimes involved
circumventing affiliation rules. For example,
applicants could submit their parent company
information to one or more lenders and their
subsidiary company information to one or more
lenders to appear as independent entities,
although they are not. This was done in order
to obtain multiple loans despite the overlap
between them.
Would SBA’s Phase III Controls Have Likely
Detected this Fraud?
The SBA had implemented several data
matching features into its upfront controls to
identify duplicate applications—an SBA OIG
recommendation. For example, a front-end
system error on the PPP submission platform
warns lenders that prospective applicants
already match the names and tax identifiers of
previously approved applicants.
The SBA also added a hold code “Potential
affiliation issue” that, if flagged, required the
SBA to resolve. Additionally, the SBA does one
last check in E-TRAN prior to issuing a loan
An owner of a Florida talent management
company and eight individuals co-conspired
and recruited others through a network of
business contacts to file fraudulent PPP
applications (at least 90 in total) through
multiple lenders to receive kickbacks. Six
were charged in this scheme by the Northern
District of Ohio and three others by the
Southern District of Florida. The scheme
began with one individual successfully
obtaining a fraudulent PPP loan. Following
this success, individuals began obtaining
additional and larger PPP loans through
recruits using fake payroll numbers, falsified
IRS documents, edited versions of bank
statements and counterfeit checks. In one
application, one of the individuals obtained
a loan for his company through a bank
in New Jersey, facilitated by a financial
services company in the same state. The
application directed the loan proceeds to
be remitted/wired to the applicants’ bank in
Ohio, but this bank account was not stated
in the application. Collectively these eight
individuals obtained at least $17.4 million.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
14
number to ensure no duplicates among its
searches.
Control Gaps:
Due to the complexity of the schemes
associated with multiple fraudulent
applications, limited lender review
requirements, and the lenders’ ability to resolve
hold codes without the SBA review, additional
up-front controls would have helped further
mitigate the risk of this type of fraud going
undetected. As an example, under the lender
certification process, lenders had the ability to
resolve hold codes and compliance check error
messages for two primary API triggers:
• “Applicant Tax ID Discrepancy/Mismatch of
TIN (EIN/SSN)”
• “Applicant Name Discrepancy/Mismatch of
Entity Name (Individual or Company)”
Below are some examples of control gaps
related to this fraud type. The SBA did not:
• Require lenders to enter the applicants’
affiliates, as applicable, in the SBA PPP
Platform so that the API could have then
cross-checked the affiliates with other
downstream screening systems prior to
disbursement.19
• Track loans that PPP lenders denied and
the reasons for denials, such as denied
for “EIN not eligible” and embed an alert
system into the PPP platform to notify
lenders that another lender determined the
borrower as ineligible or suspected fraud.
• Collect information on the loans which
lenders have internally flagged as ineligible
or fraudulent, and incorporate hold codes
to allow other lenders to review these
19 If the applicant checked the affiliation box “No” on the PPP application, there was no further review.
20 The set of rules governing the format of data sent via the internet or local network. An IP address is a unique address that identifies
a device on the internet or a local network.
flagged applications more carefully, could
reduce instances of applicants’ “shopping”
for weaker internal controls among lenders.
This approach may have allowed lenders
with less sophisticated fraud detection
controls to leverage the more effective
controls of other SBA lenders.
• Obtain Internet weblogs to track the
Internet Protocol (IP)20 or internet address
of where borrowers submit applications.
For example, in one PPP criminal case,
four individuals conspired to submit 16
fraudulent PPP applications, totaling
$3.1M, by providing false employee and
wage information, false EINs to make it
appear the business was formed prior
to February 15, 2020, and fake bank
statements. Some of the applications came
from the same IP address for different
businesses. The criminals used the
proceeds to purchase luxury items.
3. Creating Fictious Business / Operating
History
The PRAC’s review of PPP criminal cases
identified that in 53% of the criminal cases,
applicants created fraudulent applications by
fabricating fictious businesses and/or shell
companies, claiming to have employees and an
operating history when in fact no business or
employees exist. For example, in some cases
applicants applied for an EIN in the name of
a fictious and/or shell company and/or a non-
existent company after February 15, 2020,
and then falsely represented a business and
altered documentation to reflect the EIN as
obtained prior to the operating eligibility date.
To carry out this scheme, some applicants
forged documents, used stolen identities or
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
15
created synthetic identities21, and co-conspired
with family or business associates or recruited
third parties to apply for PPP loans to receive
kickbacks or a share of the proceeds.
Would SBA’s Phase III Controls Have Likely
Detected this Fraud?
SBA had implemented several hold codes
and up-front compliance checks that could
flag loans that appeared to be circumventing
eligibility requirements and/or had attributes
related to this fraud risk area. Lenders could
resolve the following hold codes under the
lender certification process without the SBA’s
review:
• Discrepancy/Mismatch of TIN (EIN/SSN)22
• Dormant Business Identified/Inactive
Business
21 A synthetic identity is a combination of fabricated credentials where the implied identity is not associated with a real person. Fraud
sters may create synthetic identities using potentially valid SSNs with accompanying false PII.
22 SBA officials told the PRAC that SBA had been working through a data exchange MOU with the IRS since last year to gain access to
such data. According to an SBA official, SBA may have also requested EIN registration data for its RRF program.
23 The SBA, in consultation with the Treasury, issued guidance in 2020 and 2021 in the form of 26 Frequently Asked Questions (FAQs)
to borrowers and lenders to address questions concerning the PPP, as of June 1, 2021. According to the FAQs, borrowers and lenders
may rely on the guidance as the SBA’s interpretation of the CARES Act and the PPP Interim Final Rules. SBA also issued 30 IFRs and
several procedural notices to lenders, as of June 1, 2021. These documents served as guidance to lenders and notices of program
eligibility changes.
• Applicant Name Discrepancy/Mismatch of
Entity Name (Individual or Company)
• Business In Operation after February 15,
2020
• Large Number of Employees at Residential
Location/Large Number of Employees at
Residential Business Address
• DNP Lists
The following hold codes required the SBA’s
review:
• Business address is currently vacant
• Business debarred, defaulted loan in last 7
years
Resolving hold codes and compliance checks,
however, were highly dependent on secondary
reviews by lenders and/or the SBA to verify
borrower self-certifications. On February 10,
2021, the SBA issued initial guidance to lenders
on documentation requirements. In response
to questions raised by lenders, the SBA issued
revised guidance on March 29, 2021.
The following section highlights examples of
the guidance the SBA gave to lenders through
Frequently Asked Questions (FAQs) and
procedural notices with respect to borrower self-
certifications. 23
Payroll cost calculations:
“Providing an accurate calculation of payroll
costs is the responsibility of the borrower on
the Borrower Application Form.…Lenders are
expected to perform a good faith review, in a
reasonable time, of the borrower’s calculations
and supporting documents concerning average
In a case in the Eastern District of Texas,
an individual filed two fraudulent PPP
applications to two different lenders for
the same business. The company while
incorporated in November 2011 had
forfeited its existence in 2018 due to a
failure to file a state franchise tax return
and/or pay state franchise taxes. However,
the individual submitted documentation to
make it appear that the business had been
in operation after the forfeiture. Ultimately,
one of the two applications was approved,
and the individual received over $1.5 million
in fraudulent PPP loans.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
16
monthly payroll costs. For example, minimal
review of calculations based on a payroll report
by a recognized third-party payroll processor
would be reasonable. In addition…lenders may
rely on borrower representations, including with
respect to amounts required to be excluded
form payroll costs.”
Affiliation Rules: The SBA does not require
lenders to make an independent determination
regarding applicability of affiliation rules.
According to the SBA:
“It is the responsibility of the borrower to
determine which entities (if any) are its affiliates
and determine the employee headcount of
the borrower and its affiliates. Lenders are
permitted to rely on borrowers’ certifications.”
E-TRAN may have also detected an anomaly or
suspicious EIN with its third-party data provider,
LexisNexis or in other datasets.
Control Gaps:
In addition to implementing an automated
control to independently verify borrower tax
information, as discussed above, the SBA may
have benefitted from live sampling of higher risk
lenders, particularly those new to SBA lending.
The SBA’s access to EIN registration data is
limited.24 The SBA told the PRAC that as part of
its final fraud-dispositioning in its EIDL program,
all applications are run against a master list of
EINs from hotline complaints and investigations
in E-TRAN that have been flagged as barred or
suspicious. The SBA should continue to work
with the IRS to access EIN registration data.
24 SBA officials told the PRAC they had been working through a data exchange MOU with the IRS since last year to gain access to such
data. According to an SBA official, the agency may have also requested EIN registration data for its RRF program.
25 The percentage of cases involving identity theft may potentially increase in 2021 given the expansion of new lenders brought on
who had no prior business with SBA programs or customers.
26 According to SBA officials, SBA engaged with Treasury around the September/October 2020 timeframe to gain direct access to data
sources on the DNP list but were unable to do so until March 2021 when Treasury issued its revised Computer Matching Agreement
(CMA). From January to March 2021, SBA provided loans daily to Treasury to verify borrowers on DNP lists.
4. Fraud: Identity Theft/Synthetic Identities
Of the 66 fraud cases reviewed, 21% involved
applicants who used the personal or business
information of persons known or unknown
to them, and/or alive or deceased to obtain
one or more PPP loans.25 This could include
an applicant falsely claiming ownership of an
existing business or stealing another’s identity
and registering a legal business in addition
to other criminal activities involving identity
deception. Creating synthetic identities includes
applicants who combined real and fake
personal information where the implied identity
is not associated with a real person.
Would SBA’s Phase III Controls Have Likely
Detected this Fraud?
The SBA’s access to DNP datasets (e.g., death
sources) helped mitigate this fraud risk.26
However, the controls were less likely to catch
In a case from the District of Rhode Island,
two individuals devised a scheme to create
fraudulent PPP loan applications and
supporting documentation for four different
restaurants, one of which was not open
prior to February 15, 2020, or anytime
thereafter. One of the individuals did not own
or have any role in the second restaurant
and misrepresented his brother as having
business ownership—a repeat offense from
an unrelated fraud scheme. This individual
submitted his brother’s social security
number on behalf of two of the restaurants
without his consent.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
17
other cases of identity theft and synthetic
identity theft involving different fraud elements.
Control Gaps:
Below are some examples of control gaps
related to stealing identities and creating
synthetic identities. As discussed earlier, SBA
did not:
• Issue credit report statements to borrowers
• Obtain Internet weblogs to track IP and
email addresses
• Track denied PPP loans and the reasons for
denials
Additionally, although 7(a) lenders were
required to report suspicious activity to the
SBA OIG under the existing terms of the 7(a)
program, it was not until July 2021 that the SBA
asked all participating PPP lenders to report
suspected application fraud to the SBA OIG and
to its Office of Credit Risk Management. Having
this information sooner may have allowed the
SBA to modify thresholds in their up-front loan
submission process. If not already being done,
the SBA should use the information for the PPP
loan forgiveness process.
Identity theft is a high priority for the PRAC
across all COVID-19 pandemic programs.
Numerous reports and media releases by
civil society and other non-governmental and
independent watchdog organizations have also
issued reports studies involving PPP identity
theft. For example, in 2020, the Federal Bureau
of Investigation’s Internet Crime Complaint
Center reported receiving thousands of
complaints regarding emerging financial crime
revolving around CARES Act stimulus funds,
including PPP.
Providing a way for victims of identity theft
to easily report misconduct, via an online
customer service process, is an important tool
in the detection system.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
18
Importance of a Fraud Risk Assessment in Designing and Implementing Controls
27 In March 2021, GAO reported that SBA did not conduct a comprehensive fraud risk assessment for its COVID-19 pandemic pro
grams, including PPP, and did not document its antifraud strategy for PPP which would outline a strategic approach to managing fraud
risks. On December 10, 2021, the SBA provided the PRAC a Fraud Risk Assessment Summary report and assessment details that one
of its contractors issued to the SBA.
The SBA has made considerable progress in
adding the up-front antifraud controls for the
2021 PPP loans. However, the SBA’s reticence
to conduct a formal fraud risk assessment for
PPP calls into question the SBA’s continual
commitment to an antifraud tone and a stop to
the “pay and chase” model found in the 2020
PPP criminal cases. The SBA’s design and
implementation of its Phase III controls would
have significantly benefitted from a formal fraud
risk assessment prior to the re-launch of PPP
in January 2021. The PRAC found that a key
underlying factor contributing to the control
gaps in SBA’s PPP Phase III antifraud controls
was the lack of a formal fraud risk assessment.
A fraud risk assessment helps agencies combat
fraud in a strategic, risk-based way with:
• a continual commitment to creating a
culture to fraud risk management,
• ongoing assessment and monitoring of
fraud risks to determine a fraud risk profile,
• designing and implementing a strategy
with specific control activities to mitigate
assessed fraud, and
• evaluating and adapting fraud risk
activities as changes to the program may
evolve.
Commitment to Creating a Culture of Fraud Risk
Management
Best practices call for sound fraud risk
management practices and due diligence in
fraud prevention, detection, and response to
mitigate the risk of fraud, waste, and abuse.
On December 9, 2021, the SBA approved
a Fraud Risk Assessment Summary Report
and assessment workbook that its contractor
had developed, dated October 29, 2021, for
its PPP and EIDL programs—an open GAO
recommendation. Among other things, the
fraud risk assessment identified high, medium,
and low fraud risks within the PPP and EIDL
programs, including some risks that are the
result of technology gaps, internal control
weaknesses, and/or lack of compliance with
requirements. The SBA’s contractor made
recommendations, several of which reinforce
the GAO’s prior recommendation related to
documenting an antifraud strategy for the PPP
which would outline a strategic approach to
managing fraud risks.27
Additionally, on November 15, 2021, the
SBA’s independent auditor reported that SBA
did not adequately document the internal
control system and processes related to the
implementation of new programs, including
RRF, and did not implement an effective risk
assessment process for PPP loan guarantees.
For example, the 2021 PPP loan guarantees
were subject to a limited set of validation
checks as compared to the 2020 PPP loan
guarantees without a documented risk
assessment determining the rationale for why a
lower response was necessary.
Ongoing Assessment and Monitoring
With respect to ongoing assessment and
monitoring, the SBA told the PRAC that it did not
monitor PPP lenders on the approved lender list
during loan origination. In July 2021, the agency
was in the process of developing aspects of its
lender oversight plans but provided the PRAC
an overview document which appeared to
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
19
focus largely on the aggregate risk of the PPP
portfolio at loan forgiveness. The SBA began
an aggregate review process to identify trends
within and across lenders in March 2021.
The PRAC believes on-site lender and servicer
reviews should not wait until after the loan is
approved and disbursed. Also, criminals who
received loan proceeds and have not been
caught may never apply for forgiveness. Without
monitoring lenders, there is no assurance
lenders conducted adequate customer due
diligence. The SBA would need to conduct an
extensive post-audit on at least the high-risk
lenders to assess whether the lender conducted
a “good faith” review of the applicant and was
eligible to receive the processing fee. If not, the
SBA should recoup the fees.
Designing and Implementing a Strategy with
Specific Control Activities to Mitigate Fraud
According to the SBA, during the retrospective
review of the 2020 loans, its contractor had
identified some fraud risks and challenges, and
corresponding mitigation strategies/residual
risks. While not a formal fraud risk assessment,
taking a step further to map the fraud risks
to specific control activities (i.e., to the Phase
28 In July 2021, the PRAC requested the SBA provide documentation detailing its manual review process. As of December 10, 2021,
the manual review process is still undergoing review and has not yet been released to the PRAC.
III controls) may have helped mitigate the
assessed fraud and inform rule development.
For example, according to the SBA, it did not
adapt the results of manual reviews over time
to edit rules or tune thresholds partly due to
concerns related to statutory timeframes for
forgiveness. Instead, SBA tailored the manual
review process to mitigate the risks of any loans
reviewed that triggered an alert or flag.28
Evaluating and Adapting Fraud Risk Activities
as Changes to the Program Evolve
Lastly, given the evolving set of PPP program
changes, using analysis of identified fraud
and fraud trends, conducting continuous
monitoring, and communicating results
across lenders could have served as an early
warning system to help modify existing fraud
controls and thresholds and respond quickly to
emerging risks, thus minimizing the impact of
fraud. Without a rigorous fraud risk framework
already in place, keeping pace with the evolving
program changes would have been challenging
for SBA to adapt and respond to new and
emerging risks and assess whether they
necessitate additional controls.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
20
Appendix A: Scope and Methodology
The objective of this limited scope evaluation
was to examine whether the SBA’s Phase III PPP
controls, those in place for the 2021 loans (and
purportedly being applied in SBA’s Restaurant
Revitalization Fund (RRF) program), would
have likely detected the fraud that has been
identified in PPP criminal cases.
The scope of our review of PPP fraud included
a review of 66 publicly released DOJ) PPP
cases from May 2020 to December 2020
and associated court documents to identify
the fraud schemes that resulted in criminal
charges, then an assessment of the Phase III
controls that the SBA put into place in 2021
to determine whether they would have likely
detected the fraud that occurred and not
allowed the loan to be processed. Additionally,
we reviewed the SBA’s 2020 Phases I and
II controls to identify what changed and the
deficiencies the SBA addressed when it re-
launched the PPP in January 2021.
To assess whether the Phase III controls would
have likely detected the fraud that occurred,
we identified the top fraud schemes/fraud
types from the 66 cases and retrospectively
mapped the controls to the specific fraud to
identify any gaps in controls or residual fraud
risks. This assessment entailed conducting
multiple interviews with SBA officials, including
obtaining a limited walkthrough of the 2021
loan origination process, and obtaining several
documents and other information in response
to inquiries. We also conducted an interview
with Treasury officials as it relates to the SBA’s
access and use of the Do Not Pay system
and the approval of nonbank/non-federally
regulated lenders new to PPP.
Throughout the evaluation, we monitored 2021
PPP and RRF criminal cases to identify any
potential instances of alleged fraud continuing
to occur after the SBA implemented its 2021
safeguards.
Limitations
We obtained documentation from the SBA on
the controls they purportedly implemented or
planned to implement in the RRF, but due to the
limited scope evaluation, we did not conduct a
detailed review or assess their effectiveness.
Also given the limited scope, we did not assess
the integrity, accuracy, and/or availability of
SBA’s loan origination PPP platform or the
systems or databases that PPP lenders used to
verify borrowers’ self-reported loan information.
We did, however, obtain a subset of hold
codes from the loans associated with the 66
cases to obtain a general understanding of the
treatment of hold codes relevant to PPP loans
in 2021.
Any gaps in controls identified through the
limited testing, would only represent examples
of control weaknesses, and should not
be construed as pervasive or systemic
weaknesses.
Additionally, there were limitations in the
completeness and availability of data on
lenders associated with the 66 cases. Lender
information for many of the loans was not
always complete and/or available in the public
and non-public PPP data sources.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
21
Coordination
We coordinated with the SBA OIG prior to
announcing the evaluation to ensure their
ongoing work is safeguarded and deconflicted
from the PRAC reporting. We also coordinated
with the SBA OIG and the SBA on the status
of prior recommendations and findings
and with the GAO on prior related work and
recommendations.
The PRAC conducted this evaluation from
April 29, 2021, to December 31, 2021, in
accordance with the Quality Standards for
Inspection and Evaluation issued by the Council
of the Inspectors General on Integrity and
Efficiency (CIGIE).
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
22
Appendix B: SBA’s 2020 Loan Origination Process and
PPP Safeguards
29 SBA Express program features an accelerated turnaround time (within 36 hours) for SBA review.
The SBA leveraged the controls from its 7(a)
program to help design the controls for the
PPP. In the 7(a) program, the SBA relies on
the lender to know their customer and has an
underwriting role. Because the SBA had no
underwriting role in PPP, it structured the PPP
loan origination process most similarly to its
SBA Express loan program and Preferred Lender
Program, where underwriting is performed by
the SBA’s delegated lenders.29 According to the
SBA, it used these assumptions, in addition to
the temporary nature of the PPP with a high-
volume of loans and the statutory timeframe for
forgiveness, to design and implement antifraud
controls for the 2020 loans. Some of the
controls extended into 2021.
Figure 3: SBA Processing of PPP Loans with 2020 Controls (referred to as Phase I and II)
Source: PRAC analysis of SBA documentation of Phase I and II controls and process information
Below is a full list of SBA’s 2020 PPP (Phases I
and II) antifraud controls:
Approved PPP lender list and Lender KYC (as
discussed in Phase III controls)
E-TRAN Platform Updates – The SBA modified
controls (added and removed) to its existing
7(a) loan submission platform (E-TRAN),
including adding a feature to identify borrowers
with duplicate tax identifiers. SBA removed
controls to identify ownership and controlling
interest in a business. Notably, PPP disbursed
more than 4,200 loans to borrowers with the
same tax and business identifiers in early 2020,
despite this feature.
Lender disburses
loan to business
Applicant applies
with self-certified
information
Lender reviews
applications
(applies KYC/BSA)
SBA uses modified
version of E-TRAN to
screen loan
SBA issues loan
number
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
23
When it came time to begin forgiving loans, SBA
introduced several additional safeguards to its
2020 loan forgiveness process by instituting:
Automated Screening Rules – The SBA, in
conjunction with its contractor, retroactively
screened all 5.2 million loans that lenders
approved in 2020 against publicly available
information and 19 fraud detection rules that,
according to SBA documentation, resulted
in about 1.9 million “alerted loans.” Alerted
loans identified anomalies or attributes that
could indicate noncompliance with eligibility
requirements, fraud, or abuse. For example,
the automated screening tool flags loans made
to a borrower in active bankruptcy or who used
the TIN of a deceased person. Other screening
rules included:
• Criminal Record30
• Inactive Business
• Mismatch of TIN (EIN/SSN)
• Entity in Operation after February 15, 2020
• Large number of Employees at Residential
Business Address
• Maximum Loan Size (annual salary limit)
• Business address is currently vacant
(according to public record)
Aggregate Review – Used as an additional
screening process, the aggregate review was
intended to identify and analyze relationships
across loans, borrowers, and lenders to identify
potentially suspicious relationships and
activities. SBA’s contractor used a proprietary
rules-based script to analyze the PPP loan
portfolio.31
30 SBA revised its guidance on criminal records in June 2020 and again in March 2021, which impacted the parameters for mitigating
these rules.
31 As of December 10, 2021, the PRAC has not received details on SBA’s aggregate review process.
32 According to SBA’s independent auditors’ report on November 15, 2021, SBA did not demonstrate effective monitoring controls over
the results from its contractor involved in the 2020 PPP loan review process. Loans determined by the contractor as “No Further Action”
were not subsequently reviewed by SBA.
33 As reported by GAO, “according to SBA officials, as of March 2021, SBA was issuing loan numbers for more than 96 percent of new
loans within 48 hours of submission, and there were about 190,000 applications with outstanding hold codes.”
Manual Review of Loans Less Than $2 Million –
In addition to automated screening, using
internet searches and public data records to
check information contained in borrowers’
applications, SBA’s contractor manually
reviewed certain loans less than $2 million that
triggered an alert or flag to determine whether
the loan required referral to SBA for further
action. Manual review flag(s)/alert(s) included:
• Do Not Pay (DNP),
• Borrower or Lender is Involved in OIG
Investigation
• Duplicate TIN
• FBI - Identified as Fraudulent Tax
Batch-Dispositioning Loans as No Further
Action – In fall 2020, the SBA authorized its
contractor to develop a proprietary modeling
tool to expedite the manual review process
of the remaining alerted loans by batch-
dispositioning certain groups as “No Further
Action.”32
In addition, the SBA also manually reviewed the
loans “Requiring Further Action” as well as a
sample of loans under $2 million.
Hold Codes – The results of the automated
screenings and manual reviews yielded hold
codes on certain suspect 2020 PPP loans,
prohibiting borrowers for both loan forgiveness
and receiving additional PPP funds in 2021
until the hold codes were cleared. For example,
borrowers that submitted a Second Draw loan
application with a hold code or compliance error
from the 2020 screening process was put on
hold in 2021 until resolved.33
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
24
In December 2020, the SBA’s independent
financial statement auditor reported
deficiencies considered to be material
weaknesses in internal controls over financial
reporting as it relates to the approval and
reporting of PPP loan guarantees and entity
level controls, among others. For example, the
auditor reported that there were over 2 million
approved PPP loans with an approximate value
of $189 billion flagged by management for
one or more of 35 reasons (e.g., business in
operation after February 15, 2020, mismatch
of TIN/EIN/SSN, criminal record, mismatch of
individual or company entity name, aggregated
data mismatch, or inactive business). SBA
was unable to provide the auditor adequate
documentation to support a significant
number of transactions related to PPP due to
inadequate processes and controls.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
25
Appendix C: 66 DOJ PPP Fraud-Related Criminal Cases from May 2020 to
December 2020
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 1: Two Charged in Rhode Island with
Stimulus Fraud
Bank fraud, aggravated identity
theft
Case 2: Reality TV Personality Charged with
Bank Fraud
Bank fraud
Case 3: Engineer Charged in Texas with COVID-
Relief Fraud
Wire fraud, bank fraud, false
statements to a financial institution
and false statements to SBA
Case 4: Texas Man Charged with $5 Million
COVID-Relief Fraud
Wire fraud, bank fraud, false
statements to a financial institution
and false statements to SBA
Case 5: Software Engineer Charged in
Washington with COVID-Relief Fraud
Wire fraud, bank fraud
Case 6: Hollywood Executive Arrested
on Federal Fraud Charges that Allege He
Pocketed Money from COVID-19 Relief
Program
Wire fraud, bank fraud, making
false statements to a financial
institution, making false
statements to SBA.
Case 7: Arkansas Project Manager Charged in
Oklahoma with COVID-Relief Fraud
Wire fraud, bank fraud, making
false statements to a financial
institution, making false
statements to SBA.
Case 8: Illinois Business Owner Charged with
COVID-Relief Fraud
Bank fraud, making false
statements to a financial
institution.
Case 9: Federal Complaint Filed Against Austin
Man for Multi-Million Dollar Fraud Scheme
Related to the SBA Paycheck Protection
Program During COVID-19 Pandemic
Wire fraud, making false
statements to the SBA.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
26
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 10: Texas Man Charged with COVID-
Relief Fraud, False Statements and Money
Laundering
Wire fraud, false statements to a
bank, money laundering
Case 11: Ophthalmologist Previously Charged
With Healthcare Fraud Indicted For Defrauding
SBA Program Intended To Help Small
Businesses During COVID-19 Pandemic
Making false statements to a bank,
making false statements
Case 12: Houston man charged with COVID
relief fraud
Making false statements, bank
fraud, falsified own identity.
Case 13: Dayton business owner charged with
COVID-relief fraud
Bank fraud, making false
statements to a bank
Case 14: Seattle Doctor Charged with COVID
Relief Fraud
Wire fraud, bank fraud
Case 15: Two Utahns Charged With Covid-
Relief Fraud After Failing To Disclose Applicant
Was Under Federal Indictment
Conspiracy, removal of property to
prevent seizure, loan application
fraud, wire fraud, money laundering
Case 16: Madison Man Charged with CARES
Act Fraud
Wire fraud, money laundering
Case 17: Florida Man Charged with COVID
Relief Fraud and Health Care Fraud
Wire fraud, conspiracy to commit
health fraud, payment of health
care kickbacks, and making
false statements to a financial
institution.
Case 18: Another Houston man charged with
COVID relief fraud
Making false statements to a
financial institution, wire fraud,
bank fraud, and engaging in
unlawful monetary transactions.
Case 19: Winchester Man Charged with
COVID-Relief Fraud
Wire fraud, making false statement
to a financial institution
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
27
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 20: Little Rock Woman Charged with
COVID Relief Fraud
Bank fraud, making a false
statement on a loan application,
engaging in monetary transaction
with proceeds of unlawful activity.
Case 21: West L.A. Man Charged with
Fraudulently Obtaining about $9 Million
in COVID-Relief Loans, Some of Which He
Gambled Away in Las Vegas
Bank fraud
Case 22: Washington Tech Executive
Charged with COVID-Relief Fraud and Money
Laundering
Wire fraud, money laundering
Case 23: Florida Man who Used COVID-Relief
Funds to Purchase Lamborghini Sports Car
Charged in Miami Federal Court
Bank fraud, making false
statements to a financial
institution, engaging in
transactions in unlawful proceeds.
Case 24: Florida Man Charged with COVID
Relief Fraud, Health Care Fraud and Money
Laundering
Wire fraud, health care fraud,
conspiracy to commit health care
fraud and wire fraud, making
false statements to a financial
institution, money laundering
Case 25: Houston entrepreneur charged with
spending COVID relief funds on improper
expenses including Lamborghini and strip club
Making false statements to a
financial institution, wire fraud,
bank fraud, and engaging in
unlawful monetary transactions.
Case 26: Five Charged in Connection with an
over $4 Million Paycheck Protection Program
Fraud Scheme
Conspiracy to commit bank and
wire fraud, bank fraud, wire fraud,
false statements to a financial
institution and money laundering.
Case 27: Nine charged in $24 million COVID-
relief fraud scheme
Wire fraud, bank fraud, obstruction
of justice, conspiracy to commit
bank and wire fraud.
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
28
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 28: San Fernando Valley Man Charged
with Fraudulently Obtaining COVID-Relief
Loans for His Sham Sewing Company
Bank fraud
Case 29: District Man Charged with Over $2
Million in Paycheck Protection Program and
Related Loan Fraud
Embezzlement, bank fraud, wire
fraud, money laundering
Case 30: Nevada Woman Charged with COVID-
Relief Fraud
Bank fraud
Case 31: Taiwanese National Arrested for
Misrepresenting Employee Payroll Figures
for Multiple Companies to Receive COVID-19
Loan Funds; Spent Over $275,000 of Loan
Proceeds on Personal Luxury Expenses
Identity theft, bank fraud, wire
fraud, making false statements
to a bank, forging e-signature of
a payroll company employee in
payroll documents
Case 32: Minnesota Man Charged with COVID-
Relief Fraud and Money Laundering
Wire fraud, money laundering
Case 33: Man Pleads Guilty to COVID-19 Fraud
Involving Paycheck Protection Program
Conspiracy to defraud the U.S.
Case 34: North Carolina Man Charged with
COVID-19 Relief Fraud
Wire fraud, bank fraud
Case 35: Miami Neighbors Charged with
COVID-Relief Fraud after Falsely Claiming to be
Farmers
Wire fraud, false statements
Case 36: Nevada Man Charged with Using
COVID-Relief Funds to Buy House
Wire fraud, bank fraud,
concealment of money laundering
and engaging in unlawful monetary
transactions
Case 37: Two Men Who Allegedly Used
Synthetic Identities, Existing Shell Companies,
and Prior Fraud Experience to Exploit Covid-19
Relief Programs Charged in Miami Federal
Court
Bank fraud, conspiracy for allegedly
using synthetic identities for
defrauding banks and stealing
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
29
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 38: Michigan Man Charged with COVID-
Relief Fraud
Wire fraud
Case 39: New Jersey Attorney Charged with
Fraudulently Obtaining $9 Million in Loans
Meant to Help Small Businesses During
COVID-19 Pandemic
Bank fraud, money laundering
Case 40: NFL Player Charged in South Florida
Federal Court for Alleged Role in $24 Million
COVID-Relief Fraud Scheme
Wire fraud, bank fraud, conspiracy
to commit wire fraud, conspiracy to
commit bank fraud
Case 41: Seven Charged in Connection with a
$2.1 Million Money Laundering Scheme that
Involved Money from the Paycheck Protection
Program
Wire fraud, money laundering
Case 42: Two Brothers Charged with COVID
Relief Fraud
Wire fraud conspiracy
Case 43: Texas Man Charged in Miami Federal
Court with Using False Payroll Documents To
Obtain $1.2 Million in Covid Relief
Bank fraud, making false
statements to a financial institution
Case 44: RI Man Charged with Fraudulently
Seeking $4.7 Million in Covid-19 Stimulus
Loans
Making false statements to SBA,
Bank Fraud
Case 45: North Carolina Man Charged with
Fraudulently Seeking Over $6 Million in COVID
Relief Funds
Wire Fraud, Bank Fraud, Engaging
in Unlawful monetary transactions
Case 46: Hawaii CEO Charged with COVID-
Relief Fraud
Bank fraud, money laundering
Case 47: Florida Recording Artist and
Pennsylvania Man Charged for Role in $24
Million COVID-Relief Fraud Scheme
Wire Fraud, Bank Fraud
Case 48: Texas Man Charged In $24 Million
COVID-Relief Fraud
Wire Fraud, Bank Fraud, Money
Laundering
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
30
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 49: Leesburg Man Arrested for $2.5M
CARES Act Loan Fraud
Bank Fraud
Case 50: Five Charged in Connection with
COVID-Relief Fraud Scheme
Bank fraud, money laundering
Case 51: Dade City Man Charged with COVID
Relief Fraud
Bank Fraud, Illegal Monetary
Transactions
Case 52: Washington man charged with
COVID-relief fraud
Wire Fraud
Case 53: Northridge Man Arrested on Charges
that Business Partner and He Fraudulently
Obtained Nearly $2 Million in COVID-Relief
PPP Loans
Making false statements to the
government and SBA, Wire Fraud,
Bank Fraud, Conspiracy
Case 54: Macomb Township Resident Charged
In COVID-19 Bank Fraud Scheme
Bank Fraud
Case 55: Local Basketball Coach Charged in
Federal Court with Defrauding Covid-19 Relief
Program out of Almost $1 Million
Bank Fraud, Money Laundering,
Engaging in Transactions in
Unlawful Proceeds, Making False
Statements to a financial institution
Case 56: Maple Grove Man Charged
With Defrauding The U.S. Small Business
Administration’s Paycheck Protection Program
Wire fraud
Case 57: Seven Charged in Connection with
a COVID-Relief Fraud Scheme Involving more
than 80 Fraudulent Loan Applications Worth
Approximately $16 Million
Wire Fraud, Conspiracy to Commit
Wire Fraud, Money Laundering
Case 58: 4 San Fernando Valley Residents
Indicted for Fraudulently Obtaining Nearly
$5 Million in COVID-Relief Loans for Fake
Businesses
Conspiracy to commit wire fraud,
bank fraud, wire fraud, identity
theft
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
31
DOJ Press Release
Criminal Charges
Fake
Documents
Multiple
Applications
Fake
Business/
Operating
History
ID Theft/
Synthetic
IDs
Misrepresenting
Self-Certified
Information
Case 59: Warren County Businessman
Arrested for Fraudulently Obtaining Nearly
$2 Million in Loans Meant to Help Small
Businesses During COVID-19 Pandemic
Wire Fraud, Bank Fraud, Money
Laundering
Case 60: 3 Defendants Arrested For Over
$13 Million Fraud Scheme To Obtain Loans
Intended To Help Small Businesses During
COVID-19 Pandemic
Wire Fraud, Major Fraud,
Conspiracy to Make False
Statements
Case 61: Sussex County Man Charged with
Fraudulently Obtaining $5.6 Million Loan
Meant to Help Small Businesses During
COVID-19 Pandemic
Bank Fraud and Money Laundering
Case 62: Three From Northwest Arkansas
Plead Guilty To Making False Statements To
Obtain Coronavirus Relief Fund
Making a false statement
Case 63: North Carolina Restaurant Owner
and Son Charged With COVID-Relief Fraud
Wire Fraud, Bank Fraud
Case 64: Four Charged with Covid-19 Fraud
Wire Fraud, Money Laundering
Case 65: Two Men Charged After Fraudulently
Applying for Paycheck Protection Program
Loans
Identity Theft, Bank Fraud
Case 66: Nevada Man Charged with Covid-
Relief Fraud
Wire Fraud, Engaging in
Transactions in Unlawful Proceeds
SMALL BUSINESS ADMINISTRATION PAYCHECK PROTECTION PROGRAM PHASE III FRAUD CONTROLS | JANUARY 21, 2022
32
PRAC Point of Contact:
Brooke Holmes
Associate Director of Oversight and Accountability
Brooke.Holmes@cigie.gov
Visit our website at:
PandemicOversight.gov
Follow us on social media:
@COVID_Oversight
Report fraud, waste, abuse, or misconduct:
To report allegations of fraud, waste, abuse, or misconduct regarding pandemic
relief funds or programs please go to the PRAC website at
PandemicOversight.gov.
A Committee of the
Council of the Inspectors General
on Integrity and Efficiency